Edit tour

Windows Analysis Report
M.V TBN - VESSEL'S DETAILS.docx.scr.exe

Overview

General Information

Sample name:	M.V TBN - VESSEL'S DETAILS.docx.scr.exe
Analysis ID:	1467863
MD5:	856076a266bf66744428123e379d6e54
SHA1:	88e2e194d5944b748671fefa67c61d3c48af7cf6
SHA256:	c09cba9da1f8a6c8fbda87ce1c29455118eb13876286388a7d768ba98585aa78
Tags:	exescr
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

AI detected suspicious sample

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

M.V TBN - VESSEL'S DETAILS.docx.scr.exe (PID: 5528 cmdline: "C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe" MD5: 856076A266BF66744428123E379D6E54)

M.V TBN - VESSEL'S DETAILS.docx.scr.exe (PID: 3472 cmdline: "C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe" MD5: 856076A266BF66744428123E379D6E54)

M.V TBN - VESSEL'S DETAILS.docx.scr.exe (PID: 1080 cmdline: "C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe" MD5: 856076A266BF66744428123E379D6E54)

M.V TBN - VESSEL'S DETAILS.docx.scr.exe (PID: 1480 cmdline: "C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe" MD5: 856076A266BF66744428123E379D6E54)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://beirutrest.com", "Username": "belogs@beirutrest.com", "Password": "9yXQ39wz(uL+"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.4440040719.00000000033CC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.4438476357.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.4438476357.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.4440040719.00000000033A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.4440040719.00000000033A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1993289609.00000000038C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1993289609.00000000038C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: M.V TBN - VESSEL'S DETAILS.docx.scr.exe PID: 5528	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: M.V TBN - VESSEL'S DETAILS.docx.scr.exe PID: 5528	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: M.V TBN - VESSEL'S DETAILS.docx.scr.exe PID: 5528	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: M.V TBN - VESSEL'S DETAILS.docx.scr.exe PID: 1480	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: M.V TBN - VESSEL'S DETAILS.docx.scr.exe PID: 1480	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.3903f90.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.3903f90.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.3903f90.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x312d3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31345:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x313cf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31461:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x314cb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3153d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x315d3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31663:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.3903f90.4.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2e6c6:$s2: GetPrivateProfileString 0x2ddc5:$s3: get_OSFullName 0x2f403:$s5: remove_Key 0x2f592:$s5: remove_Key 0x30473:$s6: FtpWebRequest 0x312b5:$s7: logins 0x31827:$s7: logins 0x3450a:$s7: logins 0x345ea:$s7: logins 0x35ee6:$s7: logins 0x35184:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.38c9970.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.38c9970.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.38c9970.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x312d3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31345:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x313cf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31461:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x314cb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3153d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x315d3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31663:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.38c9970.3.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2e6c6:$s2: GetPrivateProfileString 0x2ddc5:$s3: get_OSFullName 0x2f403:$s5: remove_Key 0x2f592:$s5: remove_Key 0x30473:$s6: FtpWebRequest 0x312b5:$s7: logins 0x31827:$s7: logins 0x3450a:$s7: logins 0x345ea:$s7: logins 0x35ee6:$s7: logins 0x35184:$s9: 1.85 (Hash, version 2, native byte-order)
5.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
5.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x330d3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33145:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x331cf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33261:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x332cb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3333d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x333d3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33463:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
5.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x304c6:$s2: GetPrivateProfileString 0x2fbc5:$s3: get_OSFullName 0x31203:$s5: remove_Key 0x31392:$s5: remove_Key 0x32273:$s6: FtpWebRequest 0x330b5:$s7: logins 0x33627:$s7: logins 0x3630a:$s7: logins 0x363ea:$s7: logins 0x37ce6:$s7: logins 0x36f84:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.3903f90.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.3903f90.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.3903f90.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x330d3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6d4f3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33145:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6d565:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x331cf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6d5ef:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33261:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6d681:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x332cb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6d6eb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3333d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6d75d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x333d3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6d7f3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33463:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6d883:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.3903f90.4.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x304c6:$s2: GetPrivateProfileString 0x6a8e6:$s2: GetPrivateProfileString 0x2fbc5:$s3: get_OSFullName 0x69fe5:$s3: get_OSFullName 0x31203:$s5: remove_Key 0x31392:$s5: remove_Key 0x6b623:$s5: remove_Key 0x6b7b2:$s5: remove_Key 0x32273:$s6: FtpWebRequest 0x6c693:$s6: FtpWebRequest 0x330b5:$s7: logins 0x33627:$s7: logins 0x3630a:$s7: logins 0x363ea:$s7: logins 0x37ce6:$s7: logins 0x6d4d5:$s7: logins 0x6da47:$s7: logins 0x7072a:$s7: logins 0x7080a:$s7: logins 0x72106:$s7: logins 0x36f84:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.38c9970.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.38c9970.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.38c9970.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x330d3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6d6f3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa7b13:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33145:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6d765:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa7b85:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x331cf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6d7ef:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa7c0f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33261:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6d881:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa7ca1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x332cb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6d8eb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa7d0b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3333d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6d95d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa7d7d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x333d3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6d9f3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa7e13:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.38c9970.3.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x304c6:$s2: GetPrivateProfileString 0x6aae6:$s2: GetPrivateProfileString 0xa4f06:$s2: GetPrivateProfileString 0x2fbc5:$s3: get_OSFullName 0x6a1e5:$s3: get_OSFullName 0xa4605:$s3: get_OSFullName 0x31203:$s5: remove_Key 0x31392:$s5: remove_Key 0x6b823:$s5: remove_Key 0x6b9b2:$s5: remove_Key 0xa5c43:$s5: remove_Key 0xa5dd2:$s5: remove_Key 0x32273:$s6: FtpWebRequest 0x6c893:$s6: FtpWebRequest 0xa6cb3:$s6: FtpWebRequest 0x330b5:$s7: logins 0x33627:$s7: logins 0x3630a:$s7: logins 0x363ea:$s7: logins 0x37ce6:$s7: logins 0x6d6d5:$s7: logins
Click to see the 15 entries

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: M.V TBN - VESSEL'S DETAILS.docx.scr.exe

Avira: detected

Found malware configuration

Source: 0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.3903f90.4.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://beirutrest.com", "Username": "belogs@beirutrest.com", "Password": "9yXQ39wz(uL+"}

Multi AV Scanner detection for submitted file

Source: M.V TBN - VESSEL'S DETAILS.docx.scr.exe

ReversingLabs: Detection: 71%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: M.V TBN - VESSEL'S DETAILS.docx.scr.exe

Joe Sandbox ML: detected

Source: M.V TBN - VESSEL'S DETAILS.docx.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.5:49706 version: TLS 1.2

Source: M.V TBN - VESSEL'S DETAILS.docx.scr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View

ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: beirutrest.com

Source: M.V TBN - VESSEL'S DETAILS.docx.scr.exe, 00000005.00000002.4440040719.00000000033CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://beirutrest.com
Source: M.V TBN - VESSEL'S DETAILS.docx.scr.exe, 00000005.00000002.4440040719.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: M.V TBN - VESSEL'S DETAILS.docx.scr.exe, 00000000.00000002.1993289609.00000000038C1000.00000004.00000800.00020000.00000000.sdmp, M.V TBN - VESSEL'S DETAILS.docx.scr.exe, 00000005.00000002.4438476357.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: M.V TBN - VESSEL'S DETAILS.docx.scr.exe, 00000000.00000002.1993289609.00000000038C1000.00000004.00000800.00020000.00000000.sdmp, M.V TBN - VESSEL'S DETAILS.docx.scr.exe, 00000005.00000002.4438476357.0000000000402000.00000040.00000400.00020000.00000000.sdmp, M.V TBN - VESSEL'S DETAILS.docx.scr.exe, 00000005.00000002.4440040719.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: M.V TBN - VESSEL'S DETAILS.docx.scr.exe, 00000005.00000002.4440040719.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: M.V TBN - VESSEL'S DETAILS.docx.scr.exe, 00000005.00000002.4440040719.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.5:49706 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.3903f90.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.3903f90.4.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.38c9970.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.38c9970.3.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 5.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.3903f90.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.3903f90.4.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.38c9970.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.38c9970.3.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen

Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 0_2_00F2E0CC	0_2_00F2E0CC
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 0_2_04DE153C	0_2_04DE153C
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 0_2_04DE20D0	0_2_04DE20D0
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 0_2_04DE0130	0_2_04DE0130
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 0_2_04DE0123	0_2_04DE0123
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 0_2_04DE1568	0_2_04DE1568
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 0_2_04DE1530	0_2_04DE1530
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 0_2_04DFD758	0_2_04DFD758
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 0_2_04DFD74B	0_2_04DFD74B
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 0_2_04DFC040	0_2_04DFC040
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 0_2_04DF5A8C	0_2_04DF5A8C
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 0_2_0700C320	0_2_0700C320
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 0_2_07003850	0_2_07003850
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 0_2_07008408	0_2_07008408
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 0_2_070064D1	0_2_070064D1
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 0_2_070064F0	0_2_070064F0
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 0_2_0700EF80	0_2_0700EF80
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 0_2_07007FC0	0_2_07007FC0
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 0_2_07007FD0	0_2_07007FD0
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 0_2_07008DA7	0_2_07008DA7
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 0_2_07008DB8	0_2_07008DB8
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 0_2_0700EB50	0_2_0700EB50
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 0_2_0700EB60	0_2_0700EB60
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 0_2_07006928	0_2_07006928
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 0_2_07003813	0_2_07003813
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 0_2_07003840	0_2_07003840
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 5_2_018AE5B8	5_2_018AE5B8
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 5_2_018AAA9B	5_2_018AAA9B
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 5_2_018A4A58	5_2_018A4A58
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 5_2_018ADD38	5_2_018ADD38
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 5_2_018A3E40	5_2_018A3E40
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 5_2_018A4188	5_2_018A4188
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 5_2_07058970	5_2_07058970
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 5_2_0705B5F8	5_2_0705B5F8
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 5_2_070655A0	5_2_070655A0
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 5_2_070665F0	5_2_070665F0
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 5_2_0706B238	5_2_0706B238
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 5_2_0706C190	5_2_0706C190
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 5_2_07063060	5_2_07063060
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 5_2_07067D80	5_2_07067D80
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 5_2_070676A0	5_2_070676A0
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 5_2_07062340	5_2_07062340
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 5_2_0706E3A8	5_2_0706E3A8
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 5_2_07060040	5_2_07060040
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 5_2_07065CE3	5_2_07065CE3
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 5_2_07060006	5_2_07060006

Source: M.V TBN - VESSEL'S DETAILS.docx.scr.exe, 00000000.00000000.1980651109.0000000000556000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameBzsV.exeH vs M.V TBN - VESSEL'S DETAILS.docx.scr.exe
Source: M.V TBN - VESSEL'S DETAILS.docx.scr.exe, 00000000.00000002.1992244928.0000000000B6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs M.V TBN - VESSEL'S DETAILS.docx.scr.exe
Source: M.V TBN - VESSEL'S DETAILS.docx.scr.exe, 00000000.00000002.1996635975.0000000005480000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameRT.dll. vs M.V TBN - VESSEL'S DETAILS.docx.scr.exe
Source: M.V TBN - VESSEL'S DETAILS.docx.scr.exe, 00000000.00000002.1992843072.00000000028C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRT.dll. vs M.V TBN - VESSEL'S DETAILS.docx.scr.exe
Source: M.V TBN - VESSEL'S DETAILS.docx.scr.exe, 00000000.00000002.1993289609.0000000003A9E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs M.V TBN - VESSEL'S DETAILS.docx.scr.exe
Source: M.V TBN - VESSEL'S DETAILS.docx.scr.exe, 00000000.00000002.1993289609.00000000038C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename2ee75d06-d489-4537-90fc-92fe0f559436.exe4 vs M.V TBN - VESSEL'S DETAILS.docx.scr.exe
Source: M.V TBN - VESSEL'S DETAILS.docx.scr.exe, 00000000.00000002.1992843072.0000000002923000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename2ee75d06-d489-4537-90fc-92fe0f559436.exe4 vs M.V TBN - VESSEL'S DETAILS.docx.scr.exe
Source: M.V TBN - VESSEL'S DETAILS.docx.scr.exe, 00000000.00000002.1997417808.00000000079C0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs M.V TBN - VESSEL'S DETAILS.docx.scr.exe
Source: M.V TBN - VESSEL'S DETAILS.docx.scr.exe, 00000005.00000002.4438476357.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilename2ee75d06-d489-4537-90fc-92fe0f559436.exe4 vs M.V TBN - VESSEL'S DETAILS.docx.scr.exe
Source: M.V TBN - VESSEL'S DETAILS.docx.scr.exe, 00000005.00000002.4438863315.00000000014F9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs M.V TBN - VESSEL'S DETAILS.docx.scr.exe
Source: M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Binary or memory string: OriginalFilenameBzsV.exeH vs M.V TBN - VESSEL'S DETAILS.docx.scr.exe

Source: M.V TBN - VESSEL'S DETAILS.docx.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.3903f90.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.3903f90.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.38c9970.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.38c9970.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 5.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.3903f90.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.3903f90.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.38c9970.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.38c9970.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload

Source: M.V TBN - VESSEL'S DETAILS.docx.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/1@2/2

Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\M.V TBN - VESSEL'S DETAILS.docx.scr.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe

Mutant created: NULL

Source: M.V TBN - VESSEL'S DETAILS.docx.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: M.V TBN - VESSEL'S DETAILS.docx.scr.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: M.V TBN - VESSEL'S DETAILS.docx.scr.exe

ReversingLabs: Detection: 71%

Source: unknown	Process created: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe "C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe"
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process created: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe "C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe"
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process created: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe "C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe"
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process created: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe "C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe"
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process created: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe "C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe"	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process created: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe "C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe"	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process created: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe "C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe"	Jump to behavior

Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: M.V TBN - VESSEL'S DETAILS.docx.scr.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: M.V TBN - VESSEL'S DETAILS.docx.scr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 0_2_070046D0 push E006E9F9h; ret	0_2_070046D5
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 0_2_0700BFC7 pushad ; retf	0_2_0700BFC9
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 5_2_018AA9E0 push eax; iretd	5_2_018AAA99
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 5_2_018A0C55 push edi; retf	5_2_018A0C7A
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Code function: 5_2_0706E20D push cs; ret	5_2_0706E217

Source: M.V TBN - VESSEL'S DETAILS.docx.scr.exe

Static PE information: section name: .text entropy: 7.812674923163569

Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: M.V TBN - VESSEL'S DETAILS.docx.scr.exe PID: 5528, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Memory allocated: EC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Memory allocated: 28C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Memory allocated: 26E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Memory allocated: 7A40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Memory allocated: 8A40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Memory allocated: 8D00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Memory allocated: 9D00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Memory allocated: 1890000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Memory allocated: 3350000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Memory allocated: 5350000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 598671	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 598343	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 597796	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 597468	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 597359	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 597250	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 597140	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 597031	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 596921	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 596812	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 596702	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 596593	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 596375	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 596265	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 596047	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 595937	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 595718	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 595613	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 595484	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 595375	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 595265	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 595155	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 595046	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 594937	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 594825	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 594707	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 594578	Jump to behavior

Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Window / User API: threadDelayed 8513			Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Window / User API: threadDelayed 1348			Jump to behavior

Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 1288	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -35048813740048126s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7296	Thread sleep count: 8513 > 30	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7296	Thread sleep count: 1348 > 30	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -599328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -599218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -599000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -598890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -598781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -598671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -598562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -598453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -598343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -598234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -598125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -598015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -597906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -597796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -597687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -597578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -597468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -597359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -597250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -597140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -597031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -596921s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -596812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -596702s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -596593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -596484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -596375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -596265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -596156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -596047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -595937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -595828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -595718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -595613s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -595484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -595375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -595265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -595155s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -595046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -594937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -594825s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -594707s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe TID: 7292	Thread sleep time: -594578s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 598671	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 598343	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 597796	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 597468	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 597359	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 597250	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 597140	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 597031	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 596921	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 596812	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 596702	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 596593	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 596375	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 596265	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 596047	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 595937	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 595718	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 595613	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 595484	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 595375	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 595265	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 595155	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 595046	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 594937	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 594825	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 594707	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Thread delayed: delay time: 594578	Jump to behavior

Source: M.V TBN - VESSEL'S DETAILS.docx.scr.exe, 00000005.00000002.4438942608.0000000001631000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllT

Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe

Memory written: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process created: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe "C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe"	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process created: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe "C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe"	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Process created: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe "C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe"	Jump to behavior

Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Queries volume information: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Queries volume information: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.3903f90.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.38c9970.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.3903f90.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.38c9970.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.4440040719.00000000033CC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4438476357.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4440040719.00000000033A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1993289609.00000000038C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: M.V TBN - VESSEL'S DETAILS.docx.scr.exe PID: 5528, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: M.V TBN - VESSEL'S DETAILS.docx.scr.exe PID: 1480, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.3903f90.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.38c9970.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.3903f90.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.38c9970.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.4438476357.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4440040719.00000000033A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1993289609.00000000038C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: M.V TBN - VESSEL'S DETAILS.docx.scr.exe PID: 5528, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: M.V TBN - VESSEL'S DETAILS.docx.scr.exe PID: 1480, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.3903f90.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.38c9970.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.3903f90.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M.V TBN - VESSEL'S DETAILS.docx.scr.exe.38c9970.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.4440040719.00000000033CC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4438476357.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4440040719.00000000033A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1993289609.00000000038C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: M.V TBN - VESSEL'S DETAILS.docx.scr.exe PID: 5528, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: M.V TBN - VESSEL'S DETAILS.docx.scr.exe PID: 1480, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	1 Masquerading	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Email Collection	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	1 Credentials in Registry	111 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	141 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	2 Data from Local System	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	141 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	24 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
M.V TBN - VESSEL'S DETAILS.docx.scr.exe	71%	ReversingLabs	ByteCode-MSIL.Spyware.Negasteal
M.V TBN - VESSEL'S DETAILS.docx.scr.exe	100%	Avira	HEUR/AGEN.1309858
M.V TBN - VESSEL'S DETAILS.docx.scr.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://api.ipify.org/	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
https://api.ipify.org/t	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://beirutrest.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
beirutrest.com	50.87.144.157	true	true		unknown
api.ipify.org	104.26.13.205	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org	M.V TBN - VESSEL'S DETAILS.docx.scr.exe, 00000000.00000002.1993289609.00000000038C1000.00000004.00000800.00020000.00000000.sdmp, M.V TBN - VESSEL'S DETAILS.docx.scr.exe, 00000005.00000002.4438476357.0000000000402000.00000040.00000400.00020000.00000000.sdmp, M.V TBN - VESSEL'S DETAILS.docx.scr.exe, 00000005.00000002.4440040719.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.dyn.com/	M.V TBN - VESSEL'S DETAILS.docx.scr.exe, 00000000.00000002.1993289609.00000000038C1000.00000004.00000800.00020000.00000000.sdmp, M.V TBN - VESSEL'S DETAILS.docx.scr.exe, 00000005.00000002.4438476357.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org/t	M.V TBN - VESSEL'S DETAILS.docx.scr.exe, 00000005.00000002.4440040719.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	M.V TBN - VESSEL'S DETAILS.docx.scr.exe, 00000005.00000002.4440040719.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://beirutrest.com	M.V TBN - VESSEL'S DETAILS.docx.scr.exe, 00000005.00000002.4440040719.00000000033CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.13.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false
50.87.144.157	beirutrest.com	United States		46606	UNIFIEDLAYER-AS-1US	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467863
Start date and time:	2024-07-04 23:38:03 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	M.V TBN - VESSEL'S DETAILS.docx.scr.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/1@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 130 Number of non-executed functions: 23
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: M.V TBN - VESSEL'S DETAILS.docx.scr.exe

Simulations

Behavior and APIs

Time	Type	Description
17:38:47	API Interceptor	13369655x Sleep call for process: M.V TBN - VESSEL'S DETAILS.docx.scr.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.13.205	242764.exe	Get hash	malicious	Ficker Stealer, Rusty Stealer	Browse	api.ipify.org/?format=wef
	Ransom.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	api.ipify.org/
	ld.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	api.ipify.org/
	ReturnLegend.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SecuriteInfo.com.Trojan.DownLoaderNET.960.9931.28151.exe	Get hash	malicious	PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/
	Sky-Beta-Setup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	ArenaWarSetup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
50.87.144.157	MV RIVA WIND - VESSEL's PARTICULARS.PDF.scr.exe	Get hash	malicious	AgentTesla	Browse
	SEACON MANILA V.2304 PARTICULARS(1).pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Lx4YLX1D5O.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
beirutrest.com	MV RIVA WIND - VESSEL's PARTICULARS.PDF.scr.exe	Get hash	malicious	AgentTesla	Browse	50.87.144.157
	SEACON MANILA V.2304 PARTICULARS(1).pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.144.157
	Lx4YLX1D5O.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse	50.87.144.157
api.ipify.org	0001.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	Zz3h8cOX1E.exe	Get hash	malicious	Quasar	Browse	104.26.13.205
	Luciana Alvarez CV.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Acal BFi UK - Products List 020240704.exe	Get hash	malicious	AgentTesla, RedLine, StormKitty, XWorm	Browse	172.67.74.152
	z4XlS0wTQM.exe	Get hash	malicious	Quasar	Browse	104.26.12.205
	Zz3h8cOX1E.exe	Get hash	malicious	Quasar	Browse	104.26.13.205
	5gO02Ijl9V.exe	Get hash	malicious	GuLoader	Browse	104.26.12.205
	0NJYTCJYLo.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	Order 0003994887588960600000.bat.exe	Get hash	malicious	GuLoader	Browse	172.67.74.152
	3.bat.exe	Get hash	malicious	GuLoader	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://www.google.com/url?q=https://authitca-adobue-sign.us-ord-1.linodeobjects.com/apts.html&sa=D&source=editors&ust=1720118061448441&usg=AOvVaw1WUHTIwDQHQCe4Um2Fp0tG	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	am.exe	Get hash	malicious	Amadey	Browse	172.67.208.139
	qeUaxJCA3FO.exe	Get hash	malicious	LummaC	Browse	104.21.27.50
	OVER DUE INVOICE PAYMENT.docx.doc	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	https://1drv.ms/b/c/76a2f2769a0f2d92/EVBBlcPr69hPlwB4teIJkR8BhOEwtE3haDg1sSdukRfZrw?e=geYoLr	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	https://1drv.ms/b/c/76a2f2769a0f2d92/EVBBlcPr69hPlwB4teIJkR8BhOEwtE3haDg1sSdukRfZrw?e=geYoLr	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	file.exe	Get hash	malicious	LummaC, SmokeLoader	Browse	104.21.45.251
	xJwSq336bs.pdf	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://chorbie.com/services/	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://share.mindmanager.com/#publish/mnPTcUqLfLnU6HRHMb6xC3qXYGZYU6tmBtOy3sS6	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
UNIFIEDLAYER-AS-1US	PO#RSB-8927393_2324.exe	Get hash	malicious	FormBook	Browse	162.241.216.26
	SecuriteInfo.com.Win32.MalwareX-gen.20684.5190.exe	Get hash	malicious	AgentTesla	Browse	162.241.62.63
	80TeZdsbeA6B6j4.exe	Get hash	malicious	FormBook	Browse	50.87.148.119
	https://t.apemail.net/c/nqkr6vk3kzmvyhqvdmdrwaabbycqmbacainqogyhdmkxs5qvdmkqcvagayhveflk-nqdbwfkcivnrkgyvpf3bkgygamaa4bqedmcagbahdmdrwbqbaibq4aypdmdrwby3cupvkw2wlfob4fi3a4nvsqs3lmnrkyl6ojqbozlsm54gkyyvdmaacdqfaycaeaq3cvpugq2hiqgrqgc6ljdvwvsfkjjveu2skjmuixszlamviwc2dfkukgcai4nfiwczinjfsqyylnmfqryylzmvguspdfpugws3cunugrkckinqaaqcdmkxs5qvdnmuew23dnmuew23dnmuew23dnmuew23dmkqcvagayhveflk	Get hash	malicious	HTMLPhisher	Browse	108.167.151.63
	PMcyGpR57k.elf	Get hash	malicious	Unknown	Browse	74.91.234.112
	ztGOiA742S.elf	Get hash	malicious	Unknown	Browse	142.5.50.93
	Purchase order No. 1073 xls.wsf	Get hash	malicious	Unknown	Browse	192.185.76.254
	RFQ - MK FMHS.RFQ.24.101.exe	Get hash	malicious	FormBook	Browse	162.241.253.174
	http://customer-easyparkas.com/	Get hash	malicious	Unknown	Browse	192.185.50.220
	Electronic Slip_metroplus.org.html	Get hash	malicious	HTMLPhisher	Browse	192.185.131.129

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	file.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	TahsilatMakbuzu.cmd.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	TahsilatMakbuzu.cmd.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	hANEXOPDF.PDF40 234057.msi	Get hash	malicious	Unknown	Browse	104.26.13.205
	0001.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	Luciana Alvarez CV.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Acal BFi UK - Products List 020240704.exe	Get hash	malicious	AgentTesla, RedLine, StormKitty, XWorm	Browse	104.26.13.205
	Zz3h8cOX1E.exe	Get hash	malicious	Quasar	Browse	104.26.13.205
	5gO02Ijl9V.exe	Get hash	malicious	GuLoader	Browse	104.26.13.205
	0NJYTCJYLo.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205

Process:	C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLV1qE4jE4K5E4KlKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:Mp1qHjHK5HKlYHKh3oPtHo6hAHKze0HJ
MD5:	B3F9683FD57A94D3C3F5E1AEC259CEAD
SHA1:	EC2310112CBA894207F624FCC35E9C0FCE80EE2F
SHA-256:	97FC8E1E4A9D08C91DEC78055942F0562C6EEC2480F5DDA2E7A9E9358AC86F94
SHA-512:	37407216C4E44C3FFF758637D4661AA9CCAC1C34C9AFEDEAF4ACEFEE8F527921046004F90CD2AE304E1A0EAFB636AC7F0DDBCED579C6642E7C32746491E854F2
Malicious:	true
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.804922237700636
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	M.V TBN - VESSEL'S DETAILS.docx.scr.exe
File size:	734'720 bytes
MD5:	856076a266bf66744428123e379d6e54
SHA1:	88e2e194d5944b748671fefa67c61d3c48af7cf6
SHA256:	c09cba9da1f8a6c8fbda87ce1c29455118eb13876286388a7d768ba98585aa78
SHA512:	a5aeb1f440fb332eb5c8cac0ac2c2a5027984acf87c16716e5e96620fd4e379e0a07776e35c2099221ae21ad440d83ec98ca6f6bcd7bc163d6c56d91e52458da
SSDEEP:	12288:4cxbJytLuL+vKDrPvBMVe/CPMvLM2isPhGCMQJ46Bh7zl:4cxbJnHegVTHisJYjUhN
TLSH:	B7F4121DA6FD9F27C9BB5BBA219100080373D856F21BF7AE5ECC18E61F42780854A75B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....yf.................,..........>J... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4b4a3e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x667904A4 [Mon Jun 24 05:31:16 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb49e8	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb6000	0x600	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb8000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xb2a44	0xb2c00	c2ad31cad1851379ccb3c3add89f7c78	False	0.8979744864510489	data	7.812674923163569	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xb6000	0x600	0x600	db63f569da53ef159fdbb76ef50bafd5	False	0.435546875	data	4.198235523205387	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb8000	0xc	0x200	f5de5a97e8dd4f99e6e87df9187a1ec1	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xb6090	0x358	data			0.4287383177570093
RT_MANIFEST	0xb63f8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 4, 2024 23:38:50.090708971 CEST	49706	443	192.168.2.5	104.26.13.205
Jul 4, 2024 23:38:50.090759993 CEST	443	49706	104.26.13.205	192.168.2.5
Jul 4, 2024 23:38:50.090831995 CEST	49706	443	192.168.2.5	104.26.13.205
Jul 4, 2024 23:38:50.119729996 CEST	49706	443	192.168.2.5	104.26.13.205
Jul 4, 2024 23:38:50.119764090 CEST	443	49706	104.26.13.205	192.168.2.5
Jul 4, 2024 23:38:50.629751921 CEST	443	49706	104.26.13.205	192.168.2.5
Jul 4, 2024 23:38:50.629837990 CEST	49706	443	192.168.2.5	104.26.13.205
Jul 4, 2024 23:38:50.633759975 CEST	49706	443	192.168.2.5	104.26.13.205
Jul 4, 2024 23:38:50.633779049 CEST	443	49706	104.26.13.205	192.168.2.5
Jul 4, 2024 23:38:50.634067059 CEST	443	49706	104.26.13.205	192.168.2.5
Jul 4, 2024 23:38:50.676076889 CEST	49706	443	192.168.2.5	104.26.13.205
Jul 4, 2024 23:38:50.720499039 CEST	443	49706	104.26.13.205	192.168.2.5
Jul 4, 2024 23:38:50.791158915 CEST	443	49706	104.26.13.205	192.168.2.5
Jul 4, 2024 23:38:50.791208982 CEST	443	49706	104.26.13.205	192.168.2.5
Jul 4, 2024 23:38:50.791294098 CEST	49706	443	192.168.2.5	104.26.13.205
Jul 4, 2024 23:38:50.796081066 CEST	49706	443	192.168.2.5	104.26.13.205
Jul 4, 2024 23:38:51.651688099 CEST	49708	21	192.168.2.5	50.87.144.157
Jul 4, 2024 23:38:51.656521082 CEST	21	49708	50.87.144.157	192.168.2.5
Jul 4, 2024 23:38:51.656605005 CEST	49708	21	192.168.2.5	50.87.144.157
Jul 4, 2024 23:38:51.659643888 CEST	49708	21	192.168.2.5	50.87.144.157
Jul 4, 2024 23:38:51.664680004 CEST	21	49708	50.87.144.157	192.168.2.5
Jul 4, 2024 23:38:51.664890051 CEST	49708	21	192.168.2.5	50.87.144.157

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 4, 2024 23:38:50.077231884 CEST	49406	53	192.168.2.5	1.1.1.1
Jul 4, 2024 23:38:50.084377050 CEST	53	49406	1.1.1.1	192.168.2.5
Jul 4, 2024 23:38:51.320318937 CEST	54584	53	192.168.2.5	1.1.1.1
Jul 4, 2024 23:38:51.650697947 CEST	53	54584	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 4, 2024 23:38:50.077231884 CEST	192.168.2.5	1.1.1.1	0xc2a4	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Jul 4, 2024 23:38:51.320318937 CEST	192.168.2.5	1.1.1.1	0xcc39	Standard query (0)	beirutrest.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jul 4, 2024 23:38:50.084377050 CEST	1.1.1.1	192.168.2.5	0xc2a4	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Jul 4, 2024 23:38:50.084377050 CEST	1.1.1.1	192.168.2.5	0xc2a4	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Jul 4, 2024 23:38:50.084377050 CEST	1.1.1.1	192.168.2.5	0xc2a4	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Jul 4, 2024 23:38:51.650697947 CEST	1.1.1.1	192.168.2.5	0xcc39	No error (0)	beirutrest.com	50.87.144.157	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	104.26.13.205	443	1480	C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 21:38:50 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-07-04 21:38:50 UTC	211	IN	HTTP/1.1 200 OK Date: Thu, 04 Jul 2024 21:38:50 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89e243bb0e3b4373-EWR
2024-07-04 21:38:50 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Target ID:	0
Start time:	17:38:47
Start date:	04/07/2024
Path:	C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe"
Imagebase:	0x4a0000
File size:	734'720 bytes
MD5 hash:	856076A266BF66744428123E379D6E54
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1993289609.00000000038C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1993289609.00000000038C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:38:48
Start date:	04/07/2024
Path:	C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe"
Imagebase:	0x1c0000
File size:	734'720 bytes
MD5 hash:	856076A266BF66744428123E379D6E54
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:38:48
Start date:	04/07/2024
Path:	C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe"
Imagebase:	0x3c0000
File size:	734'720 bytes
MD5 hash:	856076A266BF66744428123E379D6E54
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:38:48
Start date:	04/07/2024
Path:	C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe"
Imagebase:	0xfc0000
File size:	734'720 bytes
MD5 hash:	856076A266BF66744428123E379D6E54
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.4440040719.00000000033CC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.4438476357.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.4438476357.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.4440040719.00000000033A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.4440040719.00000000033A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	7.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	330
Total number of Limit Nodes:	21

Executed Functions

Function 0700C320 Relevance: .6, Instructions: 633COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1997249629.0000000007000000.00000040.00000800.00020000.00000000.sdmp, Offset: 07000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7000000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a69a5e0542ffc7ce25481a45f5000895c3cb65d001a1df360b6600543f506408
Instruction ID: 77da7571681e5ce631eaf0aa7e03a880a3ce9a612ed6aeb5c443edcf7bd18e0f
Opcode Fuzzy Hash: a69a5e0542ffc7ce25481a45f5000895c3cb65d001a1df360b6600543f506408
Instruction Fuzzy Hash: CD32CDB1B012158FEB18DB69D450BAF77F6AF89310F144669E046DB3A1CB34ED01CBA1

Function 04DFD758 Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1995237816.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fb9869b5d8df12247dfaf49d8368bf6a158e32eee1ba7eb9cbb2fae1ccc9dc9
Instruction ID: c41e3ccf2eef5835570d2ef71b3a9a3991cfcc39937797bcdfcfd4d6a5641739
Opcode Fuzzy Hash: 9fb9869b5d8df12247dfaf49d8368bf6a158e32eee1ba7eb9cbb2fae1ccc9dc9
Instruction Fuzzy Hash: 69526D34A003458FDB14DF28C844B99B7F2EF89314F2582E9D5596F3A2DB75A986CF40

Function 04DFD74B Relevance: .6, Instructions: 584COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1995237816.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d93f47250dae107d8e5365dadfe3123e570ea08249fd28726ddaa4473d2a69b
Instruction ID: 0968418c199b37fde7ce6a1ecff646f18a8f50ff457743c91abade187891274b
Opcode Fuzzy Hash: 3d93f47250dae107d8e5365dadfe3123e570ea08249fd28726ddaa4473d2a69b
Instruction Fuzzy Hash: 34525D30A003458FDB14DF28C844B99B7F2EF89314F2582E9D5596F3A2DB75AA86CF40

Function 04DE153C Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1995207602.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4de0000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fbce001c3d39cd1fd4e5c9a839c2024567289d534c7c5f2160532534d4bd144
Instruction ID: 6989c581575fbf84cb829c98e651ba6eb573b11a59445805d3932b295540c7da
Opcode Fuzzy Hash: 5fbce001c3d39cd1fd4e5c9a839c2024567289d534c7c5f2160532534d4bd144
Instruction Fuzzy Hash: 4FA17F35E00319CFCB04EFA5D8549EDBBBAFF8A314F148259E419AB261DB30E942CB51

Function 04DE1568 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1995207602.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4de0000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1523059a7c98e6ae1b9b4ec8136dd5c3a70df6ae5127dedb984f5501747ae061
Instruction ID: f683e2cfcc6c0c148e70e8b0aa0471c42e1bccee52112d7ec332e4778fa9b4aa
Opcode Fuzzy Hash: 1523059a7c98e6ae1b9b4ec8136dd5c3a70df6ae5127dedb984f5501747ae061
Instruction Fuzzy Hash: 5191B235E00319CFCB04EFA5D8549EDB7BAFF8A310B148255E41AAB265DB30E942CB51

Function 04DE1530 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1995207602.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4de0000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccaaddbba44ac84450099f77e9949be8956e58d8e793fdd56e955bd13119bfee
Instruction ID: 396d1f5d1b89cba53d5cef70575c901bf9c7991c3f63e489c81cd43f75d94876
Opcode Fuzzy Hash: ccaaddbba44ac84450099f77e9949be8956e58d8e793fdd56e955bd13119bfee
Instruction Fuzzy Hash: 0A918035E00319DFCB04DFB4D8549EDBBBAFF8A310B148259E419AB2A5DB30E942CB51

Function 04DE20D0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1995207602.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4de0000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3be79fd3436e15d598f5067844146540a4b38b5cc602de7f5d70dc815bec8e65
Instruction ID: 390aae67b5fbe3dac3f8c478e7199f4190cae66d32cb3a050d04e1965d574185
Opcode Fuzzy Hash: 3be79fd3436e15d598f5067844146540a4b38b5cc602de7f5d70dc815bec8e65
Instruction Fuzzy Hash: 6C918135E00319DFCB04DFA4D8549EDFBBAFF8A310B158259E419AB265DB30E942CB51

Function 07003840 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1997249629.0000000007000000.00000040.00000800.00020000.00000000.sdmp, Offset: 07000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7000000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6e38ff71e5c81de2a1bd5bd619e7bdd11474392504e92913c7bb9a85a5ced80
Instruction ID: fb6fac02eb3482dfcd6fed07b30b55f6c9e08d633976becf3400ddcd97bdcee0
Opcode Fuzzy Hash: b6e38ff71e5c81de2a1bd5bd619e7bdd11474392504e92913c7bb9a85a5ced80
Instruction Fuzzy Hash: 09210EB1D146188BEB19CF57C9442EEFBF7AFCD310F14C56A9519B6294DB3005858B80

Function 07003850 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1997249629.0000000007000000.00000040.00000800.00020000.00000000.sdmp, Offset: 07000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7000000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3ba722bd3e7394807292d1a2fbc15fa3ebff1ba6c7ed8fb1bdf19a1a47f7f2d
Instruction ID: 1e2b4109716b33f91d873c100be5ef493b2f9901f7660ef2251c1a3e992bdcc1
Opcode Fuzzy Hash: c3ba722bd3e7394807292d1a2fbc15fa3ebff1ba6c7ed8fb1bdf19a1a47f7f2d
Instruction Fuzzy Hash: 1C21EDB0D146588BEB19CF57C8442EEFEF7AFCE310F14C57A9519B62A4DB3009858B80

Function 07003813 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1997249629.0000000007000000.00000040.00000800.00020000.00000000.sdmp, Offset: 07000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7000000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c8ca51f41af36a371f3091e40f24769bd42ce231d7e5683fdd1640b8b5b269d
Instruction ID: cd4d75f5a266e94c4e1faacec9523dddcea0b190e2f8845f928f2dbf8e3bb648
Opcode Fuzzy Hash: 4c8ca51f41af36a371f3091e40f24769bd42ce231d7e5683fdd1640b8b5b269d
Instruction Fuzzy Hash: B11130B5D186548BEB09CF67C8401FEFFB7AFCA310F08C56AD519A61A5DB3405468B80

Function 04DFC938 Relevance: 6.4, Strings: 5, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4']q, xrefs: 04DFC9A3
4']q, xrefs: 04DFC9E9
4']q, xrefs: 04DFC9C6
4']q, xrefs: 04DFCA2F
4']q, xrefs: 04DFCA0C

Memory Dump Source

Source File: 00000000.00000002.1995237816.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_M.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$4']q
API String ID: 0-4248691736
Opcode ID: 0a60cde78e6a0aac49d5a370a7d353b83cc344ac85f868b72728eacadc6142c9
Instruction ID: 4deecc12dfcf8c389890fc944bdd2e73e76865564af3aa3e1e76496498fc1ff9
Opcode Fuzzy Hash: 0a60cde78e6a0aac49d5a370a7d353b83cc344ac85f868b72728eacadc6142c9
Instruction Fuzzy Hash: 36417130B1010A8BCF08EFB8E8516DDBBF6FF84710F5445B9D049AB255EB35AA45CBA1

Function 04DFD458 Relevance: 2.7, Strings: 2, Instructions: 171
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 04DFEDC0
(aq, xrefs: 04DFECA2

Memory Dump Source

Source File: 00000000.00000002.1995237816.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_M.jbxd

Similarity

API ID:
String ID: (aq$Haq
API String ID: 0-3785302501
Opcode ID: af655818ed994ea7c9abc262c7e43ae2e4f63a51eb2340b12edcd1c9c3aa7856
Instruction ID: e997a2ec5ee073690ffbc1d58deb2538a2aec5fb7b928dd2fda90dfa99e5f9ad
Opcode Fuzzy Hash: af655818ed994ea7c9abc262c7e43ae2e4f63a51eb2340b12edcd1c9c3aa7856
Instruction Fuzzy Hash: 505122316042109FC325AF28D8946AD7BE6FFC5300B1A84AAD5499BB66CE35FC46C791

Function 0700992D Relevance: 1.8, APIs: 1, Instructions: 250
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07009B6E

Memory Dump Source

Source File: 00000000.00000002.1997249629.0000000007000000.00000040.00000800.00020000.00000000.sdmp, Offset: 07000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7000000_M.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 9f74b6e0981d50d8a24df78060316d1c24c9ccdefc9efe4829a057b46b3043bb
Instruction ID: 87ffcfc6fdcff4aae473e28a7fe769338c19f32643049e0d257a0b6e7800d1e2
Opcode Fuzzy Hash: 9f74b6e0981d50d8a24df78060316d1c24c9ccdefc9efe4829a057b46b3043bb
Instruction Fuzzy Hash: 6EA180B1D1021ACFEB24CF68C841BDDBBF2BF45314F148269D848A7281DB75A995CF92

Function 07009938 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07009B6E

Memory Dump Source

Source File: 00000000.00000002.1997249629.0000000007000000.00000040.00000800.00020000.00000000.sdmp, Offset: 07000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7000000_M.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 73bdd2f9be52525f817f1bd53c1490a31850de694b2e0f0691207a878c1729fe
Instruction ID: 94028e98bf3896e8717fa95bcb1f1f2251c3b428470b4986d5fc40c34d736f54
Opcode Fuzzy Hash: 73bdd2f9be52525f817f1bd53c1490a31850de694b2e0f0691207a878c1729fe
Instruction Fuzzy Hash: A3918FB1D1021ACFEB24CF68C841BEDBBF2BF45310F148269D858A7291DB74A995CF91

Function 00F2B328 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1992599088.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_M.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 69b3e7db4a70dfd973d8eb5d1c6588dc1876e8eccb6302d8f55b5ba9ce94d9af
Instruction ID: ada9d3b0c00baa6bf8a6542246fdf0fc0c3b913fa2dde48aaad2021453f22499
Opcode Fuzzy Hash: 69b3e7db4a70dfd973d8eb5d1c6588dc1876e8eccb6302d8f55b5ba9ce94d9af
Instruction Fuzzy Hash: F7714670A00B158FD724DF29E49579ABBF1FF88314F00892DD84AD7A50EB78E945CB91

Function 04DE14E8 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04DE1EEA

Memory Dump Source

Source File: 00000000.00000002.1995207602.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4de0000_M.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 38b31fb48633c9ba54b897b0bd243b192e77d935b6b048bb111feea434dd7ede
Instruction ID: 0dfd3f1588332e1dcf64a013c361b0b059ecea0b84f349132d74f4d68415bb78
Opcode Fuzzy Hash: 38b31fb48633c9ba54b897b0bd243b192e77d935b6b048bb111feea434dd7ede
Instruction Fuzzy Hash: 2A51B2B1D10309DFDB14DF9AC884ADEBBB5FF48310F24812AE819AB250D775A885CF90

Function 04DE1DCC Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04DE1EEA

Memory Dump Source

Source File: 00000000.00000002.1995207602.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4de0000_M.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 0ca4cf21b8b88bd8cf0eee97459a1ca5d10e7589652173d5b4d083e7d7d83c35
Instruction ID: e6131ea2dd81c1a820174b7ced89498ef7b8b52040e4965379a741835c324b11
Opcode Fuzzy Hash: 0ca4cf21b8b88bd8cf0eee97459a1ca5d10e7589652173d5b4d083e7d7d83c35
Instruction Fuzzy Hash: 7751C1B1D00309DFDB14DF9AD884ADDBBB6BF48300F24812AE419AB250DB75A885CF90

Function 00F261F5 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00F262B1

Memory Dump Source

Source File: 00000000.00000002.1992599088.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_M.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 514cd8d8881fd89860eea2aca9ab8e1a6c6944f205df185d9e1c4019c8dbc808
Instruction ID: 68500316b3b8697722b0ccb70f7d6831841651655c4c203388c1dc886f25c71f
Opcode Fuzzy Hash: 514cd8d8881fd89860eea2aca9ab8e1a6c6944f205df185d9e1c4019c8dbc808
Instruction Fuzzy Hash: 7E4104B0C00719CFDB24DFA9C9447CDBBB1BF88304F20806AD418AB255DB75A94ACF90

Function 04DE163C Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04DE4461

Memory Dump Source

Source File: 00000000.00000002.1995207602.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4de0000_M.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 79a781937c6557ca1b97864da169ac553f646105f6ab0a6e1f117b205a14bff2
Instruction ID: be044d12c6f5ef8ae4f61a2d48fe219283795e10826987dc16acad4df13e2f6b
Opcode Fuzzy Hash: 79a781937c6557ca1b97864da169ac553f646105f6ab0a6e1f117b205a14bff2
Instruction Fuzzy Hash: 994117B5A00209CFDB14DF9AC488AAABBF5FF88318F24C459D519A7321D774E845CFA0

Function 00F24D78 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00F262B1

Memory Dump Source

Source File: 00000000.00000002.1992599088.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_M.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: cb504f89bd60d401002ee5d64ee4f0d20386ba560241c3e7442e21f446f82e73
Instruction ID: 47cce809d3056c0f6a96fc49bf000553916ffe9a385fc6da5340bd47b32d8eea
Opcode Fuzzy Hash: cb504f89bd60d401002ee5d64ee4f0d20386ba560241c3e7442e21f446f82e73
Instruction Fuzzy Hash: B541E0B0C0071DCBDB24DFA9C944B9DBBF5BF88304F20806AD419AB255DB75A94ACF91

Function 070092A8 Relevance: 1.6, APIs: 1, Instructions: 72injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07009340

Memory Dump Source

Source File: 00000000.00000002.1997249629.0000000007000000.00000040.00000800.00020000.00000000.sdmp, Offset: 07000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7000000_M.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 54bc59443126abf6ab61c8c421a32e8e459f2424c45614cba853ab186c5a3adb
Instruction ID: 4ce992525ea09fe60e33068ae38062e38c6f633b35385234d95bbb26a3a83686
Opcode Fuzzy Hash: 54bc59443126abf6ab61c8c421a32e8e459f2424c45614cba853ab186c5a3adb
Instruction Fuzzy Hash: BB2148B59003499FDB10CFA9C845BEEBBF5FF48310F508429E559A7281C778A544CFA0

Function 070092B0 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07009340

Memory Dump Source

Source File: 00000000.00000002.1997249629.0000000007000000.00000040.00000800.00020000.00000000.sdmp, Offset: 07000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7000000_M.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: cceac1cf8876c089b0c53de95c5f12fbca2d0a1bfb16ab1899cf6f07502a217e
Instruction ID: 3c974009f2c58e2f9fd7fd8f5b303be748c4183d662ef526cf490d60def27453
Opcode Fuzzy Hash: cceac1cf8876c089b0c53de95c5f12fbca2d0a1bfb16ab1899cf6f07502a217e
Instruction Fuzzy Hash: 5E212AB19003099FDB10DFA9C845BEEBBF5FF48310F108429E519A7241C778A544CFA4

Function 07009399 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07009420

Memory Dump Source

Source File: 00000000.00000002.1997249629.0000000007000000.00000040.00000800.00020000.00000000.sdmp, Offset: 07000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7000000_M.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: d1ce66f73e162ebdcbed50e8db37ba158fe40608593b39ae9832ceaf7f4db4ab
Instruction ID: 0d534c1d275f8af42e88f58db820f00a7578a62e22f3e313ec7f013b61e84d81
Opcode Fuzzy Hash: d1ce66f73e162ebdcbed50e8db37ba158fe40608593b39ae9832ceaf7f4db4ab
Instruction Fuzzy Hash: 63214AB1C003499FCB10DFAAC845AEEFBF5FF48310F508429E518A7240C779A540CBA1

Function 00F2B214 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00F2D7CE,?,?,?,?,?), ref: 00F2D88F

Memory Dump Source

Source File: 00000000.00000002.1992599088.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_M.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8aa18c4bbaba889b3954d56065956688d913e03423641eaac982d2823b4cae4f
Instruction ID: a76eb1d6d55dba8a8f81594dd97887ef74c6e58ff15e463d31b2c542a0201b1c
Opcode Fuzzy Hash: 8aa18c4bbaba889b3954d56065956688d913e03423641eaac982d2823b4cae4f
Instruction Fuzzy Hash: D821E4B5D00218DFDB10DF9AD584AEEBBF8FB48310F14842AE958A7350D378A950DFA0

Function 00F2D800 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00F2D7CE,?,?,?,?,?), ref: 00F2D88F

Memory Dump Source

Source File: 00000000.00000002.1992599088.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_M.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6b6ee02b78affbddfa60c2002b39609ce0a71feeab4a54b28da0ad79b66a5d7b
Instruction ID: 99167662984a4c7fdc74e02b1c05a70221c3b30fdae5b575ae48a502cdcf1201
Opcode Fuzzy Hash: 6b6ee02b78affbddfa60c2002b39609ce0a71feeab4a54b28da0ad79b66a5d7b
Instruction Fuzzy Hash: 7521F4B59002089FDB10CF99D484ADEBBF4FB48310F10841AE958A7310D378A941DFA0

Function 07008CDF Relevance: 1.6, APIs: 1, Instructions: 64threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07008D5E

Memory Dump Source

Source File: 00000000.00000002.1997249629.0000000007000000.00000040.00000800.00020000.00000000.sdmp, Offset: 07000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7000000_M.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: fc9d7ba3c7c0100b756228664240e63235c391dfb402934ee16f71157bd67a11
Instruction ID: 2b1b9860d3e61498d705aff845179885e745067f9297e0a40ad7c82dc0e4bf36
Opcode Fuzzy Hash: fc9d7ba3c7c0100b756228664240e63235c391dfb402934ee16f71157bd67a11
Instruction Fuzzy Hash: EF2138B19003098FDB10DFAAC4857EEBBF4FF48324F10842AD419A7280DB78A945CFA1

Function 070093A0 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07009420

Memory Dump Source

Source File: 00000000.00000002.1997249629.0000000007000000.00000040.00000800.00020000.00000000.sdmp, Offset: 07000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7000000_M.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 1e51d7cee42475ac382ecf41335da8cb71bc40b199366bd5829553556fa3e807
Instruction ID: 1f8981d96ff952cb56a6ed841d0f7213f555dde554b62adcc89364b6249cb5b4
Opcode Fuzzy Hash: 1e51d7cee42475ac382ecf41335da8cb71bc40b199366bd5829553556fa3e807
Instruction Fuzzy Hash: AE2139B1C003499FDB10DFAAC845AEEFBF5FF48310F508429E519A7240C778A940CBA0

Function 07008CE0 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07008D5E

Memory Dump Source

Source File: 00000000.00000002.1997249629.0000000007000000.00000040.00000800.00020000.00000000.sdmp, Offset: 07000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7000000_M.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: e07f78f647c68b14ee3f37cbd29ac16e3e0d19c2d5861e8873639f24d9e6c553
Instruction ID: 85c27dd041a5b2ecad497ad348e7f84903ebe2b25abc192c6d1ea3aedd5ee3f5
Opcode Fuzzy Hash: e07f78f647c68b14ee3f37cbd29ac16e3e0d19c2d5861e8873639f24d9e6c553
Instruction Fuzzy Hash: 8A2138B19003098FDB10DFAAC4857EEBBF4FF48324F10842AD419A7280DB78A945CFA1

Function 070091E8 Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0700925E

Memory Dump Source

Source File: 00000000.00000002.1997249629.0000000007000000.00000040.00000800.00020000.00000000.sdmp, Offset: 07000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7000000_M.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 96cae726f4895805c631df38fec956ab182453b9284cd2fdb33b3c60bf059bf5
Instruction ID: 18db1cc81dfd8c82a8355c48e60a534655e6f766322ade029fed4406f83b85e8
Opcode Fuzzy Hash: 96cae726f4895805c631df38fec956ab182453b9284cd2fdb33b3c60bf059bf5
Instruction Fuzzy Hash: 27114AB19002499FDB20DFAAC844AEEFBF5EF48320F108419E519A7250C779A540CFA0

Function 00F2AFE8 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00F2B5F9,00000800,00000000,00000000), ref: 00F2B80A

Memory Dump Source

Source File: 00000000.00000002.1992599088.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_M.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 3d37650dd0a496b8d939cd61614f527365c95f0ce1f8f922a80dbe2babf6a5ed
Instruction ID: e9e6c520b3c1693f72de82fb7eeafc1d6f6bdad03e5dc8dc5ec60ae12933ad1f
Opcode Fuzzy Hash: 3d37650dd0a496b8d939cd61614f527365c95f0ce1f8f922a80dbe2babf6a5ed
Instruction Fuzzy Hash: 2E11E7B6D003599FDB10DF9AD444ADEFBF8EB88310F10842AE919A7200C379A545CFA5

Function 070091F0 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0700925E

Memory Dump Source

Source File: 00000000.00000002.1997249629.0000000007000000.00000040.00000800.00020000.00000000.sdmp, Offset: 07000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7000000_M.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 17ecff534f6affdd0b7d37d2ea219c37c2bbd14c2553b6ed6c0e6e7faa14acce
Instruction ID: 04e4a93f14ea24f3ee1f6506cf6c4a257b8fdad202c70e889bf5d7d702ab240c
Opcode Fuzzy Hash: 17ecff534f6affdd0b7d37d2ea219c37c2bbd14c2553b6ed6c0e6e7faa14acce
Instruction Fuzzy Hash: 031137B19002499FDB20DFAAC844AEEFFF5EF88320F108419E519A7250CB79A540CFA0

Function 00F2B798 Relevance: 1.6, APIs: 1, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00F2B5F9,00000800,00000000,00000000), ref: 00F2B80A

Memory Dump Source

Source File: 00000000.00000002.1992599088.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_M.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 2a951c7c4f475640a9024e05f5db9d872be97d927e59125ac3ea024bd55c1b91
Instruction ID: da5dff09afd6dcda28b40a48460b96a510a4a433c00fc25ee2481a76f9f593da
Opcode Fuzzy Hash: 2a951c7c4f475640a9024e05f5db9d872be97d927e59125ac3ea024bd55c1b91
Instruction Fuzzy Hash: F211F3B6D00209CFDB14CFAAD444ADEFBF9EB88320F10842AD959A7250C779A545CFA4

Function 0700BF28 Relevance: 1.6, APIs: 1, Instructions: 50windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0700BF8D

Memory Dump Source

Source File: 00000000.00000002.1997249629.0000000007000000.00000040.00000800.00020000.00000000.sdmp, Offset: 07000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7000000_M.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 83ffc7fc711a923a84d9864c3ceab82790eba720a18585a08e5041333ada3c11
Instruction ID: 40f5828e766d65973a9b48e60983bdaffefe56eab74a192eaf57adb52be4fe18
Opcode Fuzzy Hash: 83ffc7fc711a923a84d9864c3ceab82790eba720a18585a08e5041333ada3c11
Instruction Fuzzy Hash: 5B11A4B58003499FDB10DF99D845BEEBBF8EB58320F20841AE558A7240D3756994CFA5

Function 00F28870 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,00F2B344), ref: 00F2B57E

Memory Dump Source

Source File: 00000000.00000002.1992599088.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_M.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 88326e35c55bd42b6324a80c5d16c61be3dba77a5a595982f7d75a6077e1b9d1
Instruction ID: 5eea56d463a5238bd3d44fd99b7da171952f2adfc07eecc6e76a04bb1c972f1b
Opcode Fuzzy Hash: 88326e35c55bd42b6324a80c5d16c61be3dba77a5a595982f7d75a6077e1b9d1
Instruction Fuzzy Hash: 771132B1C00749CFCB20CF9AD444A9EFBF4EF88324F14802AD819A7214D379A945CFA0

Function 0700D360 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0700D3C0

Memory Dump Source

Source File: 00000000.00000002.1997249629.0000000007000000.00000040.00000800.00020000.00000000.sdmp, Offset: 07000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7000000_M.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: c2c40f10b401cbe74af02fbfe566e5e1f12a5e05d28295f3292f4207bf47a5bf
Instruction ID: 15f9f639dc5adcf5fb874aad694cb41f054033fc2361601c5ff0cf4b31a38efa
Opcode Fuzzy Hash: c2c40f10b401cbe74af02fbfe566e5e1f12a5e05d28295f3292f4207bf47a5bf
Instruction Fuzzy Hash: 1A1113B59003498FDB20DF99C449BEEBBF4EB48320F108469D968A7240D738A544CFA5

Function 070095DC Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0700BF8D

Memory Dump Source

Source File: 00000000.00000002.1997249629.0000000007000000.00000040.00000800.00020000.00000000.sdmp, Offset: 07000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7000000_M.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 2ba05e5461610aec7041883bbb42fde96ea873f7c41c81a04971cb9b6f02d404
Instruction ID: 6094d9d0358a553761ae26ee6f9eb42b5159e6cb7e464c32c24d5d5f054ae779
Opcode Fuzzy Hash: 2ba05e5461610aec7041883bbb42fde96ea873f7c41c81a04971cb9b6f02d404
Instruction Fuzzy Hash: EC1106B5800349DFDB10DF99D848BEEBBF8EB48320F108419E519A7240C375A944CFE5

Function 0700D368 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0700D3C0

Memory Dump Source

Source File: 00000000.00000002.1997249629.0000000007000000.00000040.00000800.00020000.00000000.sdmp, Offset: 07000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7000000_M.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 00113c36578bbfb0476b1c5ec0375482892f6345fa2f9ed798a926c8936ff134
Instruction ID: afd6c9abcda306bfe9916235019e7e2ece035227d9b9f99408526bbe91b9e8fd
Opcode Fuzzy Hash: 00113c36578bbfb0476b1c5ec0375482892f6345fa2f9ed798a926c8936ff134
Instruction Fuzzy Hash: 811103B5900749CFDB20DF9AD549BEEBBF4EB48320F10842AD568A7240D778A544CFA5

Function 07008C28 Relevance: 1.5, APIs: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07008C92

Memory Dump Source

Source File: 00000000.00000002.1997249629.0000000007000000.00000040.00000800.00020000.00000000.sdmp, Offset: 07000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7000000_M.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: f2204ce7c63931113ac3685a65927ceaa57a8be9b53931cce741cede8349df5f
Instruction ID: 8ffbd096d8754b7b22af0a1d9bb6617c90e547c477debbd53248ca639baeff36
Opcode Fuzzy Hash: f2204ce7c63931113ac3685a65927ceaa57a8be9b53931cce741cede8349df5f
Instruction Fuzzy Hash: 68112AB0800349CFDB64DFAAC449BAEBFF9FF49714F208419D55967280DB786540CBA5

Function 07008C30 Relevance: 1.5, APIs: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07008C92

Memory Dump Source

Source File: 00000000.00000002.1997249629.0000000007000000.00000040.00000800.00020000.00000000.sdmp, Offset: 07000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7000000_M.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 6c8228b61ab7dc75b9a82519adba8e848553f73c2d49f4993f174594483b2fd6
Instruction ID: 7f8503e1f82bab791457ffda09ddd29d2914211587d8196c4a32d5c040dd05ef
Opcode Fuzzy Hash: 6c8228b61ab7dc75b9a82519adba8e848553f73c2d49f4993f174594483b2fd6
Instruction Fuzzy Hash: EB0108B08003498EDB24DFAAC449BAEBFF8EF49714F108419D559A7280DB786544CBA5

Function 04DFF3C0 Relevance: .6, Instructions: 551COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1995237816.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43b9f0902edca05f943f69197dff4a1ac02125931d281fca078779f337f2fc70
Instruction ID: 9c21f39067f100dafcd6a4dc3aed1370fb9c277f63e7016a1c6641d9e0f1ff33
Opcode Fuzzy Hash: 43b9f0902edca05f943f69197dff4a1ac02125931d281fca078779f337f2fc70
Instruction Fuzzy Hash: 0A42D631E10619CFCB24DF69C8946DDB7B1FF89304F1186AAD559BB261EB30AA85CF40

Function 04DFF3B2 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1995237816.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b57e1400f4cb7e80955ab45d635b5c66153df184023fb33c288e0ea197c246a
Instruction ID: ae5e68bc9ecc5ae28d15a87b8978a8c232a8884120f14251d250320e0f6480f0
Opcode Fuzzy Hash: 4b57e1400f4cb7e80955ab45d635b5c66153df184023fb33c288e0ea197c246a
Instruction Fuzzy Hash: C0E1F531E106198FCB24DF68CC946EDB7B1FF49314F1186AAD559AB361EB30AA85CB40

Function 04DFAE88 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1995237816.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36cd97ee17e640f2a469ed0425fc53c81e4e9663b111d43fe78ce39149008157
Instruction ID: 9a0bbb4f85792d0e31aa99dfdfdbb0aef2ccdb7540274bf20c0fd302773b55f1
Opcode Fuzzy Hash: 36cd97ee17e640f2a469ed0425fc53c81e4e9663b111d43fe78ce39149008157
Instruction Fuzzy Hash: 0DB17171B012089FCB14DFA8D994AED7BF2FF88310F1641A5E909AB395DA34BD41CB90

Function 00B1D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991615851.0000000000B1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b1d000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3c910171c20409a78fb89890109778dfd3b246474b0118e28dc686503329fe5
Instruction ID: b9043be20c103a928d2f259e358cd492eaf26f0e91344fc90136115678561475
Opcode Fuzzy Hash: d3c910171c20409a78fb89890109778dfd3b246474b0118e28dc686503329fe5
Instruction Fuzzy Hash: A3213471500240DFDB15DF14D9C0F66BFA6FBA8318F60C5A9E9090B256C33AD896DBB2

Function 04DFB839 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1995237816.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 187c8323b5f71eed10ca7fae78e1bad54a690f9166415d125c6f9842d4c05d8d
Instruction ID: 51aeaa1043a0b9d58c0351aa1cd1c5f2f02d4fabd6db70f5afc75d1031766be0
Opcode Fuzzy Hash: 187c8323b5f71eed10ca7fae78e1bad54a690f9166415d125c6f9842d4c05d8d
Instruction Fuzzy Hash: 9F215E343006108FDB299B39D854A6A77E9FF85714B5580AEE646CB371DB76FC02CB50

Function 04DFC830 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1995237816.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd6cdbf37783ab8311b276e90b13b7f48e93a996ad5db3336f24e6504a40e43b
Instruction ID: db051b878ad4569bef7fe9880658545c95b4d968f0e6f768bc6527e9f7998156
Opcode Fuzzy Hash: fd6cdbf37783ab8311b276e90b13b7f48e93a996ad5db3336f24e6504a40e43b
Instruction Fuzzy Hash: 8821BC71A10B058BDB00AF68D880385B7B5FF88310F1482B9E84C6B34AEB74B949CB90

Function 00B2D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991653122.0000000000B2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b2d000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45221d2f2ca2d2579934ee13db397087375104fce3dfa0973f4312e54f19dbcb
Instruction ID: 037bbb6e4ecaf9d7252d9cc29de37992c7628fc7abb3c6d8ff8256d4cbed1a1d
Opcode Fuzzy Hash: 45221d2f2ca2d2579934ee13db397087375104fce3dfa0973f4312e54f19dbcb
Instruction Fuzzy Hash: A9210471604204EFDB05DF24E9C0F26BBA5FB88314F20C9ADE90D4B296C33AD806CA61

Function 00B2D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991653122.0000000000B2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b2d000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef398dabc6f1fcc9e6a9f4f5235dbdf34543eafe252caaac94107e321408a78b
Instruction ID: f3a6dcb02b9fa39733639b446c1c47a5ba99141937a37917492cbeb5270012b4
Opcode Fuzzy Hash: ef398dabc6f1fcc9e6a9f4f5235dbdf34543eafe252caaac94107e321408a78b
Instruction Fuzzy Hash: 9B21D371504244DFCB14DF24E5D4B17BBA5EB88314F20C5A9D94D4B2A6C33AD807CA61

Function 04DFB848 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1995237816.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beed409bb0ee92833de4631075cc97ed2dc0bfb6d6f233d0cb5131d4b7225b37
Instruction ID: d229a2012a2c97a31cfb8e91a10dacf489bb8ff6aaf5db8c13756c8762b173b4
Opcode Fuzzy Hash: beed409bb0ee92833de4631075cc97ed2dc0bfb6d6f233d0cb5131d4b7225b37
Instruction Fuzzy Hash: AF215B303006108FDB289B39C854A6A73EAEF85714B5584AEE606CB375DB76FC06CB90

Function 04DFB570 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1995237816.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e47ce5ad8e764de1e03eaddb456fdec9fffe6f42734e4942f62a59cb6680cbc
Instruction ID: 8d78dbcc28a7f5b30469a2e47a9b196afca65acde893a6e65d129bb044d73ce0
Opcode Fuzzy Hash: 5e47ce5ad8e764de1e03eaddb456fdec9fffe6f42734e4942f62a59cb6680cbc
Instruction Fuzzy Hash: 16119031F106154BDB20EFA9D8452BEB7B2EB85710F05852AD609A7305EA78B9018781

Function 04DFB560 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1995237816.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2993eab741cc1d9fe8e7850ad3eecab9abc53676aec3c5bd8141e294700efc2
Instruction ID: 1d0e1cc8fd15100059e4819d5e623742cb1f730ec46d5a37c1dda8ef0ce7c196
Opcode Fuzzy Hash: e2993eab741cc1d9fe8e7850ad3eecab9abc53676aec3c5bd8141e294700efc2
Instruction Fuzzy Hash: CF11D072F106158BDB309F69DC456BEB7A2EB85714F15802ACA05D7345EA38BD0187C1

Function 04DFEE77 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1995237816.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ece51997f839f733b2ba570a162cd8e9d08971435ceebf0dc55c69583e83793f
Instruction ID: ce002546fe13ded1658f46151970cc7ae052e9c73a608b9ed95c6f88a22ff41a
Opcode Fuzzy Hash: ece51997f839f733b2ba570a162cd8e9d08971435ceebf0dc55c69583e83793f
Instruction Fuzzy Hash: B01122303043008FD734AA25DC91B6AB7A6FFC5310F55846AE9498B2A6CB74F8068780

Function 00B2D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991653122.0000000000B2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b2d000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28911295abaaea766997444fad376872dfce37ca7e6560a45992606700ed04f4
Instruction ID: 1c97cd86030dafa09e18331260620d654fb7dca7d8a24563087078be0968b27b
Opcode Fuzzy Hash: 28911295abaaea766997444fad376872dfce37ca7e6560a45992606700ed04f4
Instruction Fuzzy Hash: E421A4755083809FCB02CF14D994B12BFB1FB46314F28C5DAD8498F2A7C33A980ACB62

Function 04DFC840 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1995237816.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31cd83089d21c1e40af3ec1b6e7fbd575b8fb4909cf040b8e1a3a2386290ec10
Instruction ID: fd591dbb46a4539dfaae1a5af7ce13b3f6bc2a293cc0a8632ea65461161e73a6
Opcode Fuzzy Hash: 31cd83089d21c1e40af3ec1b6e7fbd575b8fb4909cf040b8e1a3a2386290ec10
Instruction Fuzzy Hash: 3D219A31A10A118BDB00AF68D880785B3A5FF88320F1486B9EC4D7B34AEB75B845CB90

Function 04DFEE88 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1995237816.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2110098dd7615c91306e15769f62585cec85e096ae249e21473e575a9746fb5
Instruction ID: 22d4f3298b463df9f03ef5a764ff3b794306fbd2db50552996ace90cef5c6b3d
Opcode Fuzzy Hash: d2110098dd7615c91306e15769f62585cec85e096ae249e21473e575a9746fb5
Instruction Fuzzy Hash: 531182303003009BD739EA65DC91B6AB3D6FFC5714F55C47AE949872A4CB75F8468790

Function 00B1D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991615851.0000000000B1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b1d000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 9bdc1c9caf17d8ea49a38860db2dd98900a5ac37010fcf288a41bb4d99e9896c
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: E511D376504280CFCB16CF14D5C4B56BFB2FBA8314F24C6A9D9490B656C336D85ACBA2

Function 00B2D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991653122.0000000000B2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b2d000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 2896b91285c2616ba3133837fdb1941bf79877c1b76bbd4b9ffb1c66e15a00f9
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 8F118B75504280DFDB16CF14D5C4B15BBA1FB84314F24CAA9D8494B696C33AD84ACB62

Function 04DFA8CB Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1995237816.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d30523a2685783016102bc5551f24444e8f366dd71ffc45f4b227089d0965d1
Instruction ID: e6b908afd2368e5596435c91b5338130398e6900dcb1c5b6f2f38540ebd0a9a0
Opcode Fuzzy Hash: 2d30523a2685783016102bc5551f24444e8f366dd71ffc45f4b227089d0965d1
Instruction Fuzzy Hash: 5111A030A00214DBDB28EBA4D845BAFB7F5EF45300F018439E55AA77A1DB74BC09CB80

Function 04DF76F0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1995237816.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48e96619dff19853a1affb2acb0ce56aa428b8ef8c0e32c2f8744bbf2f748815
Instruction ID: d3044daf813f103560ef125e3f4c4ad37dfe73680453787161fe09ecbc39ee0c
Opcode Fuzzy Hash: 48e96619dff19853a1affb2acb0ce56aa428b8ef8c0e32c2f8744bbf2f748815
Instruction Fuzzy Hash: 8D11CE30A00218DBDB28EB64D855BAEB7F5FF45300F018829E556A73A0DF74BC08CB81

Function 04DFECE8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1995237816.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9beb1c1e597b28af60beb60e09c3d67bc6d1e7859c07c7d7afd60e0b3de5a52a
Instruction ID: 7740847e199f298c036b5ac6223822e98ef86fce23737a4f5e45743d0391e26a
Opcode Fuzzy Hash: 9beb1c1e597b28af60beb60e09c3d67bc6d1e7859c07c7d7afd60e0b3de5a52a
Instruction Fuzzy Hash: 0B01D472A02621BBD7359F09DC00269FBA4BF45B14B0A421BD66853E21C770F490CBE1

Function 04DFB4C7 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1995237816.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b5d681d0b80701298406df832c6908788d36f2fe94f7e9885d94219deedcd97
Instruction ID: 93059339f040dff26930cdfb83315a041fbb20e178e02da042b2fee1eafdf97a
Opcode Fuzzy Hash: 1b5d681d0b80701298406df832c6908788d36f2fe94f7e9885d94219deedcd97
Instruction Fuzzy Hash: 4B016D343006008FC7509B6DD86896937EAEFCE614B1A40ABE60ACB361CE24FC05CBA1

Function 04DFFF41 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1995237816.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f40b2cb83e5dfcfc2bc7e73e8f9ffd064f97fa9b08a46c2034574355f393816d
Instruction ID: fadbdebe20ee40dc1f111918414690ece912e7172010e8b35ce4018f76d6a7d4
Opcode Fuzzy Hash: f40b2cb83e5dfcfc2bc7e73e8f9ffd064f97fa9b08a46c2034574355f393816d
Instruction Fuzzy Hash: B1F0F6313016008FC725AF29F88485ABBB6FF8A325715066FE50A87266DF39EC07CB51

Function 04DFB4D8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1995237816.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad0dd5b3900f50da4b15e576c424809b0e02d8fa3c3604155e97f1cc0d58cb73
Instruction ID: 7b04e2c26d70f954a852f3a8b7d9ebd576781bc91cc3074f59420fcbec4dcfc7
Opcode Fuzzy Hash: ad0dd5b3900f50da4b15e576c424809b0e02d8fa3c3604155e97f1cc0d58cb73
Instruction Fuzzy Hash: B6F01D343101108FC6449B6DD85C96977EAEFCD715B1940ABE60ACB364CE64FC018B90

Function 04DFFF50 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1995237816.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bab99777d9d1f5260ddabf0b00b90848f85d36858361e34f12fc352e228c93bd
Instruction ID: 77473a116b8c198897d2ae0fa353666c3d0efc33b203553aacafdb16fac996fb
Opcode Fuzzy Hash: bab99777d9d1f5260ddabf0b00b90848f85d36858361e34f12fc352e228c93bd
Instruction Fuzzy Hash: F0F054313006108FC725AB1AE84495AB7BAFFCA725751066EE50687725DF35EC46CB90

Function 04DFD468 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1995237816.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2258972678ad8b060778ff6f6f3e19d913a700dd096cff542db26d209cac9fa
Instruction ID: b9afc45204ddf412af20e853042d798619c777e5ea42d2b31c5a166573a91fbe
Opcode Fuzzy Hash: f2258972678ad8b060778ff6f6f3e19d913a700dd096cff542db26d209cac9fa
Instruction Fuzzy Hash: 3DF02B321501508FC321E62CD8C8AC937A8EF46350F0A41B3E645DB236D539B887C785

Function 04DFB480 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1995237816.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e453de2267ce5b62c20f82f049c506b7306ea8ef4281182c644e8f979c010e5
Instruction ID: 815540e455079dd89a2b291fddf35549f9a80547a115d1d4fa7145c2c82b594e
Opcode Fuzzy Hash: 4e453de2267ce5b62c20f82f049c506b7306ea8ef4281182c644e8f979c010e5
Instruction Fuzzy Hash: 53E09271B10A240B5718FB6ABC0186AFADFAFC8614318C27FE90DCB726ED30BD014684

Function 04DFB470 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1995237816.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57967d0d98ec5a50f0a30e380cda30ea4d206682d153a01cffcb5d4fb1327490
Instruction ID: 7d56058270ebf166cdc4adb93811fd9de1a865d6eab610d2056523d397e66968
Opcode Fuzzy Hash: 57967d0d98ec5a50f0a30e380cda30ea4d206682d153a01cffcb5d4fb1327490
Instruction Fuzzy Hash: 95E0D8B1315B549F8725966AED014627BEEAFC520430681AFD749CB762D530BC0287D5

Function 04DFD474 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1995237816.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c5439fd02b5de2fb9e4394e8650aff97e2447f653f062ef5acf25bf8f468e57
Instruction ID: 1f5caef3703ee3ea27cb5803d6fc31bb1a658e130f360e0d24d02171214e0bbf
Opcode Fuzzy Hash: 8c5439fd02b5de2fb9e4394e8650aff97e2447f653f062ef5acf25bf8f468e57
Instruction Fuzzy Hash: 8AE04F322500148FC721EA1CE989BE573A8FB8A354F1A45B3F659EB235C635F882C781

Function 04DFFFA9 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1995237816.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4048d537df22dc9fbae2c76dfe2826fac4a7474bb74f6499dfba780c5ad35e86
Instruction ID: 7883c9c9d15078b72a6d393138e05e24f3a0487d07670d44caf45ef940ba2e17
Opcode Fuzzy Hash: 4048d537df22dc9fbae2c76dfe2826fac4a7474bb74f6499dfba780c5ad35e86
Instruction Fuzzy Hash: F6D0C71276A1601BE706237D78570AC2FD5D58B99235A40E7E141D7347DC548D4B4392

Function 04DFB910 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1995237816.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b65c0fd13cde9da375870afa348887284b6a587797278863c6ae37de73198652
Instruction ID: 81563b007692ce7730bd99f284e4b75848e76e5816f1a7da3ed02102f0b0e062
Opcode Fuzzy Hash: b65c0fd13cde9da375870afa348887284b6a587797278863c6ae37de73198652
Instruction Fuzzy Hash: 84E02B717002149FE325672CD910C6A3FDDEF5E2603114067FE04CB362CAA4EC0083D9

Function 04DFB920 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1995237816.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51e862ed84c1b27eed9654fe16527ba94d73d86ad955b9a279a1cc5e2bcb4102
Instruction ID: 1f2705db950559d3be190cd0273017085381477f8b682849fc6b7547356764fb
Opcode Fuzzy Hash: 51e862ed84c1b27eed9654fe16527ba94d73d86ad955b9a279a1cc5e2bcb4102
Instruction Fuzzy Hash: 58D012367101249F8704AB6CE804CAA7BEDDF5D660311806AFA09CB361CE71EC1197D4

Function 04DF7700 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1995237816.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66ff890f19cf94cec1ee44371a78e8195bcc278cb967eebc12349630cda5d2db
Instruction ID: 22fa04798c255f663b5e9b56624825cf50f125c7dec9352dcda71eab0d0bc675
Opcode Fuzzy Hash: 66ff890f19cf94cec1ee44371a78e8195bcc278cb967eebc12349630cda5d2db
Instruction Fuzzy Hash: A0A0122068400443F50063D44CC537B1000DFC4300FD08811110041206544CE806D087

Function 04DFD2F4 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1995237816.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61f5efaee77e654912b843377e0025bded9edfea87ae3e7465757bd13b510d5e
Instruction ID: fc896396e9bfe360452187310153d8cd3715ca5052bf9c1c2ebde2a967c93878
Opcode Fuzzy Hash: 61f5efaee77e654912b843377e0025bded9edfea87ae3e7465757bd13b510d5e
Instruction Fuzzy Hash: B5A002187A690552B935B2691E9953D8916FFD170C7D2AC75534291435981CF4489027

Non-executed Functions

Function 0700EF80 Relevance: 2.8, Strings: 2, Instructions: 298COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0700F243
PH]q, xrefs: 0700F16B

Memory Dump Source

Source File: 00000000.00000002.1997249629.0000000007000000.00000040.00000800.00020000.00000000.sdmp, Offset: 07000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7000000_M.jbxd

Similarity

API ID:
String ID: PH]q$PH]q
API String ID: 0-1166926398
Opcode ID: e40545a319c214046d75c3c3116dfb6072662c5ed89164b75ab3f62efd832452
Instruction ID: 89a5e95ee1cc17d3b5f0f9755f0b12923a0a0df4f4ca0474d138f78d0d6a3dc0
Opcode Fuzzy Hash: e40545a319c214046d75c3c3116dfb6072662c5ed89164b75ab3f62efd832452
Instruction Fuzzy Hash: 01D1D474A00206CFEB58DF69C598AA9B7F1BF4D310F2581A8E505EB3B1DB31AD41CB60

Function 07008DB8 Relevance: 1.6, Strings: 1, Instructions: 312COMMON

Download Yara Rule

Strings

}K9I, xrefs: 07008E13

Memory Dump Source

Source File: 00000000.00000002.1997249629.0000000007000000.00000040.00000800.00020000.00000000.sdmp, Offset: 07000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7000000_M.jbxd

Similarity

API ID:
String ID: }K9I
API String ID: 0-3311055346
Opcode ID: bd38f741614642f75e5b871676d7d10a8abc9a31c90f1375f1d182bb4efa5711
Instruction ID: 167df4a7de6985a73200492da03377d113d029c0ef5404b01e466362aa699765
Opcode Fuzzy Hash: bd38f741614642f75e5b871676d7d10a8abc9a31c90f1375f1d182bb4efa5711
Instruction Fuzzy Hash: 1AE108B4E101198FDB14DFA9C5809AEFBF2BF89315F24C269D514AB356D730A981CFA0

Function 07008DA7 Relevance: 1.4, Strings: 1, Instructions: 138COMMON

Download Yara Rule

Strings

}K9I, xrefs: 07008E13

Memory Dump Source

Source File: 00000000.00000002.1997249629.0000000007000000.00000040.00000800.00020000.00000000.sdmp, Offset: 07000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7000000_M.jbxd

Similarity

API ID:
String ID: }K9I
API String ID: 0-3311055346
Opcode ID: 6f297307f7d4eebb7d47b64acf90c1f94ace78fbce8303c450429e38c3b6e2d2
Instruction ID: fe673d8a1a5296644397c07a7cddd8c0ef7e61990db24b5cda3b8cfb8a91bc54
Opcode Fuzzy Hash: 6f297307f7d4eebb7d47b64acf90c1f94ace78fbce8303c450429e38c3b6e2d2
Instruction Fuzzy Hash: BB5129B0E102198FDB14DFA9C5805AEFBF2BF89314F24C26AD418A7356D7309A41CFA1

Function 04DF5A8C Relevance: .7, Instructions: 716COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1995237816.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d76aa2eb13d2ebfcb3c11704648f5d8cf2330421ba8aa003bd5637647b3c2e7c
Instruction ID: e6f23bab80d650958afa8815e0aaacf9f5d133e1bc075b6685b8e8fb7696d4ff
Opcode Fuzzy Hash: d76aa2eb13d2ebfcb3c11704648f5d8cf2330421ba8aa003bd5637647b3c2e7c
Instruction Fuzzy Hash: BE721530A10219CFCB25EF28C994AE8B7B1FF95304F1646E9D6496B211EB71ADC5CF90

Function 04DFC040 Relevance: .5, Instructions: 501COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1995237816.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8547c02c14e14358aca53c6c7e82ae71c38b7ae77a7a19c32238d0331fba1d0
Instruction ID: 491adec42ad7385a7965fb9d431031a545387308ea4c19a3a15e183e1fbbec43
Opcode Fuzzy Hash: a8547c02c14e14358aca53c6c7e82ae71c38b7ae77a7a19c32238d0331fba1d0
Instruction Fuzzy Hash: E5321830E20619CFDB24EF78C854BA8B7B1FF85304F1685E9D5496B222EB31A995CF50

Function 04DE0130 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1995207602.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4de0000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 485cf64e84ccc923305d7086fc1d5de0dc1c924e844c7fd40f127abc71c58052
Instruction ID: 97e073a05a694106977778528c24f36f3d57426b699fc1a66b671e19ca055040
Opcode Fuzzy Hash: 485cf64e84ccc923305d7086fc1d5de0dc1c924e844c7fd40f127abc71c58052
Instruction Fuzzy Hash: 77128FB8401746ABE710CF65F97C2893BA1FBC1328B944219D3A52B3E5DBBD194ACF44

Function 07008408 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1997249629.0000000007000000.00000040.00000800.00020000.00000000.sdmp, Offset: 07000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7000000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5926fe1d0be290489eef4a92591bd50dde6bdb44485a5cec8060d4c4b25555a
Instruction ID: 863139d5bc45ee213a3662ec50264942b69e3bc580ce46b3c0b4375ec8274857
Opcode Fuzzy Hash: b5926fe1d0be290489eef4a92591bd50dde6bdb44485a5cec8060d4c4b25555a
Instruction Fuzzy Hash: 6AE109B4E101198FDB14DFA8C5809AEFBF2BF89315F24C269D514A7396D730A981CFA1

Function 070064F0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1997249629.0000000007000000.00000040.00000800.00020000.00000000.sdmp, Offset: 07000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7000000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e28238f1352ffe07653194cc778d3fdc602e52d381c881eb3cab671a4d0f060d
Instruction ID: 698c01c93c4b43092a6b7bf8626e3d4ace4b4040ec17f28bec46127e994fdd8c
Opcode Fuzzy Hash: e28238f1352ffe07653194cc778d3fdc602e52d381c881eb3cab671a4d0f060d
Instruction Fuzzy Hash: 59E11AB4E101198FDB14DFA8C5809AEFBF2FF89315F248269D414AB356D731A981CFA1

Function 07007FD0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1997249629.0000000007000000.00000040.00000800.00020000.00000000.sdmp, Offset: 07000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7000000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 138020c898f0984c2a1cd16b42dcfc3d7c68dcdea398332042723a857e55e4ed
Instruction ID: 24b4732cce53a3a6917143ec8c024509e4905fff8ad380104d99bee71ae046e5
Opcode Fuzzy Hash: 138020c898f0984c2a1cd16b42dcfc3d7c68dcdea398332042723a857e55e4ed
Instruction Fuzzy Hash: 96E10BB4E105198FDB14DFA8C5809AEFBF2BF89315F24C269D414A7396D730A981CFA1

Function 07006928 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1997249629.0000000007000000.00000040.00000800.00020000.00000000.sdmp, Offset: 07000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7000000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3796bfde5f75df01d8af011073c007a73d5f231e67238d80242c7c6925f6c84a
Instruction ID: c24728455a253cf17daae6246e8c977fbf657b39a940960856c0b8652e4d10f8
Opcode Fuzzy Hash: 3796bfde5f75df01d8af011073c007a73d5f231e67238d80242c7c6925f6c84a
Instruction Fuzzy Hash: A7E117B4E001198FDB14DFA8C5809AEFBF2FF89315F248269D414AB356D731A981CFA0

Function 00F2E0CC Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1992599088.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7793fb9d68c6a5355e145665313af2df8c04d67aa13b2e8d01707fd27d3c2096
Instruction ID: 77370fbd7a32a4aa26e0d636d976e11b49dcef5926600f9efe1559efee51c314
Opcode Fuzzy Hash: 7793fb9d68c6a5355e145665313af2df8c04d67aa13b2e8d01707fd27d3c2096
Instruction Fuzzy Hash: 26A1AD32E102298FCF05DFB4D88459EB7B2FF85310B24417AE806AB221DB35ED5ADB50

Function 04DE0123 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1995207602.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4de0000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d45a5f34fc08c33eff94aa06c5468bc8ba927e2339e3e89e24b4dca0ba2c40a5
Instruction ID: fb01834f96896e8f46eb969f11bc02de08f981cb2eba5926e2560229848b07c5
Opcode Fuzzy Hash: d45a5f34fc08c33eff94aa06c5468bc8ba927e2339e3e89e24b4dca0ba2c40a5
Instruction Fuzzy Hash: 81C1D0B9810646ABE710CF69F8781897BB1FFC5328B544219D3616B3E5DBBC188ACF44

Function 0700EB60 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1997249629.0000000007000000.00000040.00000800.00020000.00000000.sdmp, Offset: 07000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7000000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fca5fb1af5d27ff86396b3f8af7f150ab2e6cf49e29699bafd7ce2b89ff90747
Instruction ID: cc7185e759f0d6e2f8fd1f5bab10c850856ba8b336c071ec97761afa754f23e7
Opcode Fuzzy Hash: fca5fb1af5d27ff86396b3f8af7f150ab2e6cf49e29699bafd7ce2b89ff90747
Instruction Fuzzy Hash: F67141B0701A018FE369DF3AD444B66B7E2FF89310F19C96DD05A9B2A1DB31E845CB41

Function 0700EB50 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1997249629.0000000007000000.00000040.00000800.00020000.00000000.sdmp, Offset: 07000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7000000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 679304c57ac58ba06512e4eabfc6aa8022c74c2ba37a82c9c6211b174cea8e05
Instruction ID: a3eacfb9deca516523f424088d90932e1b2681bf2f80b346cb16b717cf44ffd8
Opcode Fuzzy Hash: 679304c57ac58ba06512e4eabfc6aa8022c74c2ba37a82c9c6211b174cea8e05
Instruction Fuzzy Hash: FF513EB0601A02CFE368DF3AC544BA6B7E2BF89311F19C96DD05E972A1DB31E841CB41

Function 070064D1 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1997249629.0000000007000000.00000040.00000800.00020000.00000000.sdmp, Offset: 07000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7000000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6067dcb290f24df62dc209ade0a3c4e4a9a91b68abdc1908d6ff5b85e2b078a
Instruction ID: d9add11b1d35357ec1132a8440f51ce0683acc1c21e3c4c43a81ae615a803352
Opcode Fuzzy Hash: c6067dcb290f24df62dc209ade0a3c4e4a9a91b68abdc1908d6ff5b85e2b078a
Instruction Fuzzy Hash: 005150B4E042198FDB14DFA9C5405AEFBF2BF89315F24C26AD418A7356C7319A41CFA1

Function 07007FC0 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1997249629.0000000007000000.00000040.00000800.00020000.00000000.sdmp, Offset: 07000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7000000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf1c56808c9500a273a022ff953f417848dc0c23fa8cc64b938aa84e004ae7f8
Instruction ID: 5b0feb5eece3678ce7a334aef805c601a87a717a5392f6d8685f577cd7743a2b
Opcode Fuzzy Hash: bf1c56808c9500a273a022ff953f417848dc0c23fa8cc64b938aa84e004ae7f8
Instruction Fuzzy Hash: 835118B0E106198FDB14DFA9C9805AEFBF2BF89311F24C16AD418A7356D7319942CFA1

Function 04DFC948 Relevance: 6.3, Strings: 5, Instructions: 72COMMON

Download Yara Rule

Strings

4']q, xrefs: 04DFC9A3
4']q, xrefs: 04DFC9E9
4']q, xrefs: 04DFC9C6
4']q, xrefs: 04DFCA2F
4']q, xrefs: 04DFCA0C

Memory Dump Source

Source File: 00000000.00000002.1995237816.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4df0000_M.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$4']q
API String ID: 0-4248691736
Opcode ID: 67c701ce49b6f8898db2ed11fa3866afd793897554e244dc30c6d8924181229d
Instruction ID: f659f7b688eb22bf8afff324ca5e86521a9fd784e673bcf163b95b9a6fc99519
Opcode Fuzzy Hash: 67c701ce49b6f8898db2ed11fa3866afd793897554e244dc30c6d8924181229d
Instruction Fuzzy Hash: AA215C30E1010A8BCF08EFB8E8509DEB7F6FF84710F5445A5D04577254EB35AA45CBA1

Analysis Process: M.V TBN - VESSEL'S DETAILS.docx.scr.exePID: 1480, Parent PID: 5528COMMON

Execution Graph

Execution Coverage:	10.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	178
Total number of Limit Nodes:	19

Executed Functions

Function 07063060 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 0706376B
$]q, xrefs: 070637B8
$]q, xrefs: 070637AC
$]q, xrefs: 0706375F
$]q, xrefs: 07063788
$]q, xrefs: 07063794

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: 81759375b47788156db37eee93865c2cc5cd1a1d9cede87a0af644721dcb030b
Instruction ID: 77ea9a9fdb0a91d0f7e2b34e8ff56770224b91f34728b8be57053be65351c988
Opcode Fuzzy Hash: 81759375b47788156db37eee93865c2cc5cd1a1d9cede87a0af644721dcb030b
Instruction Fuzzy Hash: C1323D31E1061A8FCB14EF79D89469DF7B6FF89300F10D66AD409A7264EF34A985CB81

Function 07067D80 Relevance: 3.0, Strings: 2, Instructions: 471
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 07068327
$]q, xrefs: 0706831B

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 1cba03d624099c1bc8c34b425d28e69504a6319c89669b47848ec22bcc5d05c0
Instruction ID: c8dc444c8a755884441d32cc159c39dd720a6239319a74c926ea5fb215ccc279
Opcode Fuzzy Hash: 1cba03d624099c1bc8c34b425d28e69504a6319c89669b47848ec22bcc5d05c0
Instruction Fuzzy Hash: C5028D70B002068FDB54DB68D4A4A6EB7E6FF88304F14CA29D909DB394DB75ED46CB81

Function 070655A0 Relevance: 1.9, Strings: 1, Instructions: 602COMMON

Download Yara Rule

Strings

$, xrefs: 0706597B

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: fe40b3e40cf522906afd050be8a266e0811c36342c9e566765325d696343e529
Instruction ID: 03c0c2c8d255197b7ae8476ef9c8172351697937db5e0d9557cad1f77e71a64a
Opcode Fuzzy Hash: fe40b3e40cf522906afd050be8a266e0811c36342c9e566765325d696343e529
Instruction Fuzzy Hash: 5C22D4B5E002068FDF24CFA4C8A46AEB7F2FF85314F248569D445AB344DA35DD52CB91

Function 07062340 Relevance: 1.0, Instructions: 1018COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7a29e668aeb6ac5ebef6c0345b5578fd4b41dee125f88e0e1d6476aad2c1f67
Instruction ID: f06882da2daa50d7c57bae35d8ba0c7fd4ae81937ddb426b0a473d972c7dc2f8
Opcode Fuzzy Hash: c7a29e668aeb6ac5ebef6c0345b5578fd4b41dee125f88e0e1d6476aad2c1f67
Instruction Fuzzy Hash: AB925574A002058FDB64CB68C5A8AADB7F2FF49314F5486A9D409EB361DB35EC85CF81

Function 070665F0 Relevance: .8, Instructions: 828COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8001da4d3838e8059b1bf5382786e76a753b8660aaf0197e741a38f3ea5b26a3
Instruction ID: fa577c3845bddbd20dcb7cda2415012250aa3d76cf56f18fd0ddf7312567eb6a
Opcode Fuzzy Hash: 8001da4d3838e8059b1bf5382786e76a753b8660aaf0197e741a38f3ea5b26a3
Instruction Fuzzy Hash: 0462B070B002058FDB14DB68D5A8AADB7F6EF88314F148669D906DB390DB36ED42CB91

Function 0706C190 Relevance: .6, Instructions: 640COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d311c21a0223ce8b38275811023d55bb69a68b8b1b13b5426c3f90f66522609b
Instruction ID: 4d2523e8e1abf7b7e7511ba3d7364688478801b02aa5f421e7bb17bc687985ec
Opcode Fuzzy Hash: d311c21a0223ce8b38275811023d55bb69a68b8b1b13b5426c3f90f66522609b
Instruction Fuzzy Hash: B6327E70A0020A8FEB14DF68D994BAEB7F6FB88314F108629D545EB354DB34EC45CBA1

Function 0706B238 Relevance: .6, Instructions: 568COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16f3e2d6ed2e2d616b3c89edc8a79432b1ae3dee0856d7b821c33b8b3e002773
Instruction ID: c7a2a15f36baf70c3c1fe94732ef860e9b71e31d71109d0d57b633b87b3abed6
Opcode Fuzzy Hash: 16f3e2d6ed2e2d616b3c89edc8a79432b1ae3dee0856d7b821c33b8b3e002773
Instruction Fuzzy Hash: 3E224FF0A0010A9FDF64CA6DD5A87ADB7F6FB45310F248A25E405DB391DA38DC85CB92

Function 0706ACE0 Relevance: 10.4, Strings: 8, Instructions: 397
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 0706AE60
$]q, xrefs: 0706AE0D
$]q, xrefs: 0706AEAC
$]q, xrefs: 0706AE8F
$]q, xrefs: 0706AE83
$]q, xrefs: 0706AE01
$]q, xrefs: 0706AE54
$]q, xrefs: 0706AEB8

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: 543e2e73fba3c6ab447c19ab70d94957dbb64a0c7cdc0ae46a7f0f2737f43649
Instruction ID: 3ea6abc0aeee5ddf2a20b0039e68564205320fa898c7a401e58e4b0cb0f7e776
Opcode Fuzzy Hash: 543e2e73fba3c6ab447c19ab70d94957dbb64a0c7cdc0ae46a7f0f2737f43649
Instruction Fuzzy Hash: 55E17EB0B0020A8FDB55EF68D4A46AEB7F6EF85304F208629D505EB354DB35EC46CB91

Function 0706B658 Relevance: 8.0, Strings: 6, Instructions: 473
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 0706BBB5
$]q, xrefs: 0706BBA9
$]q, xrefs: 0706BC1D
$]q, xrefs: 0706BBDD
$]q, xrefs: 0706BBE9
$]q, xrefs: 0706BC11

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: c1fa9aaf0fdd7846995cbf7219fa78301ec8cc16333d862298ef584f29f94d5f
Instruction ID: 767c72dbe46e59cafaed20e67474373917720cc69c226c4ad8805a381f596481
Opcode Fuzzy Hash: c1fa9aaf0fdd7846995cbf7219fa78301ec8cc16333d862298ef584f29f94d5f
Instruction Fuzzy Hash: B1027BF0A0020A8FDB64CF68D4A87ADB7F6FB85310F20862AD415DB255DB74ED85CB91

Function 07052872 Relevance: 6.1, APIs: 4, Instructions: 130
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 070528F6
GetCurrentThread.KERNEL32 ref: 07052933
GetCurrentProcess.KERNEL32 ref: 07052970
GetCurrentThreadId.KERNEL32 ref: 070529C9

Memory Dump Source

Source File: 00000005.00000002.4443762306.0000000007050000.00000040.00000800.00020000.00000000.sdmp, Offset: 07050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7050000_M.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: affc0275a0529ca66030791fcde757b11b8630b3fe911f85bddfcff4f8f14472
Instruction ID: 68bd92527d5af477c26b59e8d4a43c07bab350e71e7542db442d61060269d0ad
Opcode Fuzzy Hash: affc0275a0529ca66030791fcde757b11b8630b3fe911f85bddfcff4f8f14472
Instruction Fuzzy Hash: B65156F09002499FDB14DFA9D548BAEBBF1FF88304F248569E409A7360D739A944CF65

Function 07052878 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 070528F6
GetCurrentThread.KERNEL32 ref: 07052933
GetCurrentProcess.KERNEL32 ref: 07052970
GetCurrentThreadId.KERNEL32 ref: 070529C9

Memory Dump Source

Source File: 00000005.00000002.4443762306.0000000007050000.00000040.00000800.00020000.00000000.sdmp, Offset: 07050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7050000_M.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 0bb1cc836007c1952825ea539d30f35eb206fbd649f29ea89cc324e46d783c70
Instruction ID: a1f96f7ccb60dc4aeec7245d6d2e88c56da3482f7497ce965270084030ea5d96
Opcode Fuzzy Hash: 0bb1cc836007c1952825ea539d30f35eb206fbd649f29ea89cc324e46d783c70
Instruction Fuzzy Hash: 785165F09003499FDB04DFAAD548BAEBBF5FF88300F208569E409A7360D739A944CB65

Function 07069158 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 070691C8
$]q, xrefs: 0706920F
$]q, xrefs: 07069203
$]q, xrefs: 070691D4

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: bfcafb04fd32f80ebb5b664ece787fc34be7d87021b2b34af4830edce2df8b27
Instruction ID: 72ab9d7ee00b362da7e0dcc349ffab037a5b449600b2115ec54e16da5dae9baf
Opcode Fuzzy Hash: bfcafb04fd32f80ebb5b664ece787fc34be7d87021b2b34af4830edce2df8b27
Instruction Fuzzy Hash: 64916170B1020A8FDB54DB65D864BAEB3F6FF88304F108569C909DB744EE74ED468B91

Function 0706CF48 Relevance: 4.6, Strings: 3, Instructions: 800
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 0706D33F
$]q, xrefs: 0706D347
$]q, xrefs: 0706D353

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q
API String ID: 0-182748909
Opcode ID: 1eefe1bf0d5cce536570b040ca6bdb1cbd668841146afe541530fb3b202e6b1b
Instruction ID: d151cbedfc2f9f71666db6cfcb8243cdc44d732cd80580574ff5d010910df271
Opcode Fuzzy Hash: 1eefe1bf0d5cce536570b040ca6bdb1cbd668841146afe541530fb3b202e6b1b
Instruction Fuzzy Hash: 3E623A7070020A8FCB15DF68E594A5DB7EAFF84304F248A68D4099F369DB75ED46CB81

Function 07064B70 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Obq, xrefs: 07064D27
fbq, xrefs: 0706527D
XPbq, xrefs: 07064C9D

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID: fbq$XPbq$\Obq
API String ID: 0-4057264190
Opcode ID: e5d105b9cf96cd393ff3eca4696897eac00554bde0067622548f4e279e15fcad
Instruction ID: b4ec3b2a9237bb1b690d92bcb3b116764bee90a2710c7370ad561ee205934b2f
Opcode Fuzzy Hash: e5d105b9cf96cd393ff3eca4696897eac00554bde0067622548f4e279e15fcad
Instruction Fuzzy Hash: 7F618170F002199FEB549FA9C8547AEBBF6FF88300F208529E606EB394DA755D418B91

Function 07069149 Relevance: 2.7, Strings: 2, Instructions: 175
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 070691C8
$]q, xrefs: 07069203

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: db9f95365389269d0a1db7b7bd6255cf7f80ef70c646985e9386c739f38faee4
Instruction ID: c0ab46472273f3ee0f7d74de7d6fc342fbbc5eff18c6f8af724960bdf038d72e
Opcode Fuzzy Hash: db9f95365389269d0a1db7b7bd6255cf7f80ef70c646985e9386c739f38faee4
Instruction Fuzzy Hash: FD518F70B101069FDB54DB78D8A4B6EB3F6EF88304F108529C909DB794EE34EC068B92

Function 0705AF10 Relevance: 1.7, APIs: 1, Instructions: 203COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0705B176

Memory Dump Source

Source File: 00000005.00000002.4443762306.0000000007050000.00000040.00000800.00020000.00000000.sdmp, Offset: 07050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7050000_M.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f82513532c068e0a7379d6326caec3792766c482ee38f205e03eeebf3fe0c5e4
Instruction ID: 3b2b50201c818946bcecb8377fe8a7734bf2ed66eb722c8feaa2601000779cc3
Opcode Fuzzy Hash: f82513532c068e0a7379d6326caec3792766c482ee38f205e03eeebf3fe0c5e4
Instruction Fuzzy Hash: 9C8157B0A00B058FD764DF69D04475BBBF5FF88300F008A2AE85AC7A50DB75E945CB91

Function 0705D090 Relevance: 1.6, APIs: 1, Instructions: 146COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0705D202

Memory Dump Source

Source File: 00000005.00000002.4443762306.0000000007050000.00000040.00000800.00020000.00000000.sdmp, Offset: 07050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7050000_M.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 916fff8d4c3c7b5dda959c292c83c4ec53a951bd5b67baee2fb57a7aefe3683a
Instruction ID: d882054a6fc06770ca4e73985636753a887dd2e1e96e6a3e72004362dd903cfd
Opcode Fuzzy Hash: 916fff8d4c3c7b5dda959c292c83c4ec53a951bd5b67baee2fb57a7aefe3683a
Instruction Fuzzy Hash: CE5102B1D00249AFCF11CF99C984ADEBFB6FF49314F14816AE818AB220D7759995CF90

Function 018AEA51 Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4439753740.00000000018A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_18a0000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d22247416330330a628994ba79660bfadf1eb11d675826227d0ae6dc2b07f578
Instruction ID: 40e7c6ba0a249ad39f73f05ba5adec099b6f3042695fa779a5f3c3034f29daeb
Opcode Fuzzy Hash: d22247416330330a628994ba79660bfadf1eb11d675826227d0ae6dc2b07f578
Instruction Fuzzy Hash: AF413471D0035A8FCB10CF79D8042EABBB6EF89310F1485AAD805E7241DB78A945CBE1

Function 0705D0F0 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0705D202

Memory Dump Source

Source File: 00000005.00000002.4443762306.0000000007050000.00000040.00000800.00020000.00000000.sdmp, Offset: 07050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7050000_M.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 15f4f0b23a3e04d1931fb225f5b11ba88b35aea286a3875d40057cdde1501b35
Instruction ID: ec6497e26dd2e2ab007c4511c0b17fc7f7ca6bcc09694cf6008d574b97d9d798
Opcode Fuzzy Hash: 15f4f0b23a3e04d1931fb225f5b11ba88b35aea286a3875d40057cdde1501b35
Instruction Fuzzy Hash: 4741B1B1D00349AFDB14CF99C884ADEBBB5BF49310F24822AE819AB210D7759885CF90

Function 0705A5EC Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 0705F8F1

Memory Dump Source

Source File: 00000005.00000002.4443762306.0000000007050000.00000040.00000800.00020000.00000000.sdmp, Offset: 07050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7050000_M.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: f9b9035f782e3a6465d2622ca47856feb3bc9d6921b7356f61fbcfd9c3cd5332
Instruction ID: 4e94f8ced6cb316812b19a5e25b0396c3a40912263c371e7c0cd6509c2e868bd
Opcode Fuzzy Hash: f9b9035f782e3a6465d2622ca47856feb3bc9d6921b7356f61fbcfd9c3cd5332
Instruction Fuzzy Hash: 49412CB490030ADFCB14DF99C448AAABBF5FF88314F14C959D919AB321D738A845CFA0

Function 07052AB8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 07052B47

Memory Dump Source

Source File: 00000005.00000002.4443762306.0000000007050000.00000040.00000800.00020000.00000000.sdmp, Offset: 07050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7050000_M.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 29ccf8ed5fb65281fcc1870da3888911e5bfad8c09e65108eb174008ad9089d5
Instruction ID: c8bf86a5d6f377bc7741d87a75a26080ad9218281d28ec1d04c425a46982ea46
Opcode Fuzzy Hash: 29ccf8ed5fb65281fcc1870da3888911e5bfad8c09e65108eb174008ad9089d5
Instruction Fuzzy Hash: 8B2114B5900248DFDB10CFAAD984AEEBBF5FF48310F14801AE919A7310C378A940CFA0

Function 07052AC0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 07052B47

Memory Dump Source

Source File: 00000005.00000002.4443762306.0000000007050000.00000040.00000800.00020000.00000000.sdmp, Offset: 07050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7050000_M.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 62ec806c0f6706194fe6d1c03d7fdec57dc728c29122ba0b07736871399eb090
Instruction ID: 20a06da22bdb3cebb8d898125eef568086e0adc900a66272cd36bfd421ff339e
Opcode Fuzzy Hash: 62ec806c0f6706194fe6d1c03d7fdec57dc728c29122ba0b07736871399eb090
Instruction Fuzzy Hash: 0921E4B5900249AFDB10CF9AD984ADEFBF9FF48310F14841AE918A7310D378A944CFA0

Function 0705A328 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0705B1F1,00000800,00000000,00000000), ref: 0705B3E2

Memory Dump Source

Source File: 00000005.00000002.4443762306.0000000007050000.00000040.00000800.00020000.00000000.sdmp, Offset: 07050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7050000_M.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0863472dba406876d1eaec19a23faf16e6543666b2cee87e3344e775ac05fb63
Instruction ID: ac45445cb3b983e587439ac189d11779ae69602431f0f7670c57c6ae4a9d38c1
Opcode Fuzzy Hash: 0863472dba406876d1eaec19a23faf16e6543666b2cee87e3344e775ac05fb63
Instruction Fuzzy Hash: EA11E4B69003499FDB10DF9AC444AAEFBF8EF48310F10856AE919B7600C779A945CFA5

Function 0705B372 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0705B1F1,00000800,00000000,00000000), ref: 0705B3E2

Memory Dump Source

Source File: 00000005.00000002.4443762306.0000000007050000.00000040.00000800.00020000.00000000.sdmp, Offset: 07050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7050000_M.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 91937c029edbfd55ee142d3b755eaa5392f421f6393fddee40266580ed4cdc2b
Instruction ID: 60c028685e97405f1056d1c4fda83966ef49bb79dd91f28ff9a3d18e89b0bd4e
Opcode Fuzzy Hash: 91937c029edbfd55ee142d3b755eaa5392f421f6393fddee40266580ed4cdc2b
Instruction Fuzzy Hash: 7911E4B68003499FDB14CF9AD844ADEFBF8EF48310F10851AE919A7610C779A545CFA5

Function 018AEB38 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 018AEB9F

Memory Dump Source

Source File: 00000005.00000002.4439753740.00000000018A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_18a0000_M.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 462cda6c6dcc06b569d5e09bc916dc23f19a2f7a9bea9ab2d7d163046e94986f
Instruction ID: d234208bd3dcd79a7a5f867147b608de0614f76ccf835882d5f2ec32b430f69c
Opcode Fuzzy Hash: 462cda6c6dcc06b569d5e09bc916dc23f19a2f7a9bea9ab2d7d163046e94986f
Instruction Fuzzy Hash: 0C11E2B1C006599BDB10DF9AC544A9EFBF4AF48320F14856AD918B7240D778A944CFE5

Function 0705B110 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0705B176

Memory Dump Source

Source File: 00000005.00000002.4443762306.0000000007050000.00000040.00000800.00020000.00000000.sdmp, Offset: 07050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7050000_M.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 724547fc79d627bc98a46bd97fb632dfa2ca752533e4b618a145f4f41f80387e
Instruction ID: bc77fa0f77ba6da9f6ac53ba4952b1fe459c889bcac06a7f20297f11e6aea26e
Opcode Fuzzy Hash: 724547fc79d627bc98a46bd97fb632dfa2ca752533e4b618a145f4f41f80387e
Instruction Fuzzy Hash: DC11DFB5C002499FCB10DF9AC844A9EFBF9EF89214F10855AD829A7710C379A545CFA5

Function 07064B60 Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

XPbq, xrefs: 07064C9D

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID: XPbq
API String ID: 0-864591470
Opcode ID: 22229d0829a2f369a8deb9234baf1953db0b2df358c2f165043a7c85c2b995ce
Instruction ID: 38284af3000d7db0334637ca4eb4d40ed53ffee5c71a0973e8c8812cb904dcad
Opcode Fuzzy Hash: 22229d0829a2f369a8deb9234baf1953db0b2df358c2f165043a7c85c2b995ce
Instruction Fuzzy Hash: 0C519071B002099FDB549FB9C854B9EBBF7FF89700F208529E105AB395DA749D01CB91

Function 0706DABD Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0706DC19

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 00b78e4006d047bc240e004e52ea292c36076fbfc739892d8b49f9345f832cc1
Instruction ID: 0636ce20080e538f8ff0f9f8f14a8c4fd08f51e07f2e6439852e83264acf4a8e
Opcode Fuzzy Hash: 00b78e4006d047bc240e004e52ea292c36076fbfc739892d8b49f9345f832cc1
Instruction Fuzzy Hash: 1A418FB0B0030AEFDF659F65D8A869EBBF6EF85300F104629E405DB244DB74A946CB91

Function 070621C8 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH]q, xrefs: 07062303

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 5c2deff3011b33e67eed8d30edb7927ef089e35594faeb1c34a449b207fb02f2
Instruction ID: 61412bc9255fec17cd68512dc430fd736525532f5268f21db9c660e849efe3b2
Opcode Fuzzy Hash: 5c2deff3011b33e67eed8d30edb7927ef089e35594faeb1c34a449b207fb02f2
Instruction Fuzzy Hash: 6131AB70B002069FCB589B74D46866E7BE7FF89310F248628D406DB394DE39DD46CBA6

Function 070682D0 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

$]q, xrefs: 0706831B

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: 7b94a029c2b4c26335f3816fd6f89c6f2b38f83ff7c165e796f2582050df0c47
Instruction ID: efee13bf32216aa10a56c02d716563b9e205a65c0989b76dfaaf34348f68bc34
Opcode Fuzzy Hash: 7b94a029c2b4c26335f3816fd6f89c6f2b38f83ff7c165e796f2582050df0c47
Instruction Fuzzy Hash: 32F0C2B1700226CFCF688A58F9A867CB3F9EB45314F14C265DA19CB291C775EE06C791

Function 070661F0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 803e804296654440b0205644a6bc34a1914f57b20756138346da9db07eaf28d9
Instruction ID: 0ff95c6313afe041996ccf61ffbe2b8e0751d1291e2fef7d934ec8d2e879a398
Opcode Fuzzy Hash: 803e804296654440b0205644a6bc34a1914f57b20756138346da9db07eaf28d9
Instruction Fuzzy Hash: D661D0B1F004124FDB149A6EC89466FBADBAFD4210F154079D80EDB360DE7ADD0287D2

Function 070642A1 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58a03f83bd04015dff395c4c7178f93f7eedeca39295b8397b2141099f6dba7d
Instruction ID: bc66c56c6e93cb1b256af05e07f3a1f9de7b272019d447459ee03644962cf802
Opcode Fuzzy Hash: 58a03f83bd04015dff395c4c7178f93f7eedeca39295b8397b2141099f6dba7d
Instruction Fuzzy Hash: 76817F70B0024A8FCB44DF68D4647AEB7F6EF89304F108529E509DB395DB74ED468B92

Function 070645C4 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce02b6dd683200ff39cb09ab3ca5f63db9022e4c39b2d202a108479276a4f8a4
Instruction ID: 1c17c68dd0b71f477f7736587a088517167daf84e42b3187a40062814bfd51c9
Opcode Fuzzy Hash: ce02b6dd683200ff39cb09ab3ca5f63db9022e4c39b2d202a108479276a4f8a4
Instruction Fuzzy Hash: 3B914070E0025A8FDF60DF68C890B9DB7B1FF85300F208695D54DAB255DB71AA85CF91

Function 070645D8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d87fcbf1f22eb9e2fa05a0b9f87c7e288d781815969edad70e50fef462384f56
Instruction ID: 7c28111fe65fecfebe184d0261f6db66918940595de05a883db05ab8788d4c14
Opcode Fuzzy Hash: d87fcbf1f22eb9e2fa05a0b9f87c7e288d781815969edad70e50fef462384f56
Instruction Fuzzy Hash: C9913E70E0021A8FDF60DF68C890B9DB7B1FF89304F208699D54DAB255DB71AA85CF91

Function 0706EB19 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6db674f33a61572abc54760498a1027c7e520490e3a79507fd7464631edf235
Instruction ID: 97d4d56809cd43a902549e908bc9129862b188e07b6bc794b8f4e9ec9b2546a5
Opcode Fuzzy Hash: f6db674f33a61572abc54760498a1027c7e520490e3a79507fd7464631edf235
Instruction Fuzzy Hash: E3713D74A002099FDB14DFA9D994AAEBBFAFF88300F148529D405EB354DB31ED46CB91

Function 0706FBB8 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d577f4ad0ec3e39e69081a652ca220a414ce78918cc3a84716fbb897f15e5052
Instruction ID: 0965684028b5ce7211d2e72dff5fc135997ff7762a57bff67fbb28cb8753c7dd
Opcode Fuzzy Hash: d577f4ad0ec3e39e69081a652ca220a414ce78918cc3a84716fbb897f15e5052
Instruction Fuzzy Hash: 326126B1A00107DFDB149F78F8682ADB7B6EF84321F104969E506DB240CB35A955CB81

Function 0706EB28 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad2f1c8d4f21bf7ef79f8ac70b2d196ba9a7b24c8a58d16ffcf1371289f13aa8
Instruction ID: ab719ffeae304bad1fd148ba8402b799f41c88a9c9f560b9c572689d7881c046
Opcode Fuzzy Hash: ad2f1c8d4f21bf7ef79f8ac70b2d196ba9a7b24c8a58d16ffcf1371289f13aa8
Instruction Fuzzy Hash: 6C714C74A002099FDB14DFA8D9A4AAEBBFAFF88310F148529D405EB354DB34ED46CB51

Function 0706F968 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7306657ff3b94335f1d8b136b3bd8d7e835bedea50ef193ede154bd58206ef1f
Instruction ID: af9f7a01e058199616f949d290a8b78723bb5a60d493748242408a34957ac2aa
Opcode Fuzzy Hash: 7306657ff3b94335f1d8b136b3bd8d7e835bedea50ef193ede154bd58206ef1f
Instruction Fuzzy Hash: 6951B6F47003069FEF645A6CE86873F269EDB89310F20592AD40AC33D5C96CDC4987A2

Function 0706F978 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da852dc0804b5c2bc40edb9e418dc4201f56a1df9291b913aac120faeb569407
Instruction ID: 5bc8d679a5a60470b423c2c46b1eba9d8f5508cdaa5357e838b30a0a981ceff0
Opcode Fuzzy Hash: da852dc0804b5c2bc40edb9e418dc4201f56a1df9291b913aac120faeb569407
Instruction Fuzzy Hash: DC51C5F07003069FEF645A6CF86873F269FEB89310F205926E50AC3395C96CDC4587A2

Function 07065419 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8511a0e571a5fda80003c8a8469901201cd219eceff4905e8fe7b6ea0720acde
Instruction ID: 268c3256dc0e520a36d08af651c7893263186dcc75a04a508cb2969febdccdf6
Opcode Fuzzy Hash: 8511a0e571a5fda80003c8a8469901201cd219eceff4905e8fe7b6ea0720acde
Instruction Fuzzy Hash: F44181B1A002068FCB70CEA9DCD46AFFBF2FB45310F204A6AE259D7214D731E9558B91

Function 0706D970 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20c2e0e1803f7268fd8f12ee5af26d8a508d33235a8d008630f3b180af1c48ed
Instruction ID: a153739f4e4bb95f0c45057dbe24de00d7711e30ef25b8f765303f5a974d8424
Opcode Fuzzy Hash: 20c2e0e1803f7268fd8f12ee5af26d8a508d33235a8d008630f3b180af1c48ed
Instruction Fuzzy Hash: 2A31A770B1430A8BCF14CF69D49069EBBBAFF85304F148629D805EB304EB74E946CB91

Function 0706207B Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b789587fcab41aa04c13a3ff98310346ce9c77d2804b0594d77a4e6bdc901ce8
Instruction ID: 9ad548f87211df99632651611947aff9916066c3d41e6bacd682694ec63376a9
Opcode Fuzzy Hash: b789587fcab41aa04c13a3ff98310346ce9c77d2804b0594d77a4e6bdc901ce8
Instruction Fuzzy Hash: 52317E70E0020A9BCB05CF65D8A869EB7F2FF89300F148519EA06EB350DB70AD46CB91

Function 07062088 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33cded959795d999f69608f14d4012da44a8ebe4f3c431be03e745a82746cac5
Instruction ID: de1ad935c474d71fb49028e2bdbdb010ba668164cf493ddb4c6103e27df90a6f
Opcode Fuzzy Hash: 33cded959795d999f69608f14d4012da44a8ebe4f3c431be03e745a82746cac5
Instruction Fuzzy Hash: E4316070E0420A9BCB15CF65D8A869EB7F6FF89300F10C529E916EB350DB71AD46CB91

Function 07063AA1 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40edaf7cf7fde17b3339fb1964353fcbc5860df47a39feba94a80ab342bd00d1
Instruction ID: f7687871b3e5cf0cd06d06562e0c8d2559f885413a41feb5c8b42e2a4fe57852
Opcode Fuzzy Hash: 40edaf7cf7fde17b3339fb1964353fcbc5860df47a39feba94a80ab342bd00d1
Instruction Fuzzy Hash: 03218DB5F002169FDB50CF68D981AAEFBF5EB48710F049129EA05E7381DB35DD418B91

Function 07063AB0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e05bd48fad7b12a32caf19b873a76e77db4b0bb7042444f97d9c765f657a918
Instruction ID: bb91d170df546d7e054bf18541a1f2a737f7fb268dac40814411fb3554424293
Opcode Fuzzy Hash: 0e05bd48fad7b12a32caf19b873a76e77db4b0bb7042444f97d9c765f657a918
Instruction Fuzzy Hash: 3D21A1B1F002159FDB50CF69D890AAEF7F5EB48710F105129EA09E7381DB35DD018B91

Function 0184D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4439554243.000000000184D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0184D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_184d000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 055198721668445592b8213da608125395b3042d005ed7510189945e34fb884c
Instruction ID: d5c5263d1c371bd3ba05db0a9a69f920908d6c83877748efd0a082e266052b1f
Opcode Fuzzy Hash: 055198721668445592b8213da608125395b3042d005ed7510189945e34fb884c
Instruction Fuzzy Hash: E5212271604208DFCB15DF98D9C0B26BBA5FB94318F20C66DE9098B256CB3AD506CA62

Function 07064200 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df1099e0e61838a5e41eef8e147bec205da4fab85611c5279328913bdbf00e73
Instruction ID: 8786aa7bf51b21e33f0e30a11618ac9e3644a0b158d7879374f2c6e203dbd2d3
Opcode Fuzzy Hash: df1099e0e61838a5e41eef8e147bec205da4fab85611c5279328913bdbf00e73
Instruction Fuzzy Hash: E91145313041520BDB628A7DD868B2FBBEFDBCA710F24842AF10ACB341DD15DD4283A2

Function 07063BC0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b043b262cba504e45b504cabac6992c9c5fa1d6756fa62061749230468f48680
Instruction ID: 20da5e6f3406e45e1db02949f8c90ee452ef944dee07bbb402205a698efbc0d4
Opcode Fuzzy Hash: b043b262cba504e45b504cabac6992c9c5fa1d6756fa62061749230468f48680
Instruction Fuzzy Hash: 1511A571B000194FDB549A78D8186AEB3FBEBC8350F008139D90AE7350DE35DC068BD1

Function 0706ED99 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ec9fc4780edb054eebaa48788f702820f17d1c60a1b2446bd0a76269c0afc08
Instruction ID: b3956a7410a6758b3516cd1dc53670a3ed53adaaefc11f900125f40e2e30165f
Opcode Fuzzy Hash: 4ec9fc4780edb054eebaa48788f702820f17d1c60a1b2446bd0a76269c0afc08
Instruction Fuzzy Hash: BD01F9357002115BCB21997DD464B6A7BEFEBCA710F14852AE609C7340DD64DC068392

Function 07063878 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09cb5929b08dcafef271271ca3ebada4227176a028d118bdf33e614085d43815
Instruction ID: b25cc69de26e7145fca5a8047d137773a1dcc50d2ad3de574fbfdd67ea301447
Opcode Fuzzy Hash: 09cb5929b08dcafef271271ca3ebada4227176a028d118bdf33e614085d43815
Instruction Fuzzy Hash: A321C2B5D01259AFCB10DF9AD884ADEFFB8FB49350F50822AE518A7200C374A554CFE5

Function 0706A311 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39bc2e716c5606e6144aa9aab8af22d1522afb8231ba0e25d24a0c22309aca34
Instruction ID: 4b868e18ba334fc8e9366291636a1c1c318a8b300f085d8fd91c81261497ba78
Opcode Fuzzy Hash: 39bc2e716c5606e6144aa9aab8af22d1522afb8231ba0e25d24a0c22309aca34
Instruction Fuzzy Hash: 710128707001660FC712D67CE864B1FBBEAEB8B700F108469F14AD7351DE15ED018382

Function 0184D02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4439554243.000000000184D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0184D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_184d000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: b50460b5fb5db4c8458e61440bb5211ab650591ef021742511ee30bfcd77ad55
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: A011BB75504284CFDB12CF58D5C4B15FFA1FB84314F28C6AAD9498B656C33AD44ACB62

Function 07063BAF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97da400a3e1b6e8a961ea55eea69aee39779d78a8a5a02fc061caaf8f2f4c872
Instruction ID: e694666bfff9388d0504d0099ec3ef763b62cb32df947a11400d45be3e53bcc9
Opcode Fuzzy Hash: 97da400a3e1b6e8a961ea55eea69aee39779d78a8a5a02fc061caaf8f2f4c872
Instruction Fuzzy Hash: 5601D472B040195BDB54897CDC287EFBAEBEBC8310F04413ADA0AD3280EE65DC0647D2

Function 07063880 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed0b7df6b12488bc1ebee1d25c0898990d26b15b58c7bcaf40b3e904a193dbe3
Instruction ID: 5afb187c85bec03c2ecbdaf17effb7782c03831f68e2a215c31568382c32b3fa
Opcode Fuzzy Hash: ed0b7df6b12488bc1ebee1d25c0898990d26b15b58c7bcaf40b3e904a193dbe3
Instruction Fuzzy Hash: CF11A2B5D01259AFCB00DF9AD884ADEFFB8FB49310F50812AE518A7240D375A554CFE5

Function 07064210 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e8b2ea2606d28c4f484e8330ee31886285cef7ff5aee8a85057f146bd77993a
Instruction ID: 1cf15fc605b24989a0a2f3744793eb9a14769bdd22cc9b0fcf79876d93e2af83
Opcode Fuzzy Hash: 8e8b2ea2606d28c4f484e8330ee31886285cef7ff5aee8a85057f146bd77993a
Instruction Fuzzy Hash: 2D016D317001160BDB6499BED468B2FB7DBEBC9711F608539E60EC7344DD65DD424392

Function 0706EDA8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7cbcc987a22d07eeed4a02d61baf7713aecbc4f7fb8c27ee2993f84be4d2dad
Instruction ID: c5e8507ecb9c7ffcdaea18fbb927e5476370a59bf5177f4b9e91f08fd5bddca5
Opcode Fuzzy Hash: b7cbcc987a22d07eeed4a02d61baf7713aecbc4f7fb8c27ee2993f84be4d2dad
Instruction Fuzzy Hash: 9701F439B001164BCB65D97DE46872E73EBEBC9610F148539E60EC7340DE65EC034382

Function 0706A320 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f521d0ede9ea631475d814d589546b25ae00528057321785b7f24dd9d7e5601
Instruction ID: c1680350c1936f204892785915f5c94341b1249d679ff31ab98a3512b02fd297
Opcode Fuzzy Hash: 5f521d0ede9ea631475d814d589546b25ae00528057321785b7f24dd9d7e5601
Instruction Fuzzy Hash: 4B0181B07001264BCB51E6BDE464B2FB3DAEB8A751F108929E60ED7350DE25ED028781

Function 07066470 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41ba3de562e985521a32faf7f4752823fb5e0748623a22e3cda70e7320e8a3bd
Instruction ID: c8790308ea81a2600119f003b8b9c7f31cd5fd7576c49c5f3e478aa82138bb95
Opcode Fuzzy Hash: 41ba3de562e985521a32faf7f4752823fb5e0748623a22e3cda70e7320e8a3bd
Instruction Fuzzy Hash: A7E0D8B1A4520ABFEF10DEF0DD2EB9B7BADDB01214F1089A5D404CB182F5B3CA458791

Non-executed Functions

Function 070676A0 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$]q, xrefs: 07067805
$]q, xrefs: 07067811
$]q, xrefs: 07067C52
$]q, xrefs: 07067B91
$]q, xrefs: 07067B9D
$]q, xrefs: 07067C3C
$]q, xrefs: 07067C46
$]q, xrefs: 070677D4
$]q, xrefs: 070677E0
$]q, xrefs: 07067C30

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-2843079600
Opcode ID: ac60ecb802ad99ac7198e192e0e3d9c48d72b77bc00444ede7e88c7475dea8c0
Instruction ID: 8c3e36b531d28a5ed37d127f632eb7e5c410470caffbb66f4c73e2567ad934a5
Opcode Fuzzy Hash: ac60ecb802ad99ac7198e192e0e3d9c48d72b77bc00444ede7e88c7475dea8c0
Instruction Fuzzy Hash: 9F126070A00219CFDB28DF68C894A9DB7F6FF88314F209A69D509AB354DB34AD41CF81

Function 0706A948 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$]q, xrefs: 0706AA3E
$]q, xrefs: 0706AAD0
$]q, xrefs: 0706AA99
$]q, xrefs: 0706AB06
$]q, xrefs: 0706AA4A
$]q, xrefs: 0706AAA5
$]q, xrefs: 0706AAFA
$]q, xrefs: 0706AAC4

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: 44d4dfce0af99bbff20f158742c583fca09326f428d870336a75c9edcd53f974
Instruction ID: 62724ff4806a5ee1eae9ad37407c81d0852ece5f33f81a000fc8647165bf9325
Opcode Fuzzy Hash: 44d4dfce0af99bbff20f158742c583fca09326f428d870336a75c9edcd53f974
Instruction Fuzzy Hash: 909141B0B1020A9FDB18EF68D5A8B6EB7F6EF44310F148629D401AB394DB78DD45CB91

Function 070670A0 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$]q, xrefs: 070675A8
$]q, xrefs: 070673DC
$]q, xrefs: 0706753C
$]q, xrefs: 070675B4
.5uq, xrefs: 070670FB
$]q, xrefs: 070673E8
$]q, xrefs: 07067382

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID: .5uq$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-981061697
Opcode ID: 0e9dbad097063e56da6252710c3e4091482fa250a9726f505bca63889a58096f
Instruction ID: 6e0cc5aed4efd5e38caef898fc4129c09363d20895c20116b4da65cda7a1934e
Opcode Fuzzy Hash: 0e9dbad097063e56da6252710c3e4091482fa250a9726f505bca63889a58096f
Instruction Fuzzy Hash: A7F16E70B00205CFDB19DFA8D5A4A6EB7BAFF88304F249568D4059B364CB79ED42CB91

Function 070683D8 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$]q, xrefs: 070686A3
$]q, xrefs: 07068632
$]q, xrefs: 0706863E
$]q, xrefs: 07068697

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 580297960c6dcd8eeaca38441c32e7d20e678d1ba79e11db4339cd2aec53978a
Instruction ID: 4c687a67b36027a3f230594d391fff6d411053054a3c34fddcf8f5b47a711271
Opcode Fuzzy Hash: 580297960c6dcd8eeaca38441c32e7d20e678d1ba79e11db4339cd2aec53978a
Instruction Fuzzy Hash: 5DB12970A0020A8FDB68DFA8D5A46AEB7F6EF84304F64C529D405DB394DB75DD82CB81

Function 070687F0 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$]q, xrefs: 0706887B
$]q, xrefs: 0706886F
LR]q, xrefs: 070688E3
LR]q, xrefs: 07068932

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID: LR]q$LR]q$$]q$$]q
API String ID: 0-3527005858
Opcode ID: b6b5195564957bd18247efacbe56cb74e8bb4ebc3e4f00ff225806d7db92cb51
Instruction ID: 5caac5f5fdcd7b7c98635fcfc7f5d3978da265771f96c1620361b1a3726a1041
Opcode Fuzzy Hash: b6b5195564957bd18247efacbe56cb74e8bb4ebc3e4f00ff225806d7db92cb51
Instruction Fuzzy Hash: 8B51B2707002069FDB18DB68D9A4A6EB7FAFF88704F14C668D5069B3A0DA34EC45CB91

Function 0706ACD0 Relevance: 5.2, Strings: 4, Instructions: 165COMMON

Download Yara Rule

Strings

$]q, xrefs: 0706AEAC
$]q, xrefs: 0706AE83
$]q, xrefs: 0706AE01
$]q, xrefs: 0706AE54

Memory Dump Source

Source File: 00000005.00000002.4443807025.0000000007060000.00000040.00000800.00020000.00000000.sdmp, Offset: 07060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7060000_M.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: e0605e1bb39063c9b1fe296f58f27ec465a541c5af46b4babe375c8fa1c86939
Instruction ID: acc6f25edbd68ada4ee2498ff8ef71de66a78a39644f9e760ca84e4e5c3e171d
Opcode Fuzzy Hash: e0605e1bb39063c9b1fe296f58f27ec465a541c5af46b4babe375c8fa1c86939
Instruction Fuzzy Hash: 3451BFB4B002058FDF65EF68D4A4AAEB3F6EB89304F208629D406E7350DB35EC41CB91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report M.V TBN - VESSEL'S DETAILS.docx.scr.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\M.V TBN - VESSEL'S DETAILS.docx.scr.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

Windows Analysis Report
M.V TBN - VESSEL'S DETAILS.docx.scr.exe

Function 04DFC938 Relevance: 6.4, Strings: 5, Instructions: 107
COMMON

Function 04DFD458 Relevance: 2.7, Strings: 2, Instructions: 171
COMMON

Function 0700992D Relevance: 1.8, APIs: 1, Instructions: 250
processCOMMON

Function 07009938 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 00F2B328 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Function 04DE14E8 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Function 04DE1DCC Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre