Edit tour

Windows Analysis Report
stopka2017.exe

Overview

General Information

Sample name:	stopka2017.exe
Analysis ID:	1467972
MD5:	68d9fe381653db089a1e64d02f6177e6
SHA1:	9b7655142f01fd2b6b5c964f640404fb72b0e3b5
SHA256:	63afd59bc83f6d3742a63702fa0b0eaa452471a814c4dcf416801475b4b15ae7
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Creates HTA files

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found evasive API chain (may stop execution after checking a module file name)

PE file contains an invalid checksum

Queries the volume information (name, serial number etc) of a device

Searches for the Microsoft Outlook file path

Sigma detected: Suspicious Execution From GUID Like Folder Names

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

stopka2017.exe (PID: 6244 cmdline: "C:\Users\user\Desktop\stopka2017.exe" MD5: 68D9FE381653DB089A1E64D02F6177E6)

mshta.exe (PID: 5168 cmdline: "C:\Windows\System32\mshta.exe" "C:\Users\user\AppData\Local\Temp\{86E40C64-8653-4A9E-A0CD-DAC878E788CC}\Stopka2017.hta" MD5: 06B02D5C097C7DB1F109749C45F3F505)

cleanup

Sigma Signatures

System Summary

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\mshta.exe" "C:\Users\user\AppData\Local\Temp\{86E40C64-8653-4A9E-A0CD-DAC878E788CC}\Stopka2017.hta" , CommandLine: "C:\Windows\System32\mshta.exe" "C:\Users\user\AppData\Local\Temp\{86E40C64-8653-4A9E-A0CD-DAC878E788CC}\Stopka2017.hta" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\mshta.exe, NewProcessName: C:\Windows\SysWOW64\mshta.exe, OriginalFileName: C:\Windows\SysWOW64\mshta.exe, ParentCommandLine: "C:\Users\user\Desktop\stopka2017.exe", ParentImage: C:\Users\user\Desktop\stopka2017.exe, ParentProcessId: 6244, ParentProcessName: stopka2017.exe, ProcessCommandLine: "C:\Windows\System32\mshta.exe" "C:\Users\user\AppData\Local\Temp\{86E40C64-8653-4A9E-A0CD-DAC878E788CC}\Stopka2017.hta" , ProcessId: 5168, ProcessName: mshta.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\mshta.exe" "C:\Users\user\AppData\Local\Temp\{86E40C64-8653-4A9E-A0CD-DAC878E788CC}\Stopka2017.hta" , CommandLine: "C:\Windows\System32\mshta.exe" "C:\Users\user\AppData\Local\Temp\{86E40C64-8653-4A9E-A0CD-DAC878E788CC}\Stopka2017.hta" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\mshta.exe, NewProcessName: C:\Windows\SysWOW64\mshta.exe, OriginalFileName: C:\Windows\SysWOW64\mshta.exe, ParentCommandLine: "C:\Users\user\Desktop\stopka2017.exe", ParentImage: C:\Users\user\Desktop\stopka2017.exe, ParentProcessId: 6244, ParentProcessName: stopka2017.exe, ProcessCommandLine: "C:\Windows\System32\mshta.exe" "C:\Users\user\AppData\Local\Temp\{86E40C64-8653-4A9E-A0CD-DAC878E788CC}\Stopka2017.hta" , ProcessId: 5168, ProcessName: mshta.exe

Sigma detected: Suspicious Execution From GUID Like Folder Names

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\mshta.exe" "C:\Users\user\AppData\Local\Temp\{86E40C64-8653-4A9E-A0CD-DAC878E788CC}\Stopka2017.hta" , CommandLine: "C:\Windows\System32\mshta.exe" "C:\Users\user\AppData\Local\Temp\{86E40C64-8653-4A9E-A0CD-DAC878E788CC}\Stopka2017.hta" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\mshta.exe, NewProcessName: C:\Windows\SysWOW64\mshta.exe, OriginalFileName: C:\Windows\SysWOW64\mshta.exe, ParentCommandLine: "C:\Users\user\Desktop\stopka2017.exe", ParentImage: C:\Users\user\Desktop\stopka2017.exe, ParentProcessId: 6244, ParentProcessName: stopka2017.exe, ProcessCommandLine: "C:\Windows\System32\mshta.exe" "C:\Users\user\AppData\Local\Temp\{86E40C64-8653-4A9E-A0CD-DAC878E788CC}\Stopka2017.hta" , ProcessId: 5168, ProcessName: mshta.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: stopka2017.exe

Virustotal: Detection: 13%

Perma Link

Source: stopka2017.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source:

Binary string: C:\Projets\vbsedit_source\script2exe\Release\hta2exe.pdb source: stopka2017.exe

Source: C:\Users\user\Desktop\stopka2017.exe

Code function: 0_2_00409F80 FindFirstFileW,FindClose,

0_2_00409F80

System Summary

Creates HTA files

Source: C:\Users\user\Desktop\stopka2017.exe

File created: C:\Users\user\AppData\Local\Temp\{86E40C64-8653-4A9E-A0CD-DAC878E788CC}\Stopka2017.hta

Jump to behavior

Source: C:\Users\user\Desktop\stopka2017.exe

Code function: 0_2_004060A9

0_2_004060A9

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: stopka2017.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal60.winEXE@3/1@0/0

Source: C:\Users\user\Desktop\stopka2017.exe

Code function: 0_2_0040A030 SHGetFolderPathW,FindResourceW,LoadResource,LockResource,SizeofResource,_memset,SHCreateDirectoryExW,_swprintf,SHCreateDirectoryExW,CreateFileW,FindResourceW,LoadResource,SizeofResource,LockResource,WriteFile,FreeResource,CloseHandle,GetDesktopWindow,MessageBoxW,ShellExecuteW,

0_2_0040A030

Source: C:\Users\user\Desktop\stopka2017.exe

File created: C:\Users\user\AppData\Local\Temp\{86E40C64-8653-4A9E-A0CD-DAC878E788CC}

Jump to behavior

Source: C:\Users\user\Desktop\stopka2017.exe	Command line argument: \Temp	0_2_0040A030
Source: C:\Users\user\Desktop\stopka2017.exe	Command line argument: #129	0_2_0040A030
Source: C:\Users\user\Desktop\stopka2017.exe	Command line argument: #%d	0_2_0040A030
Source: C:\Users\user\Desktop\stopka2017.exe	Command line argument: HtaEdit	0_2_0040A030
Source: C:\Users\user\Desktop\stopka2017.exe	Command line argument: mshta.exe	0_2_0040A030
Source: C:\Users\user\Desktop\stopka2017.exe	Command line argument: open	0_2_0040A030

Source: stopka2017.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\stopka2017.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\stopka2017.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: stopka2017.exe

Virustotal: Detection: 13%

Source: unknown	Process created: C:\Users\user\Desktop\stopka2017.exe "C:\Users\user\Desktop\stopka2017.exe"
Source: C:\Users\user\Desktop\stopka2017.exe	Process created: C:\Windows\SysWOW64\mshta.exe "C:\Windows\System32\mshta.exe" "C:\Users\user\AppData\Local\Temp\{86E40C64-8653-4A9E-A0CD-DAC878E788CC}\Stopka2017.hta"
Source: C:\Users\user\Desktop\stopka2017.exe	Process created: C:\Windows\SysWOW64\mshta.exe "C:\Windows\System32\mshta.exe" "C:\Users\user\AppData\Local\Temp\{86E40C64-8653-4A9E-A0CD-DAC878E788CC}\Stopka2017.hta"	Jump to behavior

Source: C:\Users\user\Desktop\stopka2017.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\stopka2017.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\stopka2017.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\stopka2017.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\stopka2017.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\stopka2017.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\stopka2017.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\stopka2017.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\stopka2017.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\stopka2017.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\stopka2017.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\stopka2017.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\stopka2017.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\stopka2017.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\stopka2017.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\stopka2017.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\stopka2017.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\stopka2017.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\stopka2017.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\stopka2017.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\stopka2017.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\stopka2017.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: adsldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msls31.dll	Jump to behavior

Source: C:\Users\user\Desktop\stopka2017.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: stopka2017.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: C:\Projets\vbsedit_source\script2exe\Release\hta2exe.pdb source: stopka2017.exe

Source: C:\Users\user\Desktop\stopka2017.exe

Code function: 0_2_00407665 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,

0_2_00407665

Source: stopka2017.exe

Static PE information: real checksum: 0x1822d should be: 0x4e895

Source: C:\Users\user\Desktop\stopka2017.exe

Code function: 0_2_00404145 push ecx; ret

0_2_00404158

Source: C:\Users\user\Desktop\stopka2017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\stopka2017.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_0-4674

Source: C:\Users\user\Desktop\stopka2017.exe

Code function: 0_2_00409F80 FindFirstFileW,FindClose,

0_2_00409F80

Source: C:\Users\user\Desktop\stopka2017.exe

Code function: 0_2_00401000 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00401000

Source: C:\Users\user\Desktop\stopka2017.exe

0_2_00407665

Source: C:\Users\user\Desktop\stopka2017.exe	Code function: 0_2_00401000 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00401000
Source: C:\Users\user\Desktop\stopka2017.exe	Code function: 0_2_00402437 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00402437
Source: C:\Users\user\Desktop\stopka2017.exe	Code function: 0_2_00407A9F __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00407A9F
Source: C:\Users\user\Desktop\stopka2017.exe	Code function: 0_2_00404778 SetUnhandledExceptionFilter,	0_2_00404778

Source: C:\Users\user\Desktop\stopka2017.exe

Process created: C:\Windows\SysWOW64\mshta.exe "C:\Windows\System32\mshta.exe" "C:\Users\user\AppData\Local\Temp\{86E40C64-8653-4A9E-A0CD-DAC878E788CC}\Stopka2017.hta"

Jump to behavior

Source: C:\Users\user\Desktop\stopka2017.exe

Code function: GetLocaleInfoA,

0_2_004097E2

Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\stopka2017.exe

Code function: 0_2_0040103B GetSystemTimeAsFileTime,__aulldiv,

0_2_0040103B

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	11 Process Injection	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 DLL Side-Loading	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Mshta	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
stopka2017.exe	13%	Virustotal		Browse
stopka2017.exe	6%	ReversingLabs

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467972
Start date and time:	2024-07-05 07:36:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	stopka2017.exe
Detection:	MAL
Classification:	mal60.winEXE@3/1@0/0
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 94% Number of executed functions: 7 Number of non-executed functions: 9
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, 6.d.a.8.b.e.f.b.0.0.0.0.0.0.0.0.4.0.0.a.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target mshta.exe, PID 5168 because there are no executed function
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:36:58	API Interceptor	1x Sleep call for process: mshta.exe modified

Process:	C:\Users\user\Desktop\stopka2017.exe
File Type:	HTML document, Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4175
Entropy (8bit):	5.384071289809177
Encrypted:	false
SSDEEP:	96:h/henryHYGMzFwpvQapvQCBQDhvME9nlRcfo:WvzFwpvzpv7mDhvME9P
MD5:	CC0B5911FE6E810A1190124770EA3607
SHA1:	DAA3453841500B7FE090C205C64C6CBD20A0842C
SHA-256:	9DC21ABCF71F028E9FF97FE52BAB5CB2FEB6B687DBBA36626DECCC80198AF5F7
SHA-512:	DEA8CB6CCCAC423655FDBE7CA6D40D04CEFBB1226C04259FEF58EA410364FDF8F859CAAD99B1AC46524E69CFE8A08F19F3795FF6CD4EDD6739E2887C8DAE93BE
Malicious:	true
Reputation:	low
Preview:	<html>.. <title>Stopka 2017</title>.. <head>.. <HTA:APPLICATION .. APPLICATIONNAME="Signature 2017".. BORDER="thin".. MAXIMIZEBUTTON="no".. SCROLL="yes".. SINGLEINSTANCE="yes".. WINDOWSTATE="normal".. ICON="stopka.ico">.. </head>.. .. <style>.. BODY.. {.. background-color: buttonface;.. Font: arial,sans-serif.. margin-top: 10px;.. margin-left: 20px;.. margin-right: 20px;.. margin-bottom: 5px;.. }.. .button.. {.. width: 91px;.. height: 25px;.. font-family: arial,sans-serif;.. font-size: 8pt;.. }.. td.. {.. font-family: arial,sans-serif;.. font-size: 10pt;.. } .. #scroll.. {.. height:100%;.. overflow:auto;.. }.. SELECT.FixedWidth .. {.. width: 17em; /* maybe use px for pixels or pt for points here */.. }.. </style>.. .. <script language="vbscript">.. .. Option Explicit .. .. Dim WinWidth : WinWidth = 370.. Dim WinHeight : WinHeight = 325.. Window.ResizeTo WinWidth, WinHeight.. .. Sub CheckRadioButtons.. 'If Radio(0).Checked Or Radio(1).Checked Then.. '.napis.value =

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	2.7359930855306023
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	stopka2017.exe
File size:	321'536 bytes
MD5:	68d9fe381653db089a1e64d02f6177e6
SHA1:	9b7655142f01fd2b6b5c964f640404fb72b0e3b5
SHA256:	63afd59bc83f6d3742a63702fa0b0eaa452471a814c4dcf416801475b4b15ae7
SHA512:	b3f404e6fc850362072a321fa13a5c7bbad19079a5c01dde765ce6b78d7c0f6b8e206d7761d6c99212f3677e18e666e4a8a0439bb0f8fc97c48c3e43c188de45
SSDEEP:	1536:iiv/NzFqFyRPCsLBPi6EczQVC3RbwSzKQ58/ztk:iMUqFLIddpQ58LO
TLSH:	916483A369009835E86217B80131D9FA977F3EA839B1E20666E5FD377F331C15D62983
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.M.>.#G>.#G>.#G7..G..#G7..G/.#G7..GV.#G..XG9.#G>."G_.#G7..G<.#G ..G?.#G7..G?.#GRich>.#G........PE..L.....`R...................

File Icon


Icon Hash:	6f2b380f0323338e

Static PE Info

General

Entrypoint:	0x401d0e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x5260FEC8 [Fri Oct 18 09:26:32 2013 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	f0d2a479b7bd825eb66677ed15d67759

Entrypoint Preview

Instruction
call 00007F54D919378Ch
jmp 00007F54D919058Eh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov dword ptr [0040F0B8h], eax
mov dword ptr [0040F0B4h], ecx
mov dword ptr [0040F0B0h], edx
mov dword ptr [0040F0ACh], ebx
mov dword ptr [0040F0A8h], esi
mov dword ptr [0040F0A4h], edi
mov word ptr [0040F0D0h], ss
mov word ptr [0040F0C4h], cs
mov word ptr [0040F0A0h], ds
mov word ptr [0040F09Ch], es
mov word ptr [0040F098h], fs
mov word ptr [0040F094h], gs
pushfd
pop dword ptr [0040F0C8h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [0040F0BCh], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [0040F0C0h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [0040F0CCh], eax
mov eax, dword ptr [ebp-00000320h]
mov dword ptr [0040F008h], 00010001h
mov eax, dword ptr [0040F0C0h]
mov dword ptr [0040EFBCh], eax
mov dword ptr [0040EFB0h], C0000409h
mov dword ptr [0040EFB4h], 00000001h
mov eax, dword ptr [0040E048h]
mov dword ptr [ebp-00000328h], eax
mov eax, dword ptr [0040E04Ch]
mov dword ptr [ebp-00000324h], eax
call dword ptr [00000060h]

Rich Headers

Programming Language:

[C++] VS2008 SP1 build 30729
[ASM] VS2008 SP1 build 30729
[ C ] VS2008 SP1 build 30729
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd284	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x11000	0x41098	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb190	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xccd0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xb000	0x150	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x970d	0x9800	374b689d059029b464ccc836a57bb089	False	0.6057514391447368	data	6.5499267773949255	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xb000	0x29f8	0x2a00	bab75a8a7792e29e923d5d9a1e767979	False	0.375	data	5.434401623855427	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xe000	0x2c84	0x1000	b7fff4fbd55494b0f90b7c9df8168291	False	0.217529296875	data	2.266296966661002	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x11000	0x41098	0x41200	986b5c5602f3a2bcb56a035f6fc0913b	False	0.05420015595009597	data	1.6247437156370073	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x11220	0x3e428	Device independent bitmap graphic, 241 x 512 x 32, image size 246784, resolution 2834 x 2834 px/m			0.04015826457947737
RT_ICON	0x4f648	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224			0.2326454033771107
RT_ICON	0x506f0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088			0.3608156028368794
RT_GROUP_ICON	0x50b58	0x14	data			1.2
RT_VERSION	0x50b6c	0x1e4	data			0.506198347107438
RT_HTML	0x50d50	0x6e	Unicode text, UTF-16, little-endian text, with no line terminators			0.8
RT_HTML	0x50dc0	0x104f	Non-ISO extended-ASCII text, with very long lines (850), with NEL line terminators			0.3882634730538922
RT_MANIFEST	0x51e10	0x12a	ASCII text, with no line terminators			0.5838926174496645
RT_MANIFEST	0x51f3c	0x15a	ASCII text, with CRLF line terminators	English	United States	0.5491329479768786

Imports

DLL	Import
KERNEL32.dll	FindFirstFileW, FindClose, FindResourceW, LoadResource, LockResource, SizeofResource, CreateFileW, WriteFile, FreeResource, CloseHandle, FlushFileBuffers, CreateFileA, WriteConsoleW, GetConsoleOutputCP, GetSystemTimeAsFileTime, GetModuleHandleW, Sleep, GetProcAddress, ExitProcess, GetStartupInfoW, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, GetLastError, InterlockedDecrement, HeapAlloc, RaiseException, HeapFree, GetStdHandle, GetModuleFileNameA, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, LoadLibraryA, InitializeCriticalSectionAndSpinCount, GetModuleFileNameW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, SetHandleCount, GetFileType, GetStartupInfoA, HeapCreate, VirtualFree, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, HeapSize, VirtualAlloc, HeapReAlloc, SetFilePointer, WideCharToMultiByte, GetConsoleCP, GetConsoleMode, MultiByteToWideChar, RtlUnwind, GetLocaleInfoA, GetStringTypeA, GetStringTypeW, LCMapStringA, LCMapStringW, SetStdHandle, WriteConsoleA
USER32.dll	MessageBoxW, GetDesktopWindow
SHELL32.dll	SHCreateDirectoryExW, SHGetFolderPathW, ShellExecuteW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 5, 2024 07:37:43.409583092 CEST	53	49758	162.159.36.2	192.168.2.6
Jul 5, 2024 07:37:43.904211998 CEST	53	56256	1.1.1.1	192.168.2.6

Target ID:	0
Start time:	01:36:57
Start date:	05/07/2024
Path:	C:\Users\user\Desktop\stopka2017.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\stopka2017.exe"
Imagebase:	0x400000
File size:	321'536 bytes
MD5 hash:	68D9FE381653DB089A1E64D02F6177E6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	01:36:57
Start date:	05/07/2024
Path:	C:\Windows\SysWOW64\mshta.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\mshta.exe" "C:\Users\user\AppData\Local\Temp\{86E40C64-8653-4A9E-A0CD-DAC878E788CC}\Stopka2017.hta"
Imagebase:	0x900000
File size:	13'312 bytes
MD5 hash:	06B02D5C097C7DB1F109749C45F3F505
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7.1%
Total number of Nodes:	1658
Total number of Limit Nodes:	35

Executed Functions

Function 0040A030 Relevance: 49.4, APIs: 20, Strings: 8, Instructions: 411
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00409F20: __time64.LIBCMT ref: 00409F27

Part of subcall function 00401029: __getptd.LIBCMT ref: 0040102E

SHGetFolderPathW.SHELL32(00000000,0000801C,00000000,00000000,?), ref: 0040A06C
FindResourceW.KERNEL32(00000000,#129,00000017), ref: 0040A0A8
LoadResource.KERNEL32(00000000,00000000), ref: 0040A0C6
LockResource.KERNEL32(00000000), ref: 0040A0E2
SizeofResource.KERNEL32(00000000,00000000), ref: 0040A100
_memset.LIBCMT ref: 0040A1F8
SHCreateDirectoryExW.SHELL32(00000000,?,00000000), ref: 0040A2A3

Strings

mshta.exe, xrefs: 0040A6D5
\Temp, xrefs: 0040A072
#%d, xrefs: 0040A300
HtaEdit, xrefs: 0040A6B0
P, xrefs: 0040A2C4
This executable has been built with the unregistered version of HtaEdit.The registered version does not display this notice., xrefs: 0040A6B5
open, xrefs: 0040A6DA
#129, xrefs: 0040A0A1

Memory Dump Source

Source File: 00000000.00000002.2066922820.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066890273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066939321.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066979186.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_stopka2017.jbxd

Similarity

API ID: Resource$CreateDirectoryFindFolderLoadLockPathSizeof__getptd__time64_memset
String ID: #%d$#129$HtaEdit$P$This executable has been built with the unregistered version of HtaEdit.The registered version does not display this notice.$\Temp$mshta.exe$open
API String ID: 2271237972-606975464
Opcode ID: e6fa5b21570bd89c168d2b12b429e11aed5585307e325dbfb3118079b7b3469c
Instruction ID: 67c7c94e90a422b0cbe3450348450bbebdaaf90e0d4bef1a922550f5e4d56a62
Opcode Fuzzy Hash: e6fa5b21570bd89c168d2b12b429e11aed5585307e325dbfb3118079b7b3469c
Instruction Fuzzy Hash: BD026DF1A40228ABDB20DB50DC85BA9B374EB58304F4445E9F608B72C1E7B95A94CF5E

Function 00409F80 Relevance: 3.0, APIs: 2, Instructions: 26
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?), ref: 00409F9E
FindClose.KERNEL32(000000FF), ref: 00409FBE

Memory Dump Source

Source File: 00000000.00000002.2066922820.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066890273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066939321.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066979186.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_stopka2017.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 2a6c6789138963b8a2ae7610846c8dc9940de07343a11337a4b492bacadab8d2
Instruction ID: b51912a9b18dfb52d7f56d418a7bdb167fabce29a6e348d5735fcdb69d59bfdd
Opcode Fuzzy Hash: 2a6c6789138963b8a2ae7610846c8dc9940de07343a11337a4b492bacadab8d2
Instruction Fuzzy Hash: 26F0A77090070C9FCB10DF71DD086DA73B4EB88315F1046A9E519A7281EA345D449F9C

Function 00401173 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 0040118D

Part of subcall function 0040288C: __FF_MSGBANNER.LIBCMT ref: 004028AF
Part of subcall function 0040288C: __NMSG_WRITE.LIBCMT ref: 004028B6
Part of subcall function 0040288C: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00405841,?,00000001,?,?,00403E8B,00000018,0040CFE0,0000000C,00403F1C), ref: 00402903

std::bad_alloc::bad_alloc.LIBCMT ref: 004011B0

Part of subcall function 00401109: std::exception::exception.LIBCMT ref: 00401115

std::bad_exception::bad_exception.LIBCMT ref: 004011C4
__CxxThrowException@8.LIBCMT ref: 004011D2

Strings

`@, xrefs: 004011A0

Memory Dump Source

Source File: 00000000.00000002.2066922820.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066890273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066939321.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066979186.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_stopka2017.jbxd

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
String ID: `@
API String ID: 1411284514-951712118
Opcode ID: 26ee4b0004ab71c9a39da855a1725d71866f8fcae9d167e8e966bf64585d7f62
Instruction ID: d9a083ce72f4b8abaf0dcd5c603cd8fdc8e54bc2bf3e4dbfd8ce5d58bc4fb1f4
Opcode Fuzzy Hash: 26ee4b0004ab71c9a39da855a1725d71866f8fcae9d167e8e966bf64585d7f62
Instruction Fuzzy Hash: 58F0BE3590020AA3CB0C7732E80A95937685B08358F24853BE941BA1E1DFBD8941CA9C

Function 0040A164 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93
filewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040A1F8
SHCreateDirectoryExW.SHELL32(00000000,?,00000000), ref: 0040A2A3
_swprintf.LIBCMTD ref: 0040A30E
SHCreateDirectoryExW.SHELL32(00000000,?,00000000), ref: 0040A3A8
CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 0040A44A
GetDesktopWindow.USER32 ref: 0040A6BA
MessageBoxW.USER32(00000000), ref: 0040A6C1
ShellExecuteW.SHELL32(00000000,open,mshta.exe,?,0040CCAC,00000005), ref: 0040A6E1

Part of subcall function 00401173: _malloc.LIBCMT ref: 0040118D

Strings

P, xrefs: 0040A2C4

Memory Dump Source

Source File: 00000000.00000002.2066922820.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066890273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066939321.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066979186.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_stopka2017.jbxd

Similarity

API ID: Create$Directory$DesktopExecuteFileMessageShellWindow_malloc_memset_swprintf
String ID: P
API String ID: 550803703-3110715001
Opcode ID: c6b6d7fb4b017b01e8b4468b11cb176858a29ec168429b8c168cdcd66f1b0aa1
Instruction ID: 7e0d718fa788e4c34e49f5937c9f7049fa39a3e959662ce66ae89e3f9deabd87
Opcode Fuzzy Hash: c6b6d7fb4b017b01e8b4468b11cb176858a29ec168429b8c168cdcd66f1b0aa1
Instruction Fuzzy Hash: 854149B1A002289BCB28DB54DC85AADB3B1EB88305F4441EEF60977291D7795ED0CF59

Function 004018B4 Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 004018BC

Part of subcall function 00401889: GetModuleHandleW.KERNEL32(mscoree.dll,?,004018C1,?,?,004028C5,000000FF,0000001E,?,00405841,?,00000001,?,?,00403E8B,00000018), ref: 00401893
Part of subcall function 00401889: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004018A3

ExitProcess.KERNEL32 ref: 004018C5

Memory Dump Source

Source File: 00000000.00000002.2066922820.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066890273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066939321.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066979186.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_stopka2017.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: a45f812da7ce9f3fa687a9a22a86aa22456d670c9996326a439d8a9088c856bb
Instruction ID: d9eb1fcb8d5c172a914f002d6296a9f79f9da5bbe669f2d7aa44f8a5d01aa008
Opcode Fuzzy Hash: a45f812da7ce9f3fa687a9a22a86aa22456d670c9996326a439d8a9088c856bb
Instruction Fuzzy Hash: 6AB09232000208BFCB053F12EC0A85A3F2AEB803A5B108035F81919072DF76AE929AC8

Function 00404D5A Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 00404D6F

Memory Dump Source

Source File: 00000000.00000002.2066922820.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066890273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066939321.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066979186.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_stopka2017.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: bf2cbcc806c6bc44710c7ddcaa6f85f66d302889f1da169e8c5da3c8d7cdd469
Instruction ID: 6184b2da281ca6016ac0271474126ac2c76021815db6eaa891f361928dfac60c
Opcode Fuzzy Hash: bf2cbcc806c6bc44710c7ddcaa6f85f66d302889f1da169e8c5da3c8d7cdd469
Instruction Fuzzy Hash: 6BD02E72564304AAEB218FB4BC087323BDCD780395F008036FD0CC2180E370C5408148

Function 00401AD0 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_doexit.LIBCMT ref: 00401ADC

Part of subcall function 004019A4: __lock.LIBCMT ref: 004019B2
Part of subcall function 004019A4: __decode_pointer.LIBCMT ref: 004019E9
Part of subcall function 004019A4: __decode_pointer.LIBCMT ref: 004019FE
Part of subcall function 004019A4: __decode_pointer.LIBCMT ref: 00401A28
Part of subcall function 004019A4: __decode_pointer.LIBCMT ref: 00401A3E
Part of subcall function 004019A4: __decode_pointer.LIBCMT ref: 00401A4B
Part of subcall function 004019A4: __initterm.LIBCMT ref: 00401A7A
Part of subcall function 004019A4: __initterm.LIBCMT ref: 00401A8A

Memory Dump Source

Source File: 00000000.00000002.2066922820.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066890273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066939321.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066979186.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_stopka2017.jbxd

Similarity

API ID: __decode_pointer$__initterm$__lock_doexit
String ID:
API String ID: 1597249276-0
Opcode ID: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction ID: 31ad72b1b0a8f67507cfb5c715645a0153882bf3641726bcdd5842da0ec406e5
Opcode Fuzzy Hash: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction Fuzzy Hash: F2B09B7154020833D51015429C03F553A0947C0764E540021B60C191E155A6655580C9

Non-executed Functions

Function 00401000 Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsDebuggerPresent.KERNEL32 ref: 00401DD3
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00401DE8
UnhandledExceptionFilter.KERNEL32(0040B1F0), ref: 00401DF3
GetCurrentProcess.KERNEL32(C0000409), ref: 00401E0F
TerminateProcess.KERNEL32(00000000), ref: 00401E16

Memory Dump Source

Source File: 00000000.00000002.2066922820.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066890273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066939321.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066979186.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_stopka2017.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 6e3e836b459f597e3b132ebfebc9e9b8bbf38e264aa1dfad4248ff04983e6aec
Instruction ID: 0bb735be146273eb839fa64778d0a4a719c761efff924a73d878bf610d17bcc9
Opcode Fuzzy Hash: 6e3e836b459f597e3b132ebfebc9e9b8bbf38e264aa1dfad4248ff04983e6aec
Instruction Fuzzy Hash: 3121C0B4815304DFD720DF65EF456467BA0FB08305F10843AEA08B7BA2E7B459888F9D

Function 00404778 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00004736), ref: 0040477D

Memory Dump Source

Source File: 00000000.00000002.2066922820.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066890273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066939321.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066979186.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_stopka2017.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: fd3b61a800fc77083c6e0b9dad2a4fde3d86a5c3e7a1598b086878a8b411c7c9
Instruction ID: 6230234ed6b9396946f7160fedeb2ede5b9f78823a6655994de373a722a7f816
Opcode Fuzzy Hash: fd3b61a800fc77083c6e0b9dad2a4fde3d86a5c3e7a1598b086878a8b411c7c9
Instruction Fuzzy Hash: 439002A025120096D730A7705D0D5076690DA8A71775184716251E5494DB744000956D

Function 00401F85 Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 57
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,0040CF10,0000000C,004020C0,00000000,00000000,?,?,004020ED,?,00401033), ref: 00401F97
__crt_waiting_on_module_handle.LIBCMT ref: 00401FA2

Part of subcall function 00401830: Sleep.KERNEL32(000003E8,00000000,?,00401EE8,KERNEL32.DLL,?,00401F34,?,00402083,?,?,004020ED,?,00401033), ref: 0040183C
Part of subcall function 00401830: GetModuleHandleW.KERNEL32(?,?,00401EE8,KERNEL32.DLL,?,00401F34,?,00402083,?,?,004020ED,?,00401033), ref: 00401845

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00401FCB
GetProcAddress.KERNEL32(?,DecodePointer), ref: 00401FDB
__lock.LIBCMT ref: 00401FFD
InterlockedIncrement.KERNEL32(0040E538), ref: 0040200A
__lock.LIBCMT ref: 0040201E
___addlocaleref.LIBCMT ref: 0040203C

Strings

EncodePointer, xrefs: 00401FBF
P@, xrefs: 00402031
DecodePointer, xrefs: 00401FD3
KERNEL32.DLL, xrefs: 00401F91, 00401F96, 00401FA1
8@, xrefs: 00401FF4

Memory Dump Source

Source File: 00000000.00000002.2066922820.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066890273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066939321.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066979186.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_stopka2017.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: 8@$DecodePointer$EncodePointer$KERNEL32.DLL$P@
API String ID: 1028249917-1886493496
Opcode ID: 51e3c0664736392c74b8b277f5d8175cebf14eb29050de6281f278ac3fb4163e
Instruction ID: 93dfbdf727b1262c84f29c5e97bf611300e02d5b8e8abe8377074ce84542701f
Opcode Fuzzy Hash: 51e3c0664736392c74b8b277f5d8175cebf14eb29050de6281f278ac3fb4163e
Instruction Fuzzy Hash: CF11A171840702EAD710AF76D945B5ABBE0EF14314F10453FE565B63E0CBB89A41CB5C

Function 00405373 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__getptd.LIBCMT ref: 0040537F

Part of subcall function 004020E5: __getptd_noexit.LIBCMT ref: 004020E8
Part of subcall function 004020E5: __amsg_exit.LIBCMT ref: 004020F5

__amsg_exit.LIBCMT ref: 0040539F
__lock.LIBCMT ref: 004053AF
InterlockedDecrement.KERNEL32(?), ref: 004053CC
InterlockedIncrement.KERNEL32(02132D90), ref: 004053F7

Strings

8@, xrefs: 004053D6

Memory Dump Source

Source File: 00000000.00000002.2066922820.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066890273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066939321.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066979186.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_stopka2017.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID: 8@
API String ID: 4271482742-819625340
Opcode ID: cf1e1f270195e85c79e8c3b319aa750a28a249f4b8efd5e4d64402f02bbee5ea
Instruction ID: 89bafbd8448753d296c7fafddd7cbb45ae6d8989632fa875147614c87ea326c6
Opcode Fuzzy Hash: cf1e1f270195e85c79e8c3b319aa750a28a249f4b8efd5e4d64402f02bbee5ea
Instruction Fuzzy Hash: 6B01AD32901A21EBDB20AB66994974F77A0EB04759F10083BEC10B76D1DBBC6951CFCD

Function 004050D7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__getptd.LIBCMT ref: 004050E3

Part of subcall function 004020E5: __getptd_noexit.LIBCMT ref: 004020E8
Part of subcall function 004020E5: __amsg_exit.LIBCMT ref: 004020F5

__getptd.LIBCMT ref: 004050FA
__amsg_exit.LIBCMT ref: 00405108
__lock.LIBCMT ref: 00405118

Strings

P@, xrefs: 00405125

Memory Dump Source

Source File: 00000000.00000002.2066922820.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066890273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066939321.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066979186.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_stopka2017.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID: P@
API String ID: 3521780317-2576892400
Opcode ID: 292315619262c9bd03a0c3c32dc5d33be8f5e60fe6b90dd8fdf3790a4c901334
Instruction ID: 45ce987a040570b940bfd1b67db92ead2b9782dad656f6b329638e645959e1d2
Opcode Fuzzy Hash: 292315619262c9bd03a0c3c32dc5d33be8f5e60fe6b90dd8fdf3790a4c901334
Instruction Fuzzy Hash: E5F06D32D00B149BD760BBA6980775A76A0AB44729F10497FE500BB2D2CBBDA941CE5D

Function 00403B13 Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 00403B31

Part of subcall function 00403F01: __mtinitlocknum.LIBCMT ref: 00403F17
Part of subcall function 00403F01: __amsg_exit.LIBCMT ref: 00403F23
Part of subcall function 00403F01: EnterCriticalSection.KERNEL32(?,?,?,0040853B,00000004,0040D180,0000000C,0040588B,?,?,00000000,00000000,00000000,?,00402097,00000001), ref: 00403F2B

___sbh_find_block.LIBCMT ref: 00403B3C
___sbh_free_block.LIBCMT ref: 00403B4B
HeapFree.KERNEL32(00000000,?,0040CFC0,0000000C,00403EE2,00000000,0040CFE0,0000000C,00403F1C,?,?,?,0040853B,00000004,0040D180,0000000C), ref: 00403B7B
GetLastError.KERNEL32(?,0040853B,00000004,0040D180,0000000C,0040588B,?,?,00000000,00000000,00000000,?,00402097,00000001,00000214), ref: 00403B8C

Memory Dump Source

Source File: 00000000.00000002.2066922820.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066890273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066939321.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066979186.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_stopka2017.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: d40e4bded3547a574fada6302cb5c8a75203ac074cc5f097bf97510ee4f74a70
Instruction ID: 1ed3d528fb89d26d96b841ba9b13040ff4c7b6b0184ab87104d6cdf21aa37396
Opcode Fuzzy Hash: d40e4bded3547a574fada6302cb5c8a75203ac074cc5f097bf97510ee4f74a70
Instruction Fuzzy Hash: 44012171905205AADB206F71AD4AB5F7E78AF0071DF20453FF504BA1C2DB7CAA418A9D

Function 004070CF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 004070F1
__calloc_crt.LIBCMT ref: 0040710A

Strings

@, xrefs: 00407173
p@, xrefs: 00407121

Memory Dump Source

Source File: 00000000.00000002.2066922820.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066890273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066939321.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066979186.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_stopka2017.jbxd

Similarity

API ID: __calloc_crt
String ID: p@$@
API String ID: 3494438863-182354213
Opcode ID: 68f1f67d400d3783efbfbe76d1c8295ca7d93854fd5b98a01ce9ea8ddd010927
Instruction ID: e58deb14ca4d686b66a55d25d5ab87a9c9dfa1ee0c59f417d0b25fcba68291ec
Opcode Fuzzy Hash: 68f1f67d400d3783efbfbe76d1c8295ca7d93854fd5b98a01ce9ea8ddd010927
Instruction Fuzzy Hash: 9011E731B1C21157E7248A2EBC51A623395E788728B24863BF601EE3D5D678F882464E

Function 00405099 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

___addlocaleref.LIBCMT ref: 004050AB

Part of subcall function 00404F71: InterlockedIncrement.KERNEL32(?), ref: 00404F83
Part of subcall function 00404F71: InterlockedIncrement.KERNEL32(?), ref: 00404F90
Part of subcall function 00404F71: InterlockedIncrement.KERNEL32(?), ref: 00404F9D
Part of subcall function 00404F71: InterlockedIncrement.KERNEL32(?), ref: 00404FAA
Part of subcall function 00404F71: InterlockedIncrement.KERNEL32(?), ref: 00404FB7
Part of subcall function 00404F71: InterlockedIncrement.KERNEL32(?), ref: 00404FD3
Part of subcall function 00404F71: InterlockedIncrement.KERNEL32(00000000), ref: 00404FE3
Part of subcall function 00404F71: InterlockedIncrement.KERNEL32(?), ref: 00404FF9

___removelocaleref.LIBCMT ref: 004050B6

Part of subcall function 00405000: InterlockedDecrement.KERNEL32(00407591), ref: 0040501A
Part of subcall function 00405000: InterlockedDecrement.KERNEL32(24541B10), ref: 00405027
Part of subcall function 00405000: InterlockedDecrement.KERNEL32(1B082444), ref: 00405034
Part of subcall function 00405000: InterlockedDecrement.KERNEL32(2BDB3314), ref: 00405041
Part of subcall function 00405000: InterlockedDecrement.KERNEL32(83D8F7DA), ref: 0040504E
Part of subcall function 00405000: InterlockedDecrement.KERNEL32(83D8F7DA), ref: 0040506A
Part of subcall function 00405000: InterlockedDecrement.KERNEL32(448BD88B), ref: 0040507A
Part of subcall function 00405000: InterlockedDecrement.KERNEL32(8B55FED7), ref: 00405090

___freetlocinfo.LIBCMT ref: 004050CA

Part of subcall function 00404E28: ___free_lconv_mon.LIBCMT ref: 00404E6E
Part of subcall function 00404E28: ___free_lconv_num.LIBCMT ref: 00404E8F
Part of subcall function 00404E28: ___free_lc_time.LIBCMT ref: 00404F14

Strings

P@, xrefs: 004050C1

Memory Dump Source

Source File: 00000000.00000002.2066922820.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066890273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066939321.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066979186.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_stopka2017.jbxd

Similarity

API ID: Interlocked$DecrementIncrement$___addlocaleref___free_lc_time___free_lconv_mon___free_lconv_num___freetlocinfo___removelocaleref
String ID: P@
API String ID: 467427115-2576892400
Opcode ID: e3482a1573c6d3a07d82dd9e17644850ac0fb9d0e0d13d3f343ce4ab07a00c63
Instruction ID: 383dead39ef71e1e1dcd079927ab95f572f11390da728018fa155e8cc7c7cb95
Opcode Fuzzy Hash: e3482a1573c6d3a07d82dd9e17644850ac0fb9d0e0d13d3f343ce4ab07a00c63
Instruction Fuzzy Hash: CCE0DF33501C2101CA312529641436FB288CF81314FBA003BF808BB7C1EB3C5C8099FC

Function 0040744D Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00407481
__isleadbyte_l.LIBCMT ref: 004074B5
MultiByteToWideChar.KERNEL32(00000080,00000009,004013E8,?,00000000,00000000,?,?,?,?,004013E8), ref: 004074E6
MultiByteToWideChar.KERNEL32(00000080,00000009,004013E8,00000001,00000000,00000000,?,?,?,?,004013E8), ref: 00407554

Memory Dump Source

Source File: 00000000.00000002.2066922820.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066890273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066939321.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066979186.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066997063.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_stopka2017.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 64842263c045c9e913d0ede6f41d6a3c6c384cefa37386dbee949877ada3f6e0
Instruction ID: 522790c7f44f66b35ebc33cb1467b44ce90adb6fb33efdb3ecc8feb0813c704b
Opcode Fuzzy Hash: 64842263c045c9e913d0ede6f41d6a3c6c384cefa37386dbee949877ada3f6e0
Instruction Fuzzy Hash: 67319E31E08245AFDB21DF64CC85DAA7FB5FF01311B14857AE4A1AB2E1D334E940DB5A

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report stopka2017.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\{86E40C64-8653-4A9E-A0CD-DAC878E788CC}\Stopka2017.hta

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

UDP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: stopka2017.exePID: 6244, Parent PID: 4004

General

Chronological Activities

Analysis Process: mshta.exePID: 5168, Parent PID: 6244

Windows Analysis Report
stopka2017.exe

Function 0040A030 Relevance: 49.4, APIs: 20, Strings: 8, Instructions: 411
COMMON

Function 00409F80 Relevance: 3.0, APIs: 2, Instructions: 26
fileCOMMON

Function 00401173 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42
COMMON

Function 0040A164 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93
filewindowCOMMON

Function 004018B4 Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Function 00404D5A Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Function 00401AD0 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Function 00401000 Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Function 00401F85 Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 57
libraryloaderCOMMONLIBRARYCODE

Function 00405373 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47
COMMONLIBRARYCODE

Function 004050D7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31
COMMONLIBRARYCODE

Function 00403B13 Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE