Edit tour

Windows Analysis Report
encrypter-win32.rar

Overview

General Information

Sample name:	encrypter-win32.rar
Analysis ID:	1483429
MD5:	32d7de2ac3582fa9e5f10ea9ded54beb
SHA1:	ed7ec48acc8bf7b3f5e360c6bee876dc6fbfccbb
SHA256:	4dc4d6c8df24edc0d256a753c8a7068000ca05288a633325e9ac41fa31444483
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Allocates memory with a write watch (potentially for evading sandboxes)

Creates a process in suspended mode (likely to inject code)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

Classification

Process Tree

System is w10x64

unarchiver.exe (PID: 7312 cmdline: "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Desktop\encrypter-win32.rar" MD5: 16FF3CC6CC330A08EED70CBC1D35F5D2)

7za.exe (PID: 7336 cmdline: "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\tcbbx44c.cen" "C:\Users\user\Desktop\encrypter-win32.rar" MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 7344 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.12.23.50 - Destination IP: 192.168.2.4

Timestamp:	2024-07-27T13:16:34.801794+0200
SID:	2022930
Source Port:	443
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.12.23.50 - Destination IP: 192.168.2.4

Timestamp:	2024-07-27T13:17:13.453775+0200
SID:	2022930
Source Port:	443
Destination Port:	49736
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: classification engine

Classification label: clean2.winRAR@4/1@0/0

Source: C:\Windows\SysWOW64\unarchiver.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7344:120:WilError_03

Source: C:\Windows\SysWOW64\unarchiver.exe

File created: C:\Users\user\AppData\Local\Temp\unarchiver.log

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Desktop\encrypter-win32.rar"
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\tcbbx44c.cen" "C:\Users\user\Desktop\encrypter-win32.rar"
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\tcbbx44c.cen" "C:\Users\user\Desktop\encrypter-win32.rar"	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	Section loaded: 7z.dll	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: 1300000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: 3020000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: 1390000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Window / User API: threadDelayed 837			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Window / User API: threadDelayed 9132			Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe TID: 7396	Thread sleep count: 837 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 7396	Thread sleep time: -418500s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 7396	Thread sleep count: 9132 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 7396	Thread sleep time: -4566000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Code function: 0_2_0126B1D6 GetSystemInfo,

0_2_0126B1D6

Source: C:\Windows\SysWOW64\unarchiver.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\tcbbx44c.cen" "C:\Users\user\Desktop\encrypter-win32.rar"

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	2 Virtualization/Sandbox Evasion	OS Credential Dumping	2 Virtualization/Sandbox Evasion	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	3 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1483429
Start date and time:	2024-07-27 13:15:26 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	encrypter-win32.rar
Detection:	CLEAN
Classification:	clean2.winRAR@4/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 46 Number of non-executed functions: 0
Cookbook Comments:	Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
07:16:47	API Interceptor	4907002x Sleep call for process: unarchiver.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Temp\unarchiver.log

Download File

Process:	C:\Windows\SysWOW64\unarchiver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3675
Entropy (8bit):	5.040021162080001
Encrypted:	false
SSDEEP:	48:1JnGBGbBGBGpPGXGBGp4+GbLGp+GUGZGe4G3SGrGaSGSGaGBGBGmyGBG0GBGmdI3:5Cz936FPK0
MD5:	208DEAF4EFCF0A095489AE31C75D0B6D
SHA1:	F1D894C12C9E29B9E32D9507CB6968DED8B1E47F
SHA-256:	796FD03A7058157D6020C07CEEDAFC938BAC698BDF80762F272DF9528C990F2B
SHA-512:	3694F2CE32C3EDB0C15E9C7BDE26202503FD30BD9C684AC108BA03ED0B65C4675660CEB12709090336D4E8B68AC0B32B5185F253DECCAA68312D451682455D59
Malicious:	false
Reputation:	low
Preview:	07/27/2024 7:16 AM: Unpack: C:\Users\user\Desktop\encrypter-win32.rar..07/27/2024 7:16 AM: Tmp dir: C:\Users\user\AppData\Local\Temp\tcbbx44c.cen..07/27/2024 7:16 AM: Received from standard out: ..07/27/2024 7:16 AM: Received from standard out: 7-Zip 18.05 (x86) : Copyright (c) 1999-2018 Igor Pavlov : 2018-04-30..07/27/2024 7:16 AM: Received from standard out: ..07/27/2024 7:16 AM: Received from standard out: Scanning the drive for archives:..07/27/2024 7:16 AM: Received from standard out: 1 file, 48236 bytes (48 KiB)..07/27/2024 7:16 AM: Received from standard out: ..07/27/2024 7:16 AM: Received from standard out: Extracting archive: C:\Users\user\Desktop\encrypter-win32.rar..07/27/2024 7:16 AM: Received from standard out: --..07/27/2024 7:16 AM: Received from standard out: Path = C:\Users\user\Desktop\encrypter-win32.rar..07/27/2024 7:16 AM: Received from standard out: Type = Rar5..07/27/2024 7:16 AM: Received from standard out: Physical Size = 48236..07/27/2024 7:16 AM: Received

Static File Info

General

File type:	RAR archive data, v5
Entropy (8bit):	7.995877376396722
TrID:	RAR Archive (5005/1) 100.00%
File name:	encrypter-win32.rar
File size:	48'236 bytes
MD5:	32d7de2ac3582fa9e5f10ea9ded54beb
SHA1:	ed7ec48acc8bf7b3f5e360c6bee876dc6fbfccbb
SHA256:	4dc4d6c8df24edc0d256a753c8a7068000ca05288a633325e9ac41fa31444483
SHA512:	0fbca64a231c64b5b9ec3f0a46ed1d16963112612e3906750c1241ac618f7eecd1422becdd656fa42bbdb4a37b7e2d4f2a022b6943dbf369d05a38ad1ebd6e1c
SSDEEP:	768:Re4yrI5JCLQHrYaaeFTc6pdhO3STGlr3NyFE4swzUpkqinqH5Kwm+JvnSbXFqnCH:Rc8JC0Iqv1alr3QSwYViqH51m2SbwnCH
TLSH:	EC23F1E54AFE5840D43C6F960C177D50428E33B653B7AE3EB5A0672D9068CD1CD2C2B5
File Content Preview:	Rar!......................LF.b..<....... ........encrypter-win32.exe0...........;.T2. .(l!..iP.Y5/...'...&<\|...x(`a.....wA.....Y..p.....Qd.+..H.,..=.NY...!Y;`@.1....A..8.g.-..o".Fc._-...6}Su'mM9$..K0 ...V..<...;$....hk.....S#..<..O..vh.`Re..(...iY......

File Icon


Icon Hash:	90cececece8e8eb0

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: unarchiver.exePID: 7312, Parent PID: 2580

General

Target ID:	0
Start time:	07:16:14
Start date:	27/07/2024
Path:	C:\Windows\SysWOW64\unarchiver.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Desktop\encrypter-win32.rar"
Imagebase:	0x950000
File size:	12'800 bytes
MD5 hash:	16FF3CC6CC330A08EED70CBC1D35F5D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: 7za.exePID: 7336, Parent PID: 7312

General

Target ID:	1
Start time:	07:16:14
Start date:	27/07/2024
Path:	C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\tcbbx44c.cen" "C:\Users\user\Desktop\encrypter-win32.rar"
Imagebase:	0xf30000
File size:	289'792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 7344, Parent PID: 7336

General

Target ID:	2
Start time:	07:16:14
Start date:	27/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: unarchiver.exePID: 7312, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	21.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	73
Total number of Limit Nodes:	4

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0126B1D6 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 0126B208

Memory Dump Source

Source File: 00000000.00000002.4111097770.000000000126A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_126a000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 7875369d3e22888f7769db2ef79eaeea5b700127d9edf762442c81c6de991a0e
Instruction ID: 0c54854fe040f8d031b3effc9e6a635ab4897a4b6a13d5c7584846d354f55316
Opcode Fuzzy Hash: 7875369d3e22888f7769db2ef79eaeea5b700127d9edf762442c81c6de991a0e
Instruction Fuzzy Hash: 2601A271A102409FDB10CF15E885766FBE8DF15220F08C4AADD48CF656D279E444CBA1

Function 0126B246 Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 0126B2F3

Memory Dump Source

Source File: 00000000.00000002.4111097770.000000000126A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_126a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 56115b711e5231de6d8c36bb4f0c9b1f2215be8add12b7cb16b0ab88e9db5318
Instruction ID: 2a87705f5496eab6d76f6c3a91d1a462d7e7a2f95b444d03f3bf94e5456c5614
Opcode Fuzzy Hash: 56115b711e5231de6d8c36bb4f0c9b1f2215be8add12b7cb16b0ab88e9db5318
Instruction Fuzzy Hash: C631C671504344AFE7228B61DC44FA7BFFCEF05210F04889AE985CB552D324E909CB71

Function 0126AD04 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 0126ADA7

Memory Dump Source

Source File: 00000000.00000002.4111097770.000000000126A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_126a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3229cc884c597ff8a68f27419cf8d40c5eb991eb504b0af0ee203866cd11d285
Instruction ID: faddc8012085953dd8229eb71d4d78b738167e846389463fb073d1bbb656b680
Opcode Fuzzy Hash: 3229cc884c597ff8a68f27419cf8d40c5eb991eb504b0af0ee203866cd11d285
Instruction Fuzzy Hash: 2131C471504384AFEB228B65DC44FABBFFCEF06224F04889AF985DB552D224E549CB71

Function 0126AB76 Relevance: 1.6, APIs: 1, Instructions: 96
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreatePipe.KERNELBASE(?,00000E24,?,?), ref: 0126AC36

Memory Dump Source

Source File: 00000000.00000002.4111097770.000000000126A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_126a000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: bafae7e92986a15dea4153ff9686aee130a989802c33bf8cd68979c286266b1d
Instruction ID: 772e44c10af56696ce0da62a3b015af3c23e3b20b83746cc1d299e7005df52ae
Opcode Fuzzy Hash: bafae7e92986a15dea4153ff9686aee130a989802c33bf8cd68979c286266b1d
Instruction Fuzzy Hash: BD31AC7250E3C06FD3038B718C65A96BFB4AF47610F1A84DBD8C4CB5A3D269A919C772

Function 0126A5DC Relevance: 1.6, APIs: 1, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0126A67D

Memory Dump Source

Source File: 00000000.00000002.4111097770.000000000126A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_126a000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 67511cbfeefdca8ae08856826e195eb631ba9179c94afbf6c2013708dd000e88
Instruction ID: df35ef7d7b0ec18423754c827df5569f3a149bf170526c161701aa400a013b2a
Opcode Fuzzy Hash: 67511cbfeefdca8ae08856826e195eb631ba9179c94afbf6c2013708dd000e88
Instruction Fuzzy Hash: 1131C471505340AFE722CF25DC44F66BFE8EF45224F08889DE9859B652D375E809CB71

Function 0126A120 Relevance: 1.6, APIs: 1, Instructions: 82
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindNextFileW.KERNELBASE(?,00000E24,?,?), ref: 0126A1C2

Memory Dump Source

Source File: 00000000.00000002.4111097770.000000000126A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_126a000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: eb805c53b3929b7112a36940e9c31296bd751d5b4afb18a071515de239d94d55
Instruction ID: ff93c6618cbb814550fb840c3cf36078d7cbb391f8754f14f3213e2c8f1c3442
Opcode Fuzzy Hash: eb805c53b3929b7112a36940e9c31296bd751d5b4afb18a071515de239d94d55
Instruction Fuzzy Hash: 2921B07150D3C06FD3028B258C61BA6BFB4EF87610F0984CBD884CF693D225A91AC7B2

Function 0126AD2A Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 0126ADA7

Memory Dump Source

Source File: 00000000.00000002.4111097770.000000000126A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_126a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 18f33c63cafce884db015d7821640e05168ed533a479c0f4f931dec8aea1e2fb
Instruction ID: 47e6ccf3df5580dc2153237b47933c75d0a22199476ecdb1845d0ac1016dbb4d
Opcode Fuzzy Hash: 18f33c63cafce884db015d7821640e05168ed533a479c0f4f931dec8aea1e2fb
Instruction Fuzzy Hash: D421D372500204AFEB21CF55DC44FABFBECEF14224F04886AEA45DBA51D774E5498BB1

Function 0126B276 Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 0126B2F3

Memory Dump Source

Source File: 00000000.00000002.4111097770.000000000126A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_126a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1626a84dd33361afe178ee3c025b913507dfa68b88da41d0493e2436255edf64
Instruction ID: 365ec3c8cf38089adfd2e744ed32a34d1a7cd2537cc435c4455cad7f6d68e941
Opcode Fuzzy Hash: 1626a84dd33361afe178ee3c025b913507dfa68b88da41d0493e2436255edf64
Instruction Fuzzy Hash: 1A21C472600204AFEB218F55DC45FABBBECEF14214F04886AE945CBA51D774E5498BB1

Function 0126A370 Relevance: 1.6, APIs: 1, Instructions: 80
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,B4FAD00D,00000000,00000000,00000000,00000000), ref: 0126A40C

Memory Dump Source

Source File: 00000000.00000002.4111097770.000000000126A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_126a000_unarchiver.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 509f29c628ce9f684995984c486a311cdcb9173bb6d394e23da601c5cc0392c7
Instruction ID: d9be5479505b71e934f5b08769f73ffcd08dca44ee786dbb535df9875c1af915
Opcode Fuzzy Hash: 509f29c628ce9f684995984c486a311cdcb9173bb6d394e23da601c5cc0392c7
Instruction Fuzzy Hash: FF21AB71504340AFE722CF15DC84FA6BBFCEF05610F08849AEA85DB692D364E849CBB1

Function 0126A850 Relevance: 1.6, APIs: 1, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(?,00000E24,B4FAD00D,00000000,00000000,00000000,00000000), ref: 0126A8DE

Memory Dump Source

Source File: 00000000.00000002.4111097770.000000000126A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_126a000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: cd69efb42c23a2ef91b9584dfd1e828734f51cd99b5e24f32d696bd550023ae9
Instruction ID: 92c44ca7b4920cb7d8294e0aeb14cdd58bda2842c6b615f6a5ce23d5aa8ea389
Opcode Fuzzy Hash: cd69efb42c23a2ef91b9584dfd1e828734f51cd99b5e24f32d696bd550023ae9
Instruction Fuzzy Hash: 4421D6714093806FE7228B14DC44FA6BFB8EF46714F0884DAE984DF553C225A909C771

Function 0126A933 Relevance: 1.6, APIs: 1, Instructions: 77
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E24,B4FAD00D,00000000,00000000,00000000,00000000), ref: 0126A9C1

Memory Dump Source

Source File: 00000000.00000002.4111097770.000000000126A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_126a000_unarchiver.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 5861678475981bb535bfdd1c18aa51884fdb2987555fd98971e5f6cc228922bc
Instruction ID: e2a4ee5603a9e3a7897d0534c69c914d1d89d34ed9840747b20f7aeab594887a
Opcode Fuzzy Hash: 5861678475981bb535bfdd1c18aa51884fdb2987555fd98971e5f6cc228922bc
Instruction Fuzzy Hash: 7921B271409380AFDB22CF65DC44F96BFB8EF46214F0884DAE9849F552C275A549CBB1

Function 0126A5FE Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0126A67D

Memory Dump Source

Source File: 00000000.00000002.4111097770.000000000126A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_126a000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b9bbcf106f067d3a2203fc423ebdef9cedef3b69f30d88fee0305a3918c32583
Instruction ID: a8ed3e11898075f0c1ff3e6e216ebc93fb8234306ed491793c73cc73fed951b1
Opcode Fuzzy Hash: b9bbcf106f067d3a2203fc423ebdef9cedef3b69f30d88fee0305a3918c32583
Instruction Fuzzy Hash: 2921C171500200AFEB21CF25DD45F66FBE8EF18224F048869EA459B792D375E848CB71

Function 0126A78F Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,00000E24,B4FAD00D,00000000,00000000,00000000,00000000), ref: 0126A815

Memory Dump Source

Source File: 00000000.00000002.4111097770.000000000126A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_126a000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 2de1bc40f9e4aed67faf0678d7e92e7849c54f621144b1686f058cd9f11e6bb9
Instruction ID: c34543aa473a65b7161602c4aab5b555e7e4a5b111fe24b03250d266489d453d
Opcode Fuzzy Hash: 2de1bc40f9e4aed67faf0678d7e92e7849c54f621144b1686f058cd9f11e6bb9
Instruction Fuzzy Hash: 3F21D5B54093806FE7128B11DC44BA6BFBCEF57714F08C0DAE9848B693D264A90AC771

Function 0126AA0B Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 0126AA8B

Memory Dump Source

Source File: 00000000.00000002.4111097770.000000000126A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_126a000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: ec72f5d0251f7a065f7721c09fe7051820de12bdf3360bb03ebd3ddb322ec003
Instruction ID: 188dd3f278c0f46bd93c239c81d136faeec856d1413c1299e44e37acc64f5ca0
Opcode Fuzzy Hash: ec72f5d0251f7a065f7721c09fe7051820de12bdf3360bb03ebd3ddb322ec003
Instruction Fuzzy Hash: 9C21DE715083C09FEB12CB29DC55B96BFE8AF06314F0D84EAE984CB693D224D949CB61

Function 0126A392 Relevance: 1.6, APIs: 1, Instructions: 69
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,B4FAD00D,00000000,00000000,00000000,00000000), ref: 0126A40C

Memory Dump Source

Source File: 00000000.00000002.4111097770.000000000126A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_126a000_unarchiver.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: fc2b4a574aa29b7e74887fb777f93fa1f920bf7a064a73d2ae9c2d25e99027ad
Instruction ID: bf71878f42865cba1e0a0f3b2fff4697bc2f5274973fa11b4169ba94b34ec505
Opcode Fuzzy Hash: fc2b4a574aa29b7e74887fb777f93fa1f920bf7a064a73d2ae9c2d25e99027ad
Instruction Fuzzy Hash: F221CD71600204AFE721CF15DC84FA6FBECEF14610F08C45AEA45DB692D3A4E849CBB1

Function 0126A6D4 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0126A748

Memory Dump Source

Source File: 00000000.00000002.4111097770.000000000126A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_126a000_unarchiver.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 78fee3b4f7dfb7a4dd8fc8f8374ce9e57be8317da0ec755de26e4286c4eaf74e
Instruction ID: 7246b345405e9859047af7196999a300a249c4580b355133e26a097b756fd624
Opcode Fuzzy Hash: 78fee3b4f7dfb7a4dd8fc8f8374ce9e57be8317da0ec755de26e4286c4eaf74e
Instruction Fuzzy Hash: 7B21C6B59097C09FD7128B25DC54752BFB8EF07320F0984DBDC858B5A7D2649909C771

Function 0126A962 Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000E24,B4FAD00D,00000000,00000000,00000000,00000000), ref: 0126A9C1

Memory Dump Source

Source File: 00000000.00000002.4111097770.000000000126A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_126a000_unarchiver.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: dde6358c771515b36b60bdd6387aef07a600176e13b83fee2b02109ab3e5febc
Instruction ID: ecbe813b756ef63b8fd734fff551908fd359304505e155386bb44b4ae5fd0dfc
Opcode Fuzzy Hash: dde6358c771515b36b60bdd6387aef07a600176e13b83fee2b02109ab3e5febc
Instruction Fuzzy Hash: 7811E271501200AFEB21CF55DC44FAAFBE8EF14724F14C45AE9459B681C374E449CBB1

Function 0126A882 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000E24,B4FAD00D,00000000,00000000,00000000,00000000), ref: 0126A8DE

Memory Dump Source

Source File: 00000000.00000002.4111097770.000000000126A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_126a000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 6d4a4f3c29a2d27325849711d86a6a97d0516ea8783132381786f0c66bd3f76f
Instruction ID: 299f02ef2e1bfbbab9bf78e7bc7ccd7e495545ad9e8bd9af41c5b122e06d7792
Opcode Fuzzy Hash: 6d4a4f3c29a2d27325849711d86a6a97d0516ea8783132381786f0c66bd3f76f
Instruction Fuzzy Hash: 7B11E371500200AFEB21CF54DC84FAAFBECEF54724F14C85AE9459BA85C375E5498BB1

Function 0126A2AE Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0126A30C

Memory Dump Source

Source File: 00000000.00000002.4111097770.000000000126A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_126a000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: be3143fa0ce9ef369f45d8e36c5c1130468234cf64f3ff29406130221cc8b43f
Instruction ID: 47d0aff2568ef994e5f85ae000fe21cf836ecbe7ecda9fb6f5ccf3b523cd167b
Opcode Fuzzy Hash: be3143fa0ce9ef369f45d8e36c5c1130468234cf64f3ff29406130221cc8b43f
Instruction Fuzzy Hash: F411A3758093C09FD7238B25DC54A52BFB4EF47224F0980DBDD848F5A3D265A849CB72

Function 0126B1B4 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 0126B208

Memory Dump Source

Source File: 00000000.00000002.4111097770.000000000126A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_126a000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: f35a4ef570701c5d8d41966f9fa65d8e129fea1a0321d640ba38e73174d1e060
Instruction ID: eba7f9c2edbadc6bdcff1eb94ac7c3812c3aced3de7a3565e12527c6615135fd
Opcode Fuzzy Hash: f35a4ef570701c5d8d41966f9fa65d8e129fea1a0321d640ba38e73174d1e060
Instruction Fuzzy Hash: AF1170715093809FDB128F15DC44B56BFB4EF46220F0884DAED848F657D275A948CB72

Function 0126AF8B Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 0126AFE4

Memory Dump Source

Source File: 00000000.00000002.4111097770.000000000126A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_126a000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: cfb4a9f9a8d57c3c60a5a42ece363c95ab6c21aa8de725b94e3d47b20d53239c
Instruction ID: 291362073915e5c76e8ba4bc8ac830e6d73c8f1b20772df6ed394143d51574cc
Opcode Fuzzy Hash: cfb4a9f9a8d57c3c60a5a42ece363c95ab6c21aa8de725b94e3d47b20d53239c
Instruction Fuzzy Hash: AB11A0715093C09FD7128B25DC45B52BFF8EF06220F0984DAED858B6A3D274A848CB61

Function 0126AA46 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 0126AA8B

Memory Dump Source

Source File: 00000000.00000002.4111097770.000000000126A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_126a000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 4c824b5635f815022f8b39a05b62a83b0778cc665833bbf986b68d2456e76a44
Instruction ID: 6e390feb61fb1d51932a076f5442c84ae7e5595a5c13cb8ec0ac9cbdf985e257
Opcode Fuzzy Hash: 4c824b5635f815022f8b39a05b62a83b0778cc665833bbf986b68d2456e76a44
Instruction Fuzzy Hash: 5311A1716102419FEB10CF19D985B6AFBECEF04220F08C4AADE09DB686E274E944CB61

Function 0126A7C2 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,B4FAD00D,00000000,00000000,00000000,00000000), ref: 0126A815

Memory Dump Source

Source File: 00000000.00000002.4111097770.000000000126A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_126a000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: ec7a7e088267f28b893a7b731365c7e64c6d3ba12d6973abcffc13d7b201bde5
Instruction ID: 43082b92b2575b698c849b87f0ac23624e7ae659c8ceed4131dfe1314ad4e92f
Opcode Fuzzy Hash: ec7a7e088267f28b893a7b731365c7e64c6d3ba12d6973abcffc13d7b201bde5
Instruction Fuzzy Hash: 4F01D271510204AFE721CB05DC85FAAFBECDF65724F04C096EE059B782D378E8498AB5

Function 0126ABE6 Relevance: 1.5, APIs: 1, Instructions: 47pipeCOMMON

Download Yara Rule

APIs

CreatePipe.KERNELBASE(?,00000E24,?,?), ref: 0126AC36

Memory Dump Source

Source File: 00000000.00000002.4111097770.000000000126A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_126a000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: eb78c53c240febc718b591860c74d4e21e7aa2abd824c54d9f826b9d856d90d3
Instruction ID: 7c675c45104d6f3f4f1dbd89ff32945f86602703ea6367ba74b60111d2529523
Opcode Fuzzy Hash: eb78c53c240febc718b591860c74d4e21e7aa2abd824c54d9f826b9d856d90d3
Instruction Fuzzy Hash: A9017171600200ABD310DF16DC46B66FBE8FB88A20F14855AED489BB45D735F916CBE5

Function 0126A172 Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,00000E24,?,?), ref: 0126A1C2

Memory Dump Source

Source File: 00000000.00000002.4111097770.000000000126A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_126a000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: c613b89969d9b00c86b1dce85370e2e41ede3c58128f530b8b13efa4a31a0679
Instruction ID: 0220c0bc980eb991f1e47ca147869a775240e214c0c1c1f151baba3a69024ebe
Opcode Fuzzy Hash: c613b89969d9b00c86b1dce85370e2e41ede3c58128f530b8b13efa4a31a0679
Instruction Fuzzy Hash: D8017171600200ABD310DF16DC46B66FBE8EB88A20F14855AED089BB45D735F916CBE5

Function 0126A716 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0126A748

Memory Dump Source

Source File: 00000000.00000002.4111097770.000000000126A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_126a000_unarchiver.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 3da295724a750fc36a5d28154f45aec8ed79526bf590f9db4f1d75006b59f6d4
Instruction ID: 78979f3cd14103e90e3102886a7f062172860620e207dace5125649dc25ae2b1
Opcode Fuzzy Hash: 3da295724a750fc36a5d28154f45aec8ed79526bf590f9db4f1d75006b59f6d4
Instruction Fuzzy Hash: A401F271A102408FDB11CF19D88576AFBE8DF04220F08C4AADD0ADFB86D278E448CEB1

Function 0126AFB2 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 0126AFE4

Memory Dump Source

Source File: 00000000.00000002.4111097770.000000000126A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_126a000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 0d520f31d5c56a441ebb6f708df75f77a37cb69628cb08348cf3f25d08f8d089
Instruction ID: ec8250eb5b3381137ce313a09e4a48e51fc9dd84ee16ccc7eecf71583c6bc11b
Opcode Fuzzy Hash: 0d520f31d5c56a441ebb6f708df75f77a37cb69628cb08348cf3f25d08f8d089
Instruction Fuzzy Hash: CD01F9756102449FDB108F15D885762FFE8EF05220F08C09ADD058B792D275E448CEA2

Function 0126A2DA Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0126A30C

Memory Dump Source

Source File: 00000000.00000002.4111097770.000000000126A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_126a000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 6f995344a4785425b2529607bb5b26c3610a166b37acc84c782e28126c589e61
Instruction ID: 4cfafdc69f525a80a6e642089caf9acfc70b2d5f0c9cef9b15b988057f4c8a4e
Opcode Fuzzy Hash: 6f995344a4785425b2529607bb5b26c3610a166b37acc84c782e28126c589e61
Instruction Fuzzy Hash: 08F0A435914244DFDB208F05D885761FBE4DF15624F08C09ADD095F796D3B9E458CEA2

Function 013702C0 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4111247649.0000000001370000.00000040.00000800.00020000.00000000.sdmp, Offset: 01370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1370000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87a5ae9ca66a84ccfdf85fa0d0ba9a743893f003a1f25b88dd42d5464e1e1285
Instruction ID: 8130122ac516491a7cd0025d26a5e568ec2ab9740c80a079c0975e8079551fc9
Opcode Fuzzy Hash: 87a5ae9ca66a84ccfdf85fa0d0ba9a743893f003a1f25b88dd42d5464e1e1285
Instruction Fuzzy Hash: A0B13234701214CFC739DFA4EA98A5A77B2FF89254B608078EA06A7395DB3E9C41CB51

Function 01370799 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4111247649.0000000001370000.00000040.00000800.00020000.00000000.sdmp, Offset: 01370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1370000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb133f62c93390edef7e1bb54e10196f2673cd0eb38a0811b44e56db068c76fd
Instruction ID: 4189bdfcd3b717b9b602837879b5c19a050abe3133bda5f7f37aa661767b0b02
Opcode Fuzzy Hash: eb133f62c93390edef7e1bb54e10196f2673cd0eb38a0811b44e56db068c76fd
Instruction Fuzzy Hash: 91A19A30B002058BDB29AFB4D555B7E77A2FBE8308F208429E906A77D4DB7D9C42CB51

Function 01370C99 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4111247649.0000000001370000.00000040.00000800.00020000.00000000.sdmp, Offset: 01370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1370000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bc6e67f75824153e8b566189a335a6ce0febef689eac062be169864cb3ede0c
Instruction ID: 406c93aecace1f14c97cbc08a421d5ad7177ac2a81b46956e3bb0dd0b361a012
Opcode Fuzzy Hash: 0bc6e67f75824153e8b566189a335a6ce0febef689eac062be169864cb3ede0c
Instruction Fuzzy Hash: 12213230B002558FC715EB7988426BF7ADBEBD9248B44843CD546EB791DB3EED028786

Function 01370CA8 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4111247649.0000000001370000.00000040.00000800.00020000.00000000.sdmp, Offset: 01370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1370000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8deee58d90f1ecb5b88348d1441effde8c1891007a553a95738bb4c0dbe6dfb7
Instruction ID: 10400d1829a6b77b393b13c2f516a31e45dbb79c5e1484753c2f3d6abd50227b
Opcode Fuzzy Hash: 8deee58d90f1ecb5b88348d1441effde8c1891007a553a95738bb4c0dbe6dfb7
Instruction Fuzzy Hash: F82132307006058BC715EB7A84416AFB7DBAFE9208B40883CD186EB780DF3DE9028796

Function 01370B8F Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4111247649.0000000001370000.00000040.00000800.00020000.00000000.sdmp, Offset: 01370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1370000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0da2cd6a8c3ed2a8bed1f2a19e98bb309aa5a40d6332a4990363f6118c54076c
Instruction ID: 6e0c4714ebd86903d2ad5690a073ac135f993dabb7878850b5936c93549f204d
Opcode Fuzzy Hash: 0da2cd6a8c3ed2a8bed1f2a19e98bb309aa5a40d6332a4990363f6118c54076c
Instruction Fuzzy Hash: F311B136A10219AFCB549FB4D841CEE7BF6EBC8314B144179E505E7270DB39AC1A8B81

Function 01370BA0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4111247649.0000000001370000.00000040.00000800.00020000.00000000.sdmp, Offset: 01370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1370000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5915458ab5e7f6d0d9d8edf64e788e5b641cf524b70f53444622b0079fd740ee
Instruction ID: 67761f634715b826357ac19dabc4c86085970703dff6b5dc8a40b51b7dc1dae0
Opcode Fuzzy Hash: 5915458ab5e7f6d0d9d8edf64e788e5b641cf524b70f53444622b0079fd740ee
Instruction Fuzzy Hash: FF118F32A10119AFCB549BB4D845D9E7BF6EBC8214B154479E205E7270EB39AC098780

Function 014305E1 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4111282849.0000000001430000.00000040.00000020.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1430000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc50b34e9d43a6e679ad095e81056415ac0f739b92747e5eaffc30e79c44719e
Instruction ID: 6c253b790b955b56c7f168d312d0024deb5e711ca7fedb10d87e9cde5ff6e132
Opcode Fuzzy Hash: fc50b34e9d43a6e679ad095e81056415ac0f739b92747e5eaffc30e79c44719e
Instruction Fuzzy Hash: 5C01AEB65093846FD712CB15AC40863FFB8DF96630709C49FEC498B652D125A909CB75

Function 01430810 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4111282849.0000000001430000.00000040.00000020.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1430000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7883e8d7fb7c71c98c2254e303093548a4fb2c72bc22eabeea4a21eda0554474
Instruction ID: 77c1d6df2ba82b8dd12cb2463082c39cfce39bfd736440ed886011b43aa49d91
Opcode Fuzzy Hash: 7883e8d7fb7c71c98c2254e303093548a4fb2c72bc22eabeea4a21eda0554474
Instruction Fuzzy Hash: 0E01A2B2409244AFD300CB05EC41C57BBFCDF86524F09C86AEC488B601D225B9198BF2

Function 0143082E Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4111282849.0000000001430000.00000040.00000020.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1430000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d6e522f741bfaee0871bc40ad284d03b62aa5225795d3471aaab2ffac9c2b66
Instruction ID: 039b2ab7c84ee8e7795c9cab34a78c54f5bfd2f7356a49b5bbb161907595139c
Opcode Fuzzy Hash: 6d6e522f741bfaee0871bc40ad284d03b62aa5225795d3471aaab2ffac9c2b66
Instruction Fuzzy Hash: C2F082B2815204AB9240DF05ED46896F7ECDF84521F04C52AEC088B704E276A9194AF2

Function 01370C50 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4111247649.0000000001370000.00000040.00000800.00020000.00000000.sdmp, Offset: 01370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1370000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1fc8d4f26f5b1e274d7d96f553f1c425b00d38056480c9375f3d5d865b01369
Instruction ID: ca044fe754bd73863fdc3c98f8d84b2ba14814c64a7731c1d89adc914e442eab
Opcode Fuzzy Hash: e1fc8d4f26f5b1e274d7d96f553f1c425b00d38056480c9375f3d5d865b01369
Instruction Fuzzy Hash: CBE0DF32F153242FCB04DAB98842ADE7FE5EF85260B0444BAC008D73A0EB3988028380

Function 01430606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4111282849.0000000001430000.00000040.00000020.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1430000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f58b902bd5d8e889f934a559dfd0a99b4047c9f1eadddbecbd13b2386ea9353
Instruction ID: e90d8c2feeee871855b1ea95415b6955471a2c41c49ecfc7ecfe04357baa1443
Opcode Fuzzy Hash: 6f58b902bd5d8e889f934a559dfd0a99b4047c9f1eadddbecbd13b2386ea9353
Instruction Fuzzy Hash: 35E06DB66016049B9750CF0AFC41452F7E8EB88630B08C06BDC0D8BB11D235B5098AA5

Function 01370C60 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4111247649.0000000001370000.00000040.00000800.00020000.00000000.sdmp, Offset: 01370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1370000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 405b8c0b949740dba883e145cc77221a11c6d4251801c438ef6820d23ac7bb83
Instruction ID: cf03979a05cb61e12f05fc64011083a6dc52b34790fe26d3041724c3c67b2332
Opcode Fuzzy Hash: 405b8c0b949740dba883e145cc77221a11c6d4251801c438ef6820d23ac7bb83
Instruction Fuzzy Hash: 77D01232F012282B8B44DAB9584299F7BEA9B84154B5444799009D7350FF39990187D0

Function 01370E08 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4111247649.0000000001370000.00000040.00000800.00020000.00000000.sdmp, Offset: 01370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1370000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f07911fb488be1d35fd9a39508a2b7bad3b846fe35bec279ce0a1c7a013712d
Instruction ID: 83e8b3f1ddce8bc69e0f7cfd2ca95d505995e1ce2a294e58e11b1f53ddb87d3d
Opcode Fuzzy Hash: 2f07911fb488be1d35fd9a39508a2b7bad3b846fe35bec279ce0a1c7a013712d
Instruction Fuzzy Hash: 9CE02B312503018FC7099BB8E5479E47BE0ABC6318F15C0A598045F173D33CDC42C742

Function 01370DD1 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4111247649.0000000001370000.00000040.00000800.00020000.00000000.sdmp, Offset: 01370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1370000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b605f32308aea00596b95c0e95ed2658a34207dcadbddec475db095050c116c8
Instruction ID: 485feb6d987ed315aa2065ea15b49ad44391b06be78c7646c62320b1dea122b0
Opcode Fuzzy Hash: b605f32308aea00596b95c0e95ed2658a34207dcadbddec475db095050c116c8
Instruction Fuzzy Hash: 3FE0C2306443028FC7199B78C4169B57BE1ABD2318F95C0B99408DB1A2C73CCC81C740

Function 012623F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4111086272.0000000001262000.00000040.00000800.00020000.00000000.sdmp, Offset: 01262000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1262000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79f34b1f6a5e3b236ddf0d53048e8cf04a754e9306d1e41d2c35b6dc0ec0cfe9
Instruction ID: 499ee43ad248e4cb87670941afdf30be94eaeec34a2fa0cd792955782b2cd7f9
Opcode Fuzzy Hash: 79f34b1f6a5e3b236ddf0d53048e8cf04a754e9306d1e41d2c35b6dc0ec0cfe9
Instruction Fuzzy Hash: 2DD02B752006D18FE3128A0CC158B953BE8AF51704F0600F998008B7A3C728D5C0C100

Function 012623BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4111086272.0000000001262000.00000040.00000800.00020000.00000000.sdmp, Offset: 01262000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1262000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 313bffa338c99146fef6960a2f41c87f89f278d6fbaad391cddde7f9ed2ed5f1
Instruction ID: 521016648c609fc57bc025d57b3cf2fff1d4dedf32ec3c285a1d4300ad1e5cfe
Opcode Fuzzy Hash: 313bffa338c99146fef6960a2f41c87f89f278d6fbaad391cddde7f9ed2ed5f1
Instruction Fuzzy Hash: 0ED05E342002828BD715DB0CC6D4F597BD8AB50B14F0644E9BD108B7A2C7B4D8D0CA40

Function 01370E18 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4111247649.0000000001370000.00000040.00000800.00020000.00000000.sdmp, Offset: 01370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1370000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1e6aed29112dcd4276e09b0e1d91324b939be39ee5a0b6bc8e9788792f94e65
Instruction ID: 3536b57fd98a79676da0429288e2d7bc6e7c38e51f06cb9cc5ef8500f05e0a0a
Opcode Fuzzy Hash: b1e6aed29112dcd4276e09b0e1d91324b939be39ee5a0b6bc8e9788792f94e65
Instruction Fuzzy Hash: 55C012313002048BD718ABBCD559E29BB9557D9208F84C064A5086B2A1CB7CEC40C640

Function 01370DE0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4111247649.0000000001370000.00000040.00000800.00020000.00000000.sdmp, Offset: 01370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1370000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 318d3ec730634b566e6940bd15b185d25d205733cdde74bf7cd61a5db1784a9d
Instruction ID: 1f4fce573d6ed83a187ed59e8fbe1c5a38d832cb80d6404a1f2024ada8a920a2
Opcode Fuzzy Hash: 318d3ec730634b566e6940bd15b185d25d205733cdde74bf7cd61a5db1784a9d
Instruction Fuzzy Hash: 2DC012303002088BD718ABBCD559E35779657D0208F95C064A5085B2A1CB7CEC40C680

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ( Security Software Discovery ) to evade.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report encrypter-win32.rar

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\unarchiver.log

Static File Info

General

File Icon

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: unarchiver.exePID: 7312, Parent PID: 2580

General

Chronological Activities

Analysis Process: 7za.exePID: 7336, Parent PID: 7312

General

Chronological Activities

Analysis Process: conhost.exePID: 7344, Parent PID: 7336

General

Chronological Activities

Disassembly

Analysis Process: unarchiver.exePID: 7312, Parent PID: 2580COMMON

Execution Graph

Graph

Callgraph

Executed Functions

Function 0126B1D6 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Function 0126B246 Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Windows Analysis Report
encrypter-win32.rar

Function 0126B246 Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Function 0126AD04 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 0126AB76 Relevance: 1.6, APIs: 1, Instructions: 96
pipeCOMMON

Function 0126A5DC Relevance: 1.6, APIs: 1, Instructions: 90
fileCOMMON

Function 0126A120 Relevance: 1.6, APIs: 1, Instructions: 82
fileCOMMON

Function 0126AD2A Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Function 0126B276 Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Function 0126A370 Relevance: 1.6, APIs: 1, Instructions: 80
registryCOMMON

Function 0126A850 Relevance: 1.6, APIs: 1, Instructions: 78
COMMON

Function 0126A933 Relevance: 1.6, APIs: 1, Instructions: 77
fileCOMMON

Function 0126A5FE Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Function 0126A78F Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Function 0126AA0B Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Function 0126A392 Relevance: 1.6, APIs: 1, Instructions: 69
registryCOMMON

Function 0126A6D4 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON