Windows Analysis Report
jv4ri.exe

AI detected suspicious sample

Source: Yara match	File source: 12.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.name.exe.36c0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.name.exe.3f80000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.name.exe.36b0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.name.exe.36b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.name.exe.36c0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.name.exe.3f80000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2348733537.000000000522F000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2347910354.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2348427875.0000000003400000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2055858818.00000000036B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2348445947.0000000003412000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2181376722.0000000003000000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2181096608.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2040296471.0000000003F80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2182098787.00000000036C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: name.exe PID: 6176, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: name.exe PID: 6364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 3712, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: name.exe PID: 4160, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6548, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\directory\name.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: jv4ri.exe

Joe Sandbox ML: detected

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_004338C8 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,		5_2_004338C8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_004338C8 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,		12_2_004338C8

Source: name.exe, 00000002.00000002.2040296471.0000000003F80000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_ef034609-8

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 12.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.name.exe.36c0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.name.exe.3f80000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.name.exe.36b0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.name.exe.36b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.name.exe.36c0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.name.exe.3f80000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2347910354.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2055858818.00000000036B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2181096608.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2040296471.0000000003F80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2182098787.00000000036C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: name.exe PID: 6176, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: name.exe PID: 6364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 3712, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: name.exe PID: 4160, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6548, type: MEMORYSTR

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_00407538 _wcslen,CoGetObject,		5_2_00407538
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_00407538 _wcslen,CoGetObject,		12_2_00407538

Source: jv4ri.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: wntdll.pdbUGP source: name.exe, 00000002.00000003.2039035690.0000000004000000.00000004.00001000.00020000.00000000.sdmp, name.exe, 00000002.00000003.2039157753.00000000041A0000.00000004.00001000.00020000.00000000.sdmp, name.exe, 00000004.00000003.2052777335.00000000038D0000.00000004.00001000.00020000.00000000.sdmp, name.exe, 00000004.00000003.2053042365.0000000003730000.00000004.00001000.00020000.00000000.sdmp, name.exe, 0000000B.00000003.2179689028.0000000003740000.00000004.00001000.00020000.00000000.sdmp, name.exe, 0000000B.00000003.2180712436.0000000003970000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: name.exe, 00000002.00000003.2039035690.0000000004000000.00000004.00001000.00020000.00000000.sdmp, name.exe, 00000002.00000003.2039157753.00000000041A0000.00000004.00001000.00020000.00000000.sdmp, name.exe, 00000004.00000003.2052777335.00000000038D0000.00000004.00001000.00020000.00000000.sdmp, name.exe, 00000004.00000003.2053042365.0000000003730000.00000004.00001000.00020000.00000000.sdmp, name.exe, 0000000B.00000003.2179689028.0000000003740000.00000004.00001000.00020000.00000000.sdmp, name.exe, 0000000B.00000003.2180712436.0000000003970000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CD4696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00CD4696
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CDC9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00CDC9C7
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CDC93C FindFirstFileW,FindClose,	0_2_00CDC93C
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CDF200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00CDF200
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CDF35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00CDF35D
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CDF65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00CDF65E
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CD3A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00CD3A2B
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CD3D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00CD3D4E
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CDBF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00CDBF27
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_00084696 GetFileAttributesW,FindFirstFileW,FindClose,	2_2_00084696
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_0008C93C FindFirstFileW,FindClose,	2_2_0008C93C
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_0008C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	2_2_0008C9C7
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_0008F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_0008F200
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_0008F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_0008F35D
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_0008F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	2_2_0008F65E
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_00083A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	2_2_00083A2B
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_00083D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	2_2_00083D4E
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_0008BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	2_2_0008BF27
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	5_2_0040C388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	5_2_0040928E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	5_2_0041C322
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	5_2_004096A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	5_2_00408847
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_00407877 FindFirstFileW,FindNextFileW,	5_2_00407877
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0044E8F9 FindFirstFileExA,	5_2_0044E8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	5_2_0040BB6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	5_2_00419B86
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	5_2_0040BD72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	12_2_0040928E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	12_2_0041C322
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	12_2_0040C388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	12_2_004096A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	12_2_00408847
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_00407877 FindFirstFileW,FindNextFileW,	12_2_00407877
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_0044E8F9 FindFirstFileExA,	12_2_0044E8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	12_2_0040BB6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	12_2_00419B86
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	12_2_0040BD72

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 5_2_00407CD2 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

5_2_00407CD2

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49704 -> 45.95.169.104:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49721 -> 45.95.169.104:2404
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49722 -> 45.95.169.104:2404

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe

Network Connect: 45.95.169.104 2404

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 5.95.169.104

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 45.95.169.104:2404

Source: Joe Sandbox View

ASN Name: GIGANET-HUGigaNetInternetServiceProviderCoHU GIGANET-HUGigaNetInternetServiceProviderCoHU

Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.104
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.104
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.104
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.104
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.104
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.104
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.104
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.104
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.104
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.104
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.104
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.104
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.104
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.104
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.104
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.104
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.104
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.104
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.104
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.104
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.104

Source: C:\Users\user\Desktop\jv4ri.exe

Code function: 0_2_00CE25E2 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00CE25E2

Source: svchost.exe	String found in binary or memory: http://geoplugin.net/json.gp
Source: name.exe, 00000002.00000002.2040296471.0000000003F80000.00000004.00001000.00020000.00000000.sdmp, name.exe, 00000004.00000002.2055858818.00000000036B0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2347910354.0000000000400000.00000040.80000000.00040000.00000000.sdmp, name.exe, 0000000B.00000002.2182098787.00000000036C0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.2181096608.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: Amcache.hve.8.dr	String found in binary or memory: http://upx.sf.net

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 5_2_0040A2F3 SetWindowsHookExA 0000000D,0040A2DF,00000000

5_2_0040A2F3

Installs a global keyboard hook

Source: C:\Windows\SysWOW64\svchost.exe

Windows user hook set: 0 keyboard low level C:\Windows\SysWOW64\svchost.exe

Source: C:\Users\user\Desktop\jv4ri.exe

Code function: 0_2_00CE425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalFix,CloseClipboard,GlobalUnWire,IsClipboardFormatAvailable,GetClipboardData,GlobalFix,GlobalUnWire,IsClipboardFormatAvailable,GetClipboardData,GlobalFix,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnWire,CountClipboardFormats,CloseClipboard,

0_2_00CE425A

Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CE4458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalFix,_wcscpy,GlobalUnWire,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	0_2_00CE4458
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_00094458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalFix,_wcscpy,GlobalUnWire,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	2_2_00094458
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_004168FC OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	5_2_004168FC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_004168FC OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	12_2_004168FC

Source: C:\Users\user\Desktop\jv4ri.exe

0_2_00CE425A

Source: C:\Users\user\Desktop\jv4ri.exe

Code function: 0_2_00CD0219 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00CD0219

Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CFCDAC NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		0_2_00CFCDAC
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_000ACDAC NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		2_2_000ACDAC

Source: Yara match	File source: 12.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.name.exe.36c0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.name.exe.3f80000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.name.exe.36b0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.name.exe.36b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.name.exe.36c0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.name.exe.3f80000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2347910354.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2055858818.00000000036B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2181096608.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2040296471.0000000003F80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2182098787.00000000036C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: name.exe PID: 6176, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: name.exe PID: 6364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 3712, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: name.exe PID: 4160, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6548, type: MEMORYSTR

E-Banking Fraud

Contains functionalty to change the wallpaper

Source: Yara match	File source: 12.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.name.exe.36c0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.name.exe.3f80000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.name.exe.36b0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.name.exe.36b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.name.exe.36c0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.name.exe.3f80000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2348733537.000000000522F000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2347910354.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2348427875.0000000003400000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2055858818.00000000036B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2348445947.0000000003412000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2181376722.0000000003000000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2181096608.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2040296471.0000000003F80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2182098787.00000000036C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: name.exe PID: 6176, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: name.exe PID: 6364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 3712, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: name.exe PID: 4160, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6548, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0041CA73 SystemParametersInfoW,		5_2_0041CA73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_0041CA73 SystemParametersInfoW,		12_2_0041CA73

System Summary

Malicious sample detected (through community Yara rule)

Source: 12.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 12.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 12.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 11.2.name.exe.36c0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 11.2.name.exe.36c0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 11.2.name.exe.36c0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.name.exe.3f80000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 2.2.name.exe.3f80000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 2.2.name.exe.3f80000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 4.2.name.exe.36b0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 4.2.name.exe.36b0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 4.2.name.exe.36b0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 12.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 12.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 12.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 5.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 5.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 5.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 4.2.name.exe.36b0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 4.2.name.exe.36b0000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 4.2.name.exe.36b0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 11.2.name.exe.36c0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 11.2.name.exe.36c0000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 11.2.name.exe.36c0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 5.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 5.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 5.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.name.exe.3f80000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 2.2.name.exe.3f80000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 2.2.name.exe.3f80000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000005.00000002.2347910354.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000005.00000002.2347910354.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000005.00000002.2347910354.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000004.00000002.2055858818.00000000036B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000004.00000002.2055858818.00000000036B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000004.00000002.2055858818.00000000036B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000000C.00000002.2181096608.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000C.00000002.2181096608.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0000000C.00000002.2181096608.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000002.00000002.2040296471.0000000003F80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000002.00000002.2040296471.0000000003F80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000002.00000002.2040296471.0000000003F80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000000B.00000002.2182098787.00000000036C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000B.00000002.2182098787.00000000036C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0000000B.00000002.2182098787.00000000036C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: Process Memory Space: name.exe PID: 6176, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: name.exe PID: 6364, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: svchost.exe PID: 3712, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: name.exe PID: 4160, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: svchost.exe PID: 6548, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\jv4ri.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00C73B4C
Source: jv4ri.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: jv4ri.exe, 00000000.00000002.2026886010.0000000000D25000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_c0dda5a9-9
Source: jv4ri.exe, 00000000.00000002.2026886010.0000000000D25000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_d83c89d0-f
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: This is a third-party compiled AutoIt script.	2_2_00023B4C
Source: name.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: name.exe, 00000002.00000002.2039583863.00000000000D5000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_fa566f94-4
Source: name.exe, 00000002.00000002.2039583863.00000000000D5000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_86ebd91a-8
Source: name.exe, 00000004.00000002.2054778566.00000000000D5000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_303ad09c-e
Source: name.exe, 00000004.00000002.2054778566.00000000000D5000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_5c8f98c1-1
Source: name.exe, 0000000B.00000002.2181378905.00000000000D5000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_95c98581-9
Source: name.exe, 0000000B.00000002.2181378905.00000000000D5000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_ebf983c2-8

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C73633 NtdllDefWindowProc_W,KillTimer,SetTimer,RegisterClipboardFormatW,CreatePopupMenu,PostQuitMessage,SetFocus,MoveWindow,	0_2_00C73633
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CFC27C ReleaseCapture,SetWindowTextW,SendMessageW,NtdllDialogWndProc_W,	0_2_00CFC27C
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CFC220 NtdllDialogWndProc_W,	0_2_00CFC220
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CFC49C PostMessageW,GetFocus,GetDlgCtrlID,_memset,GetMenuItemInfoW,GetMenuItemCount,GetMenuItemID,GetMenuItemInfoW,GetMenuItemInfoW,CheckMenuRadioItem,NtdllDialogWndProc_W,	0_2_00CFC49C
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CFC788 GetCursorPos,TrackPopupMenuEx,GetCursorPos,NtdllDialogWndProc_W,	0_2_00CFC788
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CFC8EE DragQueryPoint,SendMessageW,DragQueryFileW,DragQueryFileW,_wcscat,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,NtdllDialogWndProc_W,	0_2_00CFC8EE
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CFC86D SendMessageW,NtdllDialogWndProc_W,	0_2_00CFC86D
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CFCBF9 NtdllDialogWndProc_W,	0_2_00CFCBF9
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CFCBAE NtdllDialogWndProc_W,	0_2_00CFCBAE
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CFCB50 NtdllDialogWndProc_W,	0_2_00CFCB50
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CFCB7F NtdllDialogWndProc_W,	0_2_00CFCB7F
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CFCC2E ClientToScreen,NtdllDialogWndProc_W,	0_2_00CFCC2E
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CFCDAC NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,	0_2_00CFCDAC
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CFCD6C GetWindowLongW,NtdllDialogWndProc_W,	0_2_00CFCD6C
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C71287 NtdllDialogWndProc_W,GetSysColor,SetBkColor,745AC8D0,NtdllDialogWndProc_W,	0_2_00C71287
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C71290 NtdllDialogWndProc_W,GetClientRect,GetCursorPos,ScreenToClient,	0_2_00C71290
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CFD6C6 NtdllDialogWndProc_W,	0_2_00CFD6C6
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C716DE GetParent,NtdllDialogWndProc_W,	0_2_00C716DE
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C716B5 NtdllDialogWndProc_W,	0_2_00C716B5
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C7167D NtdllDialogWndProc_W,	0_2_00C7167D
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CFD74C GetSystemMetrics,GetSystemMetrics,MoveWindow,SendMessageW,SendMessageW,ShowWindow,InvalidateRect,NtdllDialogWndProc_W,	0_2_00CFD74C
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C7189B NtdllDialogWndProc_W,	0_2_00C7189B
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CFDA9A NtdllDialogWndProc_W,	0_2_00CFDA9A
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CFBF4D NtdllDialogWndProc_W,CallWindowProcW,	0_2_00CFBF4D
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_00023633 NtdllDefWindowProc_W,KillTimer,SetTimer,RegisterClipboardFormatW,CreatePopupMenu,PostQuitMessage,SetFocus,MoveWindow,	2_2_00023633
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_000AC220 NtdllDialogWndProc_W,	2_2_000AC220
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_000AC27C ReleaseCapture,SetWindowTextW,SendMessageW,NtdllDialogWndProc_W,	2_2_000AC27C
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_000AC49C PostMessageW,GetFocus,GetDlgCtrlID,_memset,GetMenuItemInfoW,GetMenuItemCount,GetMenuItemID,GetMenuItemInfoW,GetMenuItemInfoW,CheckMenuRadioItem,NtdllDialogWndProc_W,	2_2_000AC49C
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_000AC788 GetCursorPos,TrackPopupMenuEx,GetCursorPos,NtdllDialogWndProc_W,	2_2_000AC788
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_000AC86D SendMessageW,NtdllDialogWndProc_W,	2_2_000AC86D
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_000AC8EE DragQueryPoint,SendMessageW,DragQueryFileW,DragQueryFileW,_wcscat,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,NtdllDialogWndProc_W,	2_2_000AC8EE
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_000ACB50 NtdllDialogWndProc_W,	2_2_000ACB50
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_000ACB7F NtdllDialogWndProc_W,	2_2_000ACB7F
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_000ACBAE NtdllDialogWndProc_W,	2_2_000ACBAE
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_000ACBF9 NtdllDialogWndProc_W,	2_2_000ACBF9
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_000ACC2E ClientToScreen,NtdllDialogWndProc_W,	2_2_000ACC2E
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_000ACD6C GetWindowLongW,NtdllDialogWndProc_W,	2_2_000ACD6C
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_000ACDAC NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,	2_2_000ACDAC
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_00021287 NtdllDialogWndProc_W,GetSysColor,SetBkColor,745AC8D0,NtdllDialogWndProc_W,	2_2_00021287
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_00021290 NtdllDialogWndProc_W,GetClientRect,GetCursorPos,ScreenToClient,	2_2_00021290
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_0002167D NtdllDialogWndProc_W,	2_2_0002167D
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_000216B5 NtdllDialogWndProc_W,	2_2_000216B5
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_000AD6C6 NtdllDialogWndProc_W,	2_2_000AD6C6
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_000216DE GetParent,NtdllDialogWndProc_W,	2_2_000216DE
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_000AD74C GetSystemMetrics,GetSystemMetrics,MoveWindow,SendMessageW,SendMessageW,ShowWindow,InvalidateRect,NtdllDialogWndProc_W,	2_2_000AD74C
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_0002189B NtdllDialogWndProc_W,	2_2_0002189B
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_000ADA9A NtdllDialogWndProc_W,	2_2_000ADA9A
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_000ABF4D NtdllDialogWndProc_W,CallWindowProcW,	2_2_000ABF4D

Source: C:\Users\user\Desktop\jv4ri.exe

Code function: 0_2_00CD40B1: CreateFileW,_memset,DeviceIoControl,CloseHandle,

0_2_00CD40B1

Source: C:\Users\user\Desktop\jv4ri.exe

Code function: 0_2_00CC8858 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,74765590,CreateProcessAsUserW,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,

0_2_00CC8858

Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CD545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	0_2_00CD545F
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_0008545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	2_2_0008545F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_004167EF ExitWindowsEx,LoadLibraryA,GetProcAddress,	5_2_004167EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_004167EF ExitWindowsEx,LoadLibraryA,GetProcAddress,	12_2_004167EF

Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C7E800	0_2_00C7E800
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C9DBB5	0_2_00C9DBB5
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C7FE40	0_2_00C7FE40
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CF804A	0_2_00CF804A
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C7E060	0_2_00C7E060
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C84140	0_2_00C84140
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C92405	0_2_00C92405
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CA6522	0_2_00CA6522
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CF0665	0_2_00CF0665
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CA267E	0_2_00CA267E
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C86843	0_2_00C86843
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C9283A	0_2_00C9283A
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CA89DF	0_2_00CA89DF
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CF0AE2	0_2_00CF0AE2
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CA6A94	0_2_00CA6A94
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C88A0E	0_2_00C88A0E
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CCEB07	0_2_00CCEB07
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CD8B13	0_2_00CD8B13
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C9CD61	0_2_00C9CD61
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CA7006	0_2_00CA7006
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C83190	0_2_00C83190
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C8710E	0_2_00C8710E
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C71287	0_2_00C71287
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C933C7	0_2_00C933C7
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C9F419	0_2_00C9F419
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C916C4	0_2_00C916C4
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C85680	0_2_00C85680
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C858C0	0_2_00C858C0
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C978D3	0_2_00C978D3
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C91BB8	0_2_00C91BB8
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CA9D05	0_2_00CA9D05
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C91FD0	0_2_00C91FD0
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C9BFE6	0_2_00C9BFE6
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_03143650	0_2_03143650
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_0002E800	2_2_0002E800
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_0004DBB5	2_2_0004DBB5
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_0002FE40	2_2_0002FE40
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_000A804A	2_2_000A804A
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_0002E060	2_2_0002E060
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_00034140	2_2_00034140
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_00042405	2_2_00042405
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_00056522	2_2_00056522
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_000A0665	2_2_000A0665
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_0005267E	2_2_0005267E
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_0004283A	2_2_0004283A
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_00036843	2_2_00036843
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_000589DF	2_2_000589DF
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_00038A0E	2_2_00038A0E
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_00056A94	2_2_00056A94
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_000A0AE2	2_2_000A0AE2
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_0007EB07	2_2_0007EB07
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_00088B13	2_2_00088B13
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_0004CD61	2_2_0004CD61
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_00057006	2_2_00057006
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_0003710E	2_2_0003710E
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_00033190	2_2_00033190
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_00021287	2_2_00021287
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_000433C7	2_2_000433C7
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_0004F419	2_2_0004F419
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_00035680	2_2_00035680
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_000416C4	2_2_000416C4
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_000358C0	2_2_000358C0
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_000478D3	2_2_000478D3
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_00041BB8	2_2_00041BB8
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_00059D05	2_2_00059D05
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_00041FD0	2_2_00041FD0
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_0004BFE6	2_2_0004BFE6
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_03F73650	2_2_03F73650
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 4_2_00D33650	4_2_00D33650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0043706A	5_2_0043706A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_00414005	5_2_00414005
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0043E11C	5_2_0043E11C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_004541D9	5_2_004541D9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_004381E8	5_2_004381E8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0041F18B	5_2_0041F18B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_00446270	5_2_00446270
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0043E34B	5_2_0043E34B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_004533AB	5_2_004533AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0042742E	5_2_0042742E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_00437566	5_2_00437566
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0043E5A8	5_2_0043E5A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_004387F0	5_2_004387F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0043797E	5_2_0043797E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_004339D7	5_2_004339D7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0044DA49	5_2_0044DA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_00427AD7	5_2_00427AD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0041DBF3	5_2_0041DBF3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_00427C40	5_2_00427C40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_00437DB3	5_2_00437DB3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_00435EEB	5_2_00435EEB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0043DEED	5_2_0043DEED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_00426E9F	5_2_00426E9F
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 11_2_03263650	11_2_03263650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_0043706A	12_2_0043706A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_00414005	12_2_00414005
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_0043E11C	12_2_0043E11C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_004541D9	12_2_004541D9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_004381E8	12_2_004381E8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_0041F18B	12_2_0041F18B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_00446270	12_2_00446270
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_0043E34B	12_2_0043E34B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_004533AB	12_2_004533AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_0042742E	12_2_0042742E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_00437566	12_2_00437566
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_0043E5A8	12_2_0043E5A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_004387F0	12_2_004387F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_0043797E	12_2_0043797E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_004339D7	12_2_004339D7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_0044DA49	12_2_0044DA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_00427AD7	12_2_00427AD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_0041DBF3	12_2_0041DBF3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_00427C40	12_2_00427C40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_00437DB3	12_2_00437DB3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_00435EEB	12_2_00435EEB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_0043DEED	12_2_0043DEED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_00426E9F	12_2_00426E9F

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 00402213 appears 38 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 004052FD appears 32 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0040417E appears 46 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 00402093 appears 100 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 00401E65 appears 68 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 00434E70 appears 108 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 00401FAB appears 38 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 004020DF appears 40 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 00434801 appears 82 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 00457AA8 appears 34 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 00445951 appears 56 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0044854A appears 36 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 00411FA2 appears 32 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 004046F7 appears 34 times
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: String function: 00048B40 appears 42 times
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: String function: 00040D27 appears 70 times
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: String function: 00027F41 appears 35 times
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: String function: 00C90D27 appears 70 times
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: String function: 00C98B40 appears 42 times
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: String function: 00C77F41 appears 35 times

Source: C:\Windows\SysWOW64\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 736

Source: jv4ri.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 12.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 12.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 12.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 11.2.name.exe.36c0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 11.2.name.exe.36c0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 11.2.name.exe.36c0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.name.exe.3f80000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 2.2.name.exe.3f80000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 2.2.name.exe.3f80000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 4.2.name.exe.36b0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 4.2.name.exe.36b0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 4.2.name.exe.36b0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 12.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 12.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 12.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 5.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 5.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 5.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 4.2.name.exe.36b0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 4.2.name.exe.36b0000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 4.2.name.exe.36b0000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 11.2.name.exe.36c0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 11.2.name.exe.36c0000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 11.2.name.exe.36c0000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 5.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 5.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 5.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.name.exe.3f80000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 2.2.name.exe.3f80000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 2.2.name.exe.3f80000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000005.00000002.2347910354.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000005.00000002.2347910354.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000005.00000002.2347910354.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000004.00000002.2055858818.00000000036B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000004.00000002.2055858818.00000000036B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000004.00000002.2055858818.00000000036B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000000C.00000002.2181096608.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000C.00000002.2181096608.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0000000C.00000002.2181096608.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000002.00000002.2040296471.0000000003F80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000002.00000002.2040296471.0000000003F80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000002.00000002.2040296471.0000000003F80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000000B.00000002.2182098787.00000000036C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000B.00000002.2182098787.00000000036C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0000000B.00000002.2182098787.00000000036C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: Process Memory Space: name.exe PID: 6176, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: name.exe PID: 6364, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: svchost.exe PID: 3712, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: name.exe PID: 4160, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: svchost.exe PID: 6548, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: jv4ri.exe	Static PE information: Section: .rsrc ZLIB complexity 0.9930708547993492
Source: name.exe.0.dr	Static PE information: Section: .rsrc ZLIB complexity 0.9930708547993492

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@16/22@0/1

Source: C:\Users\user\Desktop\jv4ri.exe

Code function: 0_2_00CDA2D5 GetLastError,FormatMessageW,

0_2_00CDA2D5

Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CC8713 AdjustTokenPrivileges,CloseHandle,	0_2_00CC8713
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CC8CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	0_2_00CC8CC3
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_00078713 AdjustTokenPrivileges,CloseHandle,	2_2_00078713
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_00078CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	2_2_00078CC3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0041798D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	5_2_0041798D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_0041798D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	12_2_0041798D

Source: C:\Users\user\Desktop\jv4ri.exe

Code function: 0_2_00CDB59E SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00CDB59E

Source: C:\Users\user\Desktop\jv4ri.exe

Code function: 0_2_00CEF121 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00CEF121

Source: C:\Users\user\Desktop\jv4ri.exe

Code function: 0_2_00C74FE9 FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00C74FE9

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 5_2_0041AADB OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

5_2_0041AADB

Source: C:\Users\user\Desktop\jv4ri.exe

File created: C:\Users\user\AppData\Local\directory

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3712
Source: C:\Windows\SysWOW64\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-S3AD48

Source: C:\Users\user\Desktop\jv4ri.exe

File created: C:\Users\user\AppData\Local\Temp\aut4DA0.tmp

Source: unknown

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\jv4ri.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: jv4ri.exe

ReversingLabs: Detection: 42%

Source: C:\Users\user\Desktop\jv4ri.exe

File read: C:\Users\user\Desktop\jv4ri.exe

Source: unknown	Process created: C:\Users\user\Desktop\jv4ri.exe "C:\Users\user\Desktop\jv4ri.exe"
Source: C:\Users\user\Desktop\jv4ri.exe	Process created: C:\Users\user\AppData\Local\directory\name.exe "C:\Users\user\Desktop\jv4ri.exe"
Source: C:\Users\user\AppData\Local\directory\name.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\jv4ri.exe"
Source: C:\Users\user\AppData\Local\directory\name.exe	Process created: C:\Users\user\AppData\Local\directory\name.exe "C:\Users\user\AppData\Local\directory\name.exe"
Source: C:\Users\user\AppData\Local\directory\name.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\AppData\Local\directory\name.exe"
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 736
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\directory\name.exe "C:\Users\user\AppData\Local\directory\name.exe"
Source: C:\Users\user\AppData\Local\directory\name.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\AppData\Local\directory\name.exe"
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 784
Source: C:\Users\user\Desktop\jv4ri.exe	Process created: C:\Users\user\AppData\Local\directory\name.exe "C:\Users\user\Desktop\jv4ri.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\jv4ri.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Process created: C:\Users\user\AppData\Local\directory\name.exe "C:\Users\user\AppData\Local\directory\name.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\AppData\Local\directory\name.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\directory\name.exe "C:\Users\user\AppData\Local\directory\name.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\AppData\Local\directory\name.exe"	Jump to behavior

Source: C:\Users\user\Desktop\jv4ri.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jv4ri.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\jv4ri.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\jv4ri.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\jv4ri.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\jv4ri.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\jv4ri.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\jv4ri.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jv4ri.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\jv4ri.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\jv4ri.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jv4ri.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\jv4ri.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\jv4ri.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jv4ri.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\jv4ri.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\jv4ri.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: C:\Users\user\Desktop\jv4ri.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32

Drops VBS files to the startup folder

Source:	Binary string: wntdll.pdbUGP source: name.exe, 00000002.00000003.2039035690.0000000004000000.00000004.00001000.00020000.00000000.sdmp, name.exe, 00000002.00000003.2039157753.00000000041A0000.00000004.00001000.00020000.00000000.sdmp, name.exe, 00000004.00000003.2052777335.00000000038D0000.00000004.00001000.00020000.00000000.sdmp, name.exe, 00000004.00000003.2053042365.0000000003730000.00000004.00001000.00020000.00000000.sdmp, name.exe, 0000000B.00000003.2179689028.0000000003740000.00000004.00001000.00020000.00000000.sdmp, name.exe, 0000000B.00000003.2180712436.0000000003970000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: name.exe, 00000002.00000003.2039035690.0000000004000000.00000004.00001000.00020000.00000000.sdmp, name.exe, 00000002.00000003.2039157753.00000000041A0000.00000004.00001000.00020000.00000000.sdmp, name.exe, 00000004.00000003.2052777335.00000000038D0000.00000004.00001000.00020000.00000000.sdmp, name.exe, 00000004.00000003.2053042365.0000000003730000.00000004.00001000.00020000.00000000.sdmp, name.exe, 0000000B.00000003.2179689028.0000000003740000.00000004.00001000.00020000.00000000.sdmp, name.exe, 0000000B.00000003.2180712436.0000000003970000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\jv4ri.exe

Code function: 0_2_00DBC0B0 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

0_2_00DBC0B0

Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CC0181 pushfd ; retf	0_2_00CC0195
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CC019E pushfd ; retf	0_2_00CC01A5
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CC01AE pushfd ; retf	0_2_00CC01B1
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CC01A6 pushfd ; retf	0_2_00CC01AD
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CC02AB push FFFFFFC0h; retf	0_2_00CC02AD
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C7C946 push ds; retf	0_2_00C7C949
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C7C94C push ds; retf	0_2_00C7C94D
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C7C950 push ds; retf	0_2_00C7C951
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C7C927 push ds; retf	0_2_00C7C929
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C7C937 push ds; retf	0_2_00C7C93D
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C7C934 push ds; retf	0_2_00C7C935
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C7C93F push ds; retf	0_2_00C7C945
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C80A68 push eax; retf	0_2_00C80A69
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C80A64 push eax; retf	0_2_00C80A65
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C80A3B push eax; retf	0_2_00C80A41
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C98B85 push ecx; ret	0_2_00C98B98
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C7B740 push es; retf	0_2_00C7B75A
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C7B88B push cs; retf	0_2_00C7B892
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C7B889 push cs; retf	0_2_00C7B88A
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C7B894 push cs; retf	0_2_00C7B89A
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CFF848 pushfd ; iretd	0_2_00CFF84E
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C7B83B push cs; retf	0_2_00C7B872
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CB1A9A push ss; retf	0_2_00CB1A9C
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CB1A9D push ss; retf	0_2_00CB1AA0
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CB1AA2 push ss; retf	0_2_00CB1AAC
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_0002C590 push eax; retn 0002h	2_2_0002C599
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_00048B85 push ecx; ret	2_2_00048B98
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_000AF84D pushfd ; iretd	2_2_000AF84E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_00457186 push ecx; ret	5_2_00457199
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0045E55D push esi; ret	5_2_0045E566
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_00457AA8 push eax; ret	5_2_00457AC6

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 5_2_00406EEB ShellExecuteW,URLDownloadToFileW,

5_2_00406EEB

Source: C:\Users\user\Desktop\jv4ri.exe

File created: C:\Users\user\AppData\Local\directory\name.exe

Jump to dropped file

Boot Survival

Source: C:\Users\user\AppData\Local\directory\name.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs

Jump to dropped file

Source: C:\Users\user\AppData\Local\directory\name.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs

Source: C:\Users\user\AppData\Local\directory\name.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs

Delayed program exit found

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 5_2_0041AADB OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

5_2_0041AADB

Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C74A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	0_2_00C74A35
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CF55FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	0_2_00CF55FD
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_00024A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	2_2_00024A35
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_000A55FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	2_2_000A55FD

Source: C:\Users\user\Desktop\jv4ri.exe

Code function: 0_2_00C933C7 RtlEncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00C933C7

Source: C:\Users\user\Desktop\jv4ri.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jv4ri.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0040F7E2 Sleep,ExitProcess,		5_2_0040F7E2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_0040F7E2 Sleep,ExitProcess,		12_2_0040F7E2

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\directory\name.exe	API/Special instruction interceptor: Address: 3F73274
Source: C:\Users\user\AppData\Local\directory\name.exe	API/Special instruction interceptor: Address: D33274
Source: C:\Users\user\AppData\Local\directory\name.exe	API/Special instruction interceptor: Address: 3263274

Source: C:\Windows\SysWOW64\svchost.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,		5_2_0041A7D9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,		12_2_0041A7D9

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

System process connects to network (likely due to code injection or exploit)

Source: C:\Users\user\Desktop\jv4ri.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-100002

Source: C:\Users\user\Desktop\jv4ri.exe	API coverage: 4.5 %
Source: C:\Users\user\AppData\Local\directory\name.exe	API coverage: 4.8 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 6.1 %

Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CD4696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00CD4696
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CDC9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00CDC9C7
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CDC93C FindFirstFileW,FindClose,	0_2_00CDC93C
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CDF200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00CDF200
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CDF35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00CDF35D
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CDF65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00CDF65E
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CD3A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00CD3A2B
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CD3D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00CD3D4E
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CDBF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00CDBF27
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_00084696 GetFileAttributesW,FindFirstFileW,FindClose,	2_2_00084696
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_0008C93C FindFirstFileW,FindClose,	2_2_0008C93C
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_0008C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	2_2_0008C9C7
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_0008F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_0008F200
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_0008F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_0008F35D
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_0008F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	2_2_0008F65E
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_00083A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	2_2_00083A2B
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_00083D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	2_2_00083D4E
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_0008BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	2_2_0008BF27
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	5_2_0040C388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	5_2_0040928E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	5_2_0041C322
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	5_2_004096A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	5_2_00408847
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_00407877 FindFirstFileW,FindNextFileW,	5_2_00407877
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0044E8F9 FindFirstFileExA,	5_2_0044E8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	5_2_0040BB6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	5_2_00419B86
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	5_2_0040BD72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	12_2_0040928E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	12_2_0041C322
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	12_2_0040C388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	12_2_004096A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	12_2_00408847
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_00407877 FindFirstFileW,FindNextFileW,	12_2_00407877
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_0044E8F9 FindFirstFileExA,	12_2_0044E8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	12_2_0040BB6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	12_2_00419B86
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	12_2_0040BD72

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 5_2_00407CD2 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

5_2_00407CD2

Source: C:\Users\user\Desktop\jv4ri.exe

Code function: 0_2_00C74AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00C74AFE

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior

Source: Amcache.hve.8.dr	Binary or memory string: VMware
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.8.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.8.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.8.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.8.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: svchost.exe, 00000005.00000002.2348445947.0000000003412000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.8.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.8.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.8.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.8.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.8.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.8.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.8.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.8.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.8.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\jv4ri.exe	API call chain: ExitProcess graph end node	graph_0-99049
Source: C:\Users\user\Desktop\jv4ri.exe	API call chain: ExitProcess graph end node	graph_0-99123
Source: C:\Users\user\Desktop\jv4ri.exe	API call chain: ExitProcess graph end node	graph_0-99235
Source: C:\Users\user\AppData\Local\directory\name.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\directory\name.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\svchost.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\jv4ri.exe

Code function: 0_2_00CE41FD BlockInput,

0_2_00CE41FD

Source: C:\Users\user\Desktop\jv4ri.exe

Code function: 0_2_00C73B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00C73B4C

Source: C:\Users\user\Desktop\jv4ri.exe

Code function: 0_2_00CA5CCC RtlEncodePointer,RtlEncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,IsDebuggerPresent,OutputDebugStringW,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,

0_2_00CA5CCC

Source: C:\Users\user\Desktop\jv4ri.exe

Code function: 0_2_00DBC0B0 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

0_2_00DBC0B0

Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_03143540 mov eax, dword ptr fs:[00000030h]	0_2_03143540
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_031434E0 mov eax, dword ptr fs:[00000030h]	0_2_031434E0
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_03141E70 mov eax, dword ptr fs:[00000030h]	0_2_03141E70
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_03F73540 mov eax, dword ptr fs:[00000030h]	2_2_03F73540
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_03F734E0 mov eax, dword ptr fs:[00000030h]	2_2_03F734E0
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_03F71E70 mov eax, dword ptr fs:[00000030h]	2_2_03F71E70
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 4_2_00D33540 mov eax, dword ptr fs:[00000030h]	4_2_00D33540
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 4_2_00D31E70 mov eax, dword ptr fs:[00000030h]	4_2_00D31E70
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 4_2_00D334E0 mov eax, dword ptr fs:[00000030h]	4_2_00D334E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_00443355 mov eax, dword ptr fs:[00000030h]	5_2_00443355
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 11_2_032634E0 mov eax, dword ptr fs:[00000030h]	11_2_032634E0
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 11_2_03261E70 mov eax, dword ptr fs:[00000030h]	11_2_03261E70
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 11_2_03263540 mov eax, dword ptr fs:[00000030h]	11_2_03263540
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_00443355 mov eax, dword ptr fs:[00000030h]	12_2_00443355

Source: C:\Users\user\Desktop\jv4ri.exe

Code function: 0_2_00CC81F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,RtlAllocateHeap,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00CC81F7

Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C9A395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00C9A395
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00C9A364 SetUnhandledExceptionFilter,	0_2_00C9A364
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_0004A364 SetUnhandledExceptionFilter,	2_2_0004A364
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_0004A395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0004A395
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0043503C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_0043503C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00434A8A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0043BB71 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_0043BB71
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_00434BD8 SetUnhandledExceptionFilter,	5_2_00434BD8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_0043503C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_0043503C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_00434A8A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_0043BB71 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_0043BB71
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_00434BD8 SetUnhandledExceptionFilter,	12_2_00434BD8

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\SysWOW64\svchost.exe

Network Connect: 45.95.169.104 2404

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\directory\name.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3000008			Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2D88008			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe		5_2_00412132
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe		12_2_00412132

Source: C:\Users\user\Desktop\jv4ri.exe

Code function: 0_2_00CC8C93 LogonUserW,

0_2_00CC8C93

Source: C:\Users\user\Desktop\jv4ri.exe

Code function: 0_2_00C73B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00C73B4C

Source: C:\Users\user\Desktop\jv4ri.exe

Code function: 0_2_00C74A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00C74A35

Source: C:\Users\user\Desktop\jv4ri.exe

Code function: 0_2_00CD4EC9 mouse_event,

0_2_00CD4EC9

Source: C:\Users\user\AppData\Local\directory\name.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\jv4ri.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\AppData\Local\directory\name.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\directory\name.exe "C:\Users\user\AppData\Local\directory\name.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\AppData\Local\directory\name.exe"	Jump to behavior

Source: C:\Users\user\Desktop\jv4ri.exe

0_2_00CC81F7

Source: C:\Users\user\Desktop\jv4ri.exe

Code function: 0_2_00CD4C03 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00CD4C03

Source: jv4ri.exe, 00000000.00000002.2026886010.0000000000D25000.00000040.00000001.01000000.00000003.sdmp, name.exe, 00000002.00000002.2039583863.00000000000D5000.00000040.00000001.01000000.00000004.sdmp, name.exe, 00000004.00000002.2054778566.00000000000D5000.00000040.00000001.01000000.00000004.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: svchost.exe, 00000005.00000002.2348445947.0000000003412000.00000004.00000020.00020000.00000000.sdmp, logs.dat.5.dr	Binary or memory string: [2024/09/06 15:56:57 Program Manager]
Source: jv4ri.exe, name.exe	Binary or memory string: Shell_TrayWnd
Source: svchost.exe, 00000005.00000002.2348481451.0000000003436000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager+
Source: svchost.exe, 00000005.00000002.2348445947.0000000003412000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|

Source: C:\Users\user\Desktop\jv4ri.exe

Code function: 0_2_00C9886B cpuid

0_2_00C9886B

Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoA,	5_2_0040F90C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: EnumSystemLocalesW,	5_2_0045201B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: EnumSystemLocalesW,	5_2_004520B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	5_2_00452143
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoW,	5_2_00452393
Source: C:\Windows\SysWOW64\svchost.exe	Code function: EnumSystemLocalesW,	5_2_00448484
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	5_2_004524BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoW,	5_2_004525C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	5_2_00452690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoW,	5_2_0044896D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	5_2_00451D58
Source: C:\Windows\SysWOW64\svchost.exe	Code function: EnumSystemLocalesW,	5_2_00451FD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: EnumSystemLocalesW,	12_2_0045201B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: EnumSystemLocalesW,	12_2_004520B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	12_2_00452143
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoW,	12_2_00452393
Source: C:\Windows\SysWOW64\svchost.exe	Code function: EnumSystemLocalesW,	12_2_00448484
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	12_2_004524BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoW,	12_2_004525C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	12_2_00452690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoW,	12_2_0044896D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: GetLocaleInfoA,	12_2_0040F90C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	12_2_00451D58
Source: C:\Windows\SysWOW64\svchost.exe	Code function: EnumSystemLocalesW,	12_2_00451FD0

Source: C:\Users\user\Desktop\jv4ri.exe

Code function: 0_2_00CA50D7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00CA50D7

Source: C:\Users\user\Desktop\jv4ri.exe

Code function: 0_2_00CB2230 GetUserNameW,

0_2_00CB2230

Source: C:\Users\user\Desktop\jv4ri.exe

Code function: 0_2_00CA418A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00CA418A

Source: C:\Users\user\Desktop\jv4ri.exe

Code function: 0_2_00C74AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00C74AFE

Source: C:\Users\user\Desktop\jv4ri.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: Yara match	File source: 12.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.name.exe.36c0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.name.exe.3f80000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.name.exe.36b0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.name.exe.36b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.name.exe.36c0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.name.exe.3f80000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2348733537.000000000522F000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2347910354.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2348427875.0000000003400000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2055858818.00000000036B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2348445947.0000000003412000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2181376722.0000000003000000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2181096608.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2040296471.0000000003F80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2182098787.00000000036C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: name.exe PID: 6176, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: name.exe PID: 6364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 3712, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: name.exe PID: 4160, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6548, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: C:\Windows\SysWOW64\svchost.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data		5_2_0040BA4D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data		12_2_0040BA4D

Contains functionality to steal Firefox passwords or cookies

Source: C:\Windows\SysWOW64\svchost.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\	5_2_0040BB6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: \key3.db	5_2_0040BB6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\	12_2_0040BB6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: \key3.db	12_2_0040BB6B

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\svchost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Source: name.exe	Binary or memory string: WIN_81
Source: name.exe	Binary or memory string: WIN_XP
Source: name.exe	Binary or memory string: WIN_XPe
Source: name.exe	Binary or memory string: WIN_VISTA
Source: name.exe	Binary or memory string: WIN_7
Source: name.exe	Binary or memory string: WIN_8
Source: name.exe, 0000000B.00000002.2181378905.00000000000D5000.00000040.00000001.01000000.00000004.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Remote Access Functionality

Detected Remcos RAT

Source: C:\Windows\SysWOW64\svchost.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-S3AD48			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-S3AD48			Jump to behavior

Source: Yara match	File source: 12.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.name.exe.36c0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.name.exe.3f80000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.name.exe.36b0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.name.exe.36b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.name.exe.36c0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.name.exe.3f80000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2348733537.000000000522F000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2347910354.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2348427875.0000000003400000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2055858818.00000000036B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2348445947.0000000003412000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2181376722.0000000003000000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2181096608.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2040296471.0000000003F80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2182098787.00000000036C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: name.exe PID: 6176, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: name.exe PID: 6364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 3712, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: name.exe PID: 4160, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6548, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: C:\Windows\SysWOW64\svchost.exe	Code function: cmd.exe		5_2_0040569A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: cmd.exe		12_2_0040569A

Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CE6596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	0_2_00CE6596
Source: C:\Users\user\Desktop\jv4ri.exe	Code function: 0_2_00CE6A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	0_2_00CE6A5A
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_00096596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	2_2_00096596
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_00096A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	2_2_00096A5A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	2 Valid Accounts	2 Native API	111 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	221 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	2 Valid Accounts	1 Bypass User Account Control	21 Obfuscated Files or Information	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	221 Input Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Windows Service	2 Valid Accounts	11 Software Packing	NTDS	4 File and Directory Discovery	Distributed Component Object Model	3 Clipboard Data	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	2 Registry Run Keys / Startup Folder	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	126 System Information Discovery	SSH	Keylogging	1 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Windows Service	1 Bypass User Account Control	Cached Domain Credentials	251 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	322 Process Injection	1 Masquerading	DCSync	1 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	2 Registry Run Keys / Startup Folder	2 Valid Accounts	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	21 Access Token Manipulation	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	322 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
jv4ri.exe	42%	ReversingLabs	Win32.Trojan.Vindor
jv4ri.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\directory\name.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\directory\name.exe	42%	ReversingLabs	Win32.Trojan.Vindor

Source	Detection	Scanner	Label
http://upx.sf.net	0%	URL Reputation	safe
5.95.169.104	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gp	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gp/C	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
5.95.169.104	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp	svchost.exe	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.8.dr	false	URL Reputation: safe	unknown
http://geoplugin.net/json.gp/C	name.exe, 00000002.00000002.2040296471.0000000003F80000.00000004.00001000.00020000.00000000.sdmp, name.exe, 00000004.00000002.2055858818.00000000036B0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2347910354.0000000000400000.00000040.80000000.00040000.00000000.sdmp, name.exe, 0000000B.00000002.2182098787.00000000036C0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.2181096608.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.95.169.104	unknown	Croatia (LOCAL Name: Hrvatska)		42864	GIGANET-HUGigaNetInternetServiceProviderCoHU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1505824
Start date and time:	2024-09-06 21:56:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	jv4ri.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winEXE@16/22@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 63 Number of non-executed functions: 272
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: jv4ri.exe

Simulations

Behavior and APIs

Time	Type	Description
15:57:21	API Interceptor	2x Sleep call for process: WerFault.exe modified
21:56:58	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GIGANET-HUGigaNetInternetServiceProviderCoHU	P.O_Qouts_t87E90Y-E4R7G-PDF.exe	Get hash	malicious	Remcos, GuLoader	Browse	45.95.169.18
	7GfciIf7ys.exe	Get hash	malicious	Unknown	Browse	45.95.169.223
	Qoute_EXW_prices_43GJI_pdf.exe	Get hash	malicious	Remcos, GuLoader	Browse	45.95.169.110
	Qoute_EXW_prices_43GJI_pdf.exe	Get hash	malicious	Remcos, GuLoader	Browse	45.95.169.110
	RFQ-7H87-F8R-pdf.exe	Get hash	malicious	Remcos, GuLoader	Browse	45.95.169.139
	Q-5687-348t.exe	Get hash	malicious	Remcos	Browse	45.95.169.135
	BdrPfb3rZS.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.95.169.149
	otpD06ykDv.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.95.169.149
	wzPLWj0B5C.elf	Get hash	malicious	Gafgyt	Browse	45.95.169.146
	NxFjydLnaS.elf	Get hash	malicious	Gafgyt	Browse	45.95.169.146

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_svchost.exe_90306d8653668e93dc76e25903a477e7da5e9b1_1b8f0228_3462b859-46f3-46d3-976d-c605528b01ec\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9084555098033209
Encrypted:	false
SSDEEP:	192:hCT1Js8A0YrZkhaJjkZriHzzuiFeZ24IO8KRA:ABJs8bYrZkhaJjNzuiFeY4IO8KRA
MD5:	9A9499B08C58249EC40A0C574AD65014
SHA1:	4D1E3B3B51DC3EE698768A8885BE7896F11A5FF8
SHA-256:	8D46733E9BA16B3E7456404896C2B192B7D8CC4945DA71AD1F4DAC0CD82D7AD1
SHA-512:	AB0F1BA3AAD43F92E03FA4E0CEEDF076A4431A7A07D1F584834F1076A798417D179F582C96241AD7CF94D3B749C942A062930D4318930C102AE06BDD68EE0D39
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.0.1.2.6.2.1.9.0.7.6.0.3.2.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.0.1.2.6.2.1.9.5.4.4.7.8.1.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.4.6.2.b.8.5.9.-.4.6.f.3.-.4.6.d.3.-.9.7.6.d.-.c.6.0.5.5.2.8.b.0.1.e.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.7.7.5.7.c.4.4.-.b.6.4.f.-.4.7.2.4.-.b.1.6.6.-.a.7.b.b.1.8.6.7.6.d.3.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.s.v.c.h.o.s.t...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.s.v.c.h.o.s.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.e.8.0.-.0.0.0.1.-.0.0.1.4.-.e.9.4.3.-.b.4.e.d.9.6.0.0.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.3.1.9.6.f.4.5.b.2.6.9.a.6.1.4.a.3.9.2.6.e.f.c.0.3.2.f.c.9.d.7.5.0.1.7.f.2.7.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_svchost.exe_fbbd68dbb613b46818cd907af168fb3f524e519_1b8f0228_ba63b463-c4dd-42e3-a65c-d22e9f103333\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9363468098655506
Encrypted:	false
SSDEEP:	192:qWT1JFL8M0qG2GFjjkZriH4zuiFeZ24IO8KRA:rBJFL8HqGPFjjGzuiFeY4IO8KRA
MD5:	CE1BE38E08A03142200168DA967A37C7
SHA1:	BB72B5B02DB7C6534EAF7AC7E3C65233AB7A4FDD
SHA-256:	952DD915722585B06AC30B64EF8200CF7F2F714AA897C9D6BA2B3D8EC968BB57
SHA-512:	40ABD219564502A4C987E682201584EB79FA8F7AB6E916BFAD13708C10BE709455758D62C1BAF1438DA323FD0374155A72A3AFB1FBD5B48011CC80EC2923253C
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.0.1.2.6.2.4.1.8.9.6.1.3.5.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.0.1.2.6.2.4.2.3.9.6.1.3.1.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.a.6.3.b.4.6.3.-.c.4.d.d.-.4.2.e.3.-.a.6.5.c.-.d.2.2.e.9.f.1.0.3.3.3.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.1.8.6.9.5.b.f.-.4.3.b.c.-.4.3.d.b.-.9.c.d.f.-.2.6.9.c.6.8.b.1.8.a.b.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.s.v.c.h.o.s.t...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.s.v.c.h.o.s.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.e.8.0.-.0.0.0.1.-.0.0.1.4.-.e.9.4.3.-.b.4.e.d.9.6.0.0.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.3.1.9.6.f.4.5.b.2.6.9.a.6.1.4.a.3.9.2.6.e.f.c.0.3.2.f.c.9.d.7.5.0.1.7.f.2.7.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER654F.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Sep 6 19:56:59 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	85234
Entropy (8bit):	1.7825057835408542
Encrypted:	false
SSDEEP:	384:Jy98g9USjG5jnkiJ6E6N9kQ7ZHbpShKkyvI2N:Jy9NuGG5jnL6ECkQlpS6wy
MD5:	6CAA514D6F59A04A51FE30F262AD223A
SHA1:	1F254BA3B1F4F347D885068C5BBAB7E27A7104F2
SHA-256:	B7DDF4287F453B6DC3BFCBBC3A596A3A70B78A948484F367F0FA28284625AD8D
SHA-512:	CA62C4B03D4BCE882458CD7A81CCFC8E19BAD99A9B353202C91AE5168197A2F1B98CFD8F403E613FC9D1BF87AC68AE6E3FF22DC295458B51563EBAA3CD94A9F6
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........^.f.........................................;..........T.......8...........T...........p..../.......... ...........................................................................................eJ..............GenuineIntel............T............^.f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER662B.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8272
Entropy (8bit):	3.691727776888771
Encrypted:	false
SSDEEP:	192:R6l7wVeJwxl6d6Yl36AIyXgmfp7JuZ+2prt89bOgsfwam:R6lXJU6d6YV6AIyXgmfp7JuZ+pOzfM
MD5:	ED0F4771C5B986786FAB93EE755DE9E0
SHA1:	989ED459F093DD94DF83794A1968AE586E702E9F
SHA-256:	D209FFA07072B57BBEABAAF5AD8ED948A63BC55D12C424E26C74BE63300C129E
SHA-512:	ADC9DA2B7D57A3F5BF882DC7821DA7D0DA522E4A9858AB68285BCCDFECE298CC3591B1FCEFD70CDBF6848EAE630AEAB892A2E268B6F48472E3F2E9BCA20169EE
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.7.1.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER666A.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4655
Entropy (8bit):	4.45001390218119
Encrypted:	false
SSDEEP:	48:cvIwWl8zswJg77aI9a1WpW8VYTvYm8M4JCxIFoZ+q8ST8D0md:uIjf2I70E7VLJC5Z/8D0md
MD5:	133C0C7B79A92EB692A12FA6061B4129
SHA1:	80B4D0EAFCB4A62E58AD40BC1E89FA09E8F9C52F
SHA-256:	510A075326DA93001F7892BDE68EA14FBCD361F2F5E0C7417515E2E2C5844EC4
SHA-512:	7538923EA3E09A7FCEA7920A9B0F977333BAFDA79EF964E45737317FAE3E0FBBFC4701114C17F143A37AE4186775193F1C0F84FD2EBE301375F5A31F505E11B1
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="488819" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBE7B.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Sep 6 19:57:22 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	140908
Entropy (8bit):	1.7781722702700224
Encrypted:	false
SSDEEP:	768:eRrUBgG5trDWl06ECkQoNpho189O+lF4rho75HxqA/+2K:krapr5v9o189O+X4rho75HxqA/+2K
MD5:	A9214519048212A3B607FF09DCEFCF44
SHA1:	92C8D25C8E0BBBDC84C013BC3F13EAE2094F405D
SHA-256:	C56ECC7072B919E252F9793C015C902C732638C8933189AAB055315934128913
SHA-512:	9B90E64EFB5F4E7DD871A7C53FCEA8F892A33D6BC6B7490365D01F3391EDE60A010BE46DB95D4FBAE8AE537FBDBAD64407AA43E1638FD3EFA981C2D26A0FDDB0
Malicious:	false
Preview:	MDMP..a..... ........^.f........................D................R..........T.......8...........T............&..d........... ............ ..............................................................................eJ....... ......GenuineIntel............T............^.f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBFE3.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8280
Entropy (8bit):	3.686134361783112
Encrypted:	false
SSDEEP:	192:R6l7wVeJwCA6Hizo46Yl+6AIyXgmfp79AWpDa89brgsf3Zm:R6lXJC6Y6YM6AIyXgmfp79Hrzfk
MD5:	C200811CB02528FA2B3324A79DD63E1C
SHA1:	A624E6D0D65D6059DF60E10307AFCDE169BEEE99
SHA-256:	EE5A86E12BF0A146BF17F7E950CF2F4709A0C19355E898A313157B783415BCCD
SHA-512:	197616F701A07DF2742784F5AF38E1BE289FC6F13FEAB529A6C1911AE9345EC39FF335AECD86F86F59963494DA49C12B988E9D28729E6A326E5D50B426070068
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.7.1.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC004.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4655
Entropy (8bit):	4.448573265436057
Encrypted:	false
SSDEEP:	48:cvIwWl8zsgJg77aI9a1WpW8VYEYm8M4JCxKFz+q8oT8D0md:uIjfmI70E7V4JCqR8D0md
MD5:	C6176340C1DE8B66707006EFCF8F4595
SHA1:	3858600F6F26252CF08F05E819BE08E5BC1C3F57
SHA-256:	E062CE157B4DD320BF56F9F8B1DADB9D8AA09C6C14F1F45E2D57BE8732338C6A
SHA-512:	9632ACF54EFDDBE9152321470670E001A85CC7711F6BDA7C8354AF95F02BD0044B40FD3E24B0933DA2F51047E2BB3DF11D3C58D9175EA43D05B4A5AC948DDAFF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="488820" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\remcos\logs.dat

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	184
Entropy (8bit):	3.3928118725288807
Encrypted:	false
SSDEEP:	3:rhlKlTlTGlwfKlxPU5JWRal2Jl+7R0DAlBG4phlKlTlTGlwfKlxPPQblovDl6v:6lclPI5YcIeeDAlMlclPsbWAv
MD5:	5AD886C53E3181D42C8C37FD02A617AB
SHA1:	63286DC48329438E388B1549C46D939E694490A4
SHA-256:	D7263F51A64B921097FFFB259CC0BA73E485876CF630CFA9803A61E5AC344DBF
SHA-512:	617EBD7A0F84A1C6671ACABE03B45EF50DD1E08822966833675A0F2F84780041C29DA53B71774141513CF88BAB0379D45E69AE006A0EAAECB50B9F7090F6E2E6
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\ProgramData\remcos\logs.dat, Author: Joe Security
Preview:	....[.2.0.2.4./.0.9./.0.6. .1.5.:.5.6.:.5.7. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.2.0.2.4./.0.9./.0.6. .1.5.:.5.6.:.5.7. .P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

C:\Users\user\AppData\Local\Temp\Lymnaeidae

Process:	C:\Users\user\Desktop\jv4ri.exe
File Type:	data
Category:	dropped
Size (bytes):	494592
Entropy (8bit):	7.648069693388643
Encrypted:	false
SSDEEP:	12288:EKeJlfV8SdLU0tuS5k2soir71v1yh9+1FjRVQdOXJjEDl:Ehd8SdLUsu8Fir7Xyh9+xCdOWx
MD5:	D27901A98FCF9BA932E53C7450496F09
SHA1:	423DB92CD7D8EF22A1F486A4547BD3B473ECC4A1
SHA-256:	986EFA4E9A46AB0D0091CD50C8CF22101FE87C21729CE6D90B9441A6448E7071
SHA-512:	A811201954A1F9998717621FE1F9305E1F2DE2FD2D1B96BEE1660E2235C4B5A63B9CFD10F52FD39810373FFC365281E3BE3316321A1C626064B2B1481936FE8D
Malicious:	false
Preview:	...5IB4M=EWG..JL.1A96IVQxNE75JB4M9EWG69JLI1A96IVQ8NE75JB4M9EOF69DS.?A.?.w.9...a"+GmI78 DX'lP/WY=v3]n7B[j+Zm}..g[V.)g<L3.IVQ8NE791...#.).,.4.S.?.n(.".;.o<.W.;...G.V.O.[d7.K.0..$4...G...IkP.7...I;L.F...J X.3x'.9g#.2.+.G@R./...H.P.J.}l).,.4...>p,.(.Q--./.<4M9EWG69JLI1A96IVQ8NE75J.qM9.V@6../1A96IVQ8.E54AC:M97RG6/HLI1A9..UQ8^E75.G4M9.WG&9JLK1A<6HVQ8NE25KB4M9EWg>9JHI1A96ITQ8.E7%JB$M9EWW69ZLI1A96YVQ8NE75JB4M..QG28JLI.F9..VQ8NE75JB4M9EWG69JL.6A..IV..HE.5JB4M9EWG69JLI1A96I..>N]75J..K9.WG69JLI1A96I.T8N@75JB4M9EWG69JLI1A96IVQ8NE7.>'L99EW.G<JLY1A9DLVQ<NE75JB4M9EWG69jLIQoKR("08N.N4JB.H9E-F69<II1A96IVQ8NE75.B4..!63W9JL.lA96YQQ8@E75.D4M9EWG69JLI1Ay6I..L"675JB=M9EW719JNI1A.0IVQ8NE75JB4M9.WG..- U296yTQ8N.05JF4M9EPG69JLI1A96IVQxNEw.81F.9EW.\|9JL.6A9zIVQ<IE75JB4M9EWG69.LIqoKS%928N..5JB.J9EkG69.KI1A96IVQ8NE75.B4.9EWG69JLI1A96IVQ8NE75JB4M9EWG69JLI1A96IVQ8NE75JB4M9EWG69JLI1A96IVQ8NE75JB4M9EWG69JLI1A96IVQ8NE75JB4M9EWG69JLI1A96IVQ8NE75JB4M9EWG69JLI1A96IVQ8NE75JB4M9EWG69JLI1A96IVQ8NE75JB4M9EWG69JLI1A96IVQ8

C:\Users\user\AppData\Local\Temp\aut4DA0.tmp

Process:	C:\Users\user\Desktop\jv4ri.exe
File Type:	data
Category:	dropped
Size (bytes):	435094
Entropy (8bit):	7.988688030415207
Encrypted:	false
SSDEEP:	6144:AB8QymyCNA026bs/OG+skFxZObHmJwlx8edLelM0gDskRO79BDUk15J0nfIxag:c8jXXms/O7FrOykbLf0gDXc79BokWwL
MD5:	3B359F0E0BB258EC851BDF1D17A9F448
SHA1:	9F1D46562F12D11C70DFC7215A4862E5A7D6B876
SHA-256:	4552D49989780CC2EBBF5CC50454ECE310078ECE1B67A2D9A496DB3F4C00E585
SHA-512:	DD2153A6961846F237CA2234410D98936728864F1E3508D77E8546B990F97BBE50E0A182FF2E9C7ABC5BA9DB6BFD08D6A5F574F41BF4C7E95A7BA0D0B2FFD79A
Malicious:	false
Preview:	EA06........ZM.iM..j.~O..L..h3..&.Q.S..y.(.d....i..I.....g..4.sD.....l..w..`X...E+..i3y..X..%U.}^.=.L....j....T..[.K.6y.2g..K..c...dy9L>Y.A~y..an.B.Y../go.v..........\|..d...~.O.$.B%.>.'.......R....z6...H+.)..O....y..W...X......Fj.JV..l.....7.>.K3..F[-.......%q..a5j.......u...f....9...i} ...@...x...Q...-^.&.K)s...mH.K.SZX..,.......Fq......e..5...V@W....h.).....Nr.0.............>.E...S.l.S.ut...y.`....8.I.:.......zd..d.Q.ed.d.S......j.Rj6.]JQ".N).t.B.R'4Yh.i<............up.B.l..j5....d.Q..~......$S`.Fz.2..3.U8.d....~........Y..my.E).Y..F.Kj......w..&4ip.Y.......sz..'......L..m....s2.S......J..m`.$j............G..\&.)..9....9.C~.Pl._..9..kq.Tes.F.U...u&...~47.u[s...+.i....X(.k.&M...a.ZL?....h..C..g..M..A.S.~yQ.....\.....2<P.LY.........24P.L\o.......21..LRq......C..Z..k..io....... .j.F...j....k......R[6.l.P.]...=y..o..f.....?..ZM...9.l%1I....R..........TZe&.B...;..:.E.}..,o........U2C...&..-.wN.}+...;~....9.Ig..'=..8...X..i.

C:\Users\user\AppData\Local\Temp\aut4E0F.tmp

Process:	C:\Users\user\Desktop\jv4ri.exe
File Type:	data
Category:	dropped
Size (bytes):	16506
Entropy (8bit):	7.575140850617736
Encrypted:	false
SSDEEP:	384:T0fPw2X19Oc+FtDTRuqsvHUddjObP7P9kJ0UXPT3kdxzsAvRZp:TSwy/MFBBsv6djObPBkOiPCxQGV
MD5:	64C0A461DAEA97226D05D1A92A219D77
SHA1:	42E64F7F89BB396A969F35FE8E8446E184D9E97A
SHA-256:	A797284C52DC19C38B2A640294F221C0225FEF47FD194DACE17A966055615054
SHA-512:	6297133A731F0AD60CDF1F2E74B40FA2A51A8D987096B924023627AD7A6268B34352E827BD99952FBDA1932A25E3E882106704F52DF7481EFBD192ABAFCC9910
Malicious:	false
Preview:	EA06...".L&.J..q4..........O.8....'VP..X..>I..'....?nd.%......;...\|.p...p.[.X..?.....l....1.r.....'.4...' ..h...od.).. +.$....6.....<.....Q.....0.o.l.Q......P.o.f...................<.,.......f@e_........~.@.o.Fl...X.y.....g..9.....[....Ic.....?.y....4...,..?.H<...U......@.o..c......g...l..c...8..@.>...G.H.....D}.0(...d.q...l\|.P(...h........Q...........l`Q..D......... J_......-......@./.p.E.....6@./.;..[..9}.....1......._hw...d...C.... eG.......`....n..!..}..vP&.;............."l....X@...C?.a....&... OW..6.J....?.K(Q..[0....&._. 4W.9....&._.$.%#.H...f._.hK......M.`..)..W.m4....E...9..W.Z#...M..?../.py....~.0..."."..M.3.......".......6.....n.....y.i..7.."...+...<.u.........60...h......@<.-.E3.u...}..Q..D........"z...f.a........=G..b'...lD.......c'...&`<..E......J..62z.....R......@.o.D...m...}.y..%....6..a..p...'.....?....o.c!...b=.h...3.....e?{0.'.........60...nb....@..I.B..d%...c?.Y.FW.f.Z..@c?y....e....fA..h...f...l.._m..3.6#..g.1........2O......%'.4.8...)?y...

C:\Users\user\AppData\Local\Temp\aut536D.tmp

Process:	C:\Users\user\AppData\Local\directory\name.exe
File Type:	data
Category:	dropped
Size (bytes):	435094
Entropy (8bit):	7.988688030415207
Encrypted:	false
SSDEEP:	6144:AB8QymyCNA026bs/OG+skFxZObHmJwlx8edLelM0gDskRO79BDUk15J0nfIxag:c8jXXms/O7FrOykbLf0gDXc79BokWwL
MD5:	3B359F0E0BB258EC851BDF1D17A9F448
SHA1:	9F1D46562F12D11C70DFC7215A4862E5A7D6B876
SHA-256:	4552D49989780CC2EBBF5CC50454ECE310078ECE1B67A2D9A496DB3F4C00E585
SHA-512:	DD2153A6961846F237CA2234410D98936728864F1E3508D77E8546B990F97BBE50E0A182FF2E9C7ABC5BA9DB6BFD08D6A5F574F41BF4C7E95A7BA0D0B2FFD79A
Malicious:	false
Preview:	EA06........ZM.iM..j.~O..L..h3..&.Q.S..y.(.d....i..I.....g..4.sD.....l..w..`X...E+..i3y..X..%U.}^.=.L....j....T..[.K.6y.2g..K..c...dy9L>Y.A~y..an.B.Y../go.v..........\|..d...~.O.$.B%.>.'.......R....z6...H+.)..O....y..W...X......Fj.JV..l.....7.>.K3..F[-.......%q..a5j.......u...f....9...i} ...@...x...Q...-^.&.K)s...mH.K.SZX..,.......Fq......e..5...V@W....h.).....Nr.0.............>.E...S.l.S.ut...y.`....8.I.:.......zd..d.Q.ed.d.S......j.Rj6.]JQ".N).t.B.R'4Yh.i<............up.B.l..j5....d.Q..~......$S`.Fz.2..3.U8.d....~........Y..my.E).Y..F.Kj......w..&4ip.Y.......sz..'......L..m....s2.S......J..m`.$j............G..\&.)..9....9.C~.Pl._..9..kq.Tes.F.U...u&...~47.u[s...+.i....X(.k.&M...a.ZL?....h..C..g..M..A.S.~yQ.....\.....2<P.LY.........24P.L\o.......21..LRq......C..Z..k..io....... .j.F...j....k......R[6.l.P.]...=y..o..f.....?..ZM...9.l%1I....R..........TZe&.B...;..:.E.}..,o........U2C...&..-.wN.}+...;~....9.Ig..'=..8...X..i.

C:\Users\user\AppData\Local\Temp\aut53CC.tmp

Process:	C:\Users\user\AppData\Local\directory\name.exe
File Type:	data
Category:	dropped
Size (bytes):	16506
Entropy (8bit):	7.575140850617736
Encrypted:	false
SSDEEP:	384:T0fPw2X19Oc+FtDTRuqsvHUddjObP7P9kJ0UXPT3kdxzsAvRZp:TSwy/MFBBsv6djObPBkOiPCxQGV
MD5:	64C0A461DAEA97226D05D1A92A219D77
SHA1:	42E64F7F89BB396A969F35FE8E8446E184D9E97A
SHA-256:	A797284C52DC19C38B2A640294F221C0225FEF47FD194DACE17A966055615054
SHA-512:	6297133A731F0AD60CDF1F2E74B40FA2A51A8D987096B924023627AD7A6268B34352E827BD99952FBDA1932A25E3E882106704F52DF7481EFBD192ABAFCC9910
Malicious:	false
Preview:	EA06...".L&.J..q4..........O.8....'VP..X..>I..'....?nd.%......;...\|.p...p.[.X..?.....l....1.r.....'.4...' ..h...od.).. +.$....6.....<.....Q.....0.o.l.Q......P.o.f...................<.,.......f@e_........~.@.o.Fl...X.y.....g..9.....[....Ic.....?.y....4...,..?.H<...U......@.o..c......g...l..c...8..@.>...G.H.....D}.0(...d.q...l\|.P(...h........Q...........l`Q..D......... J_......-......@./.p.E.....6@./.;..[..9}.....1......._hw...d...C.... eG.......`....n..!..}..vP&.;............."l....X@...C?.a....&... OW..6.J....?.K(Q..[0....&._. 4W.9....&._.$.%#.H...f._.hK......M.`..)..W.m4....E...9..W.Z#...M..?../.py....~.0..."."..M.3.......".......6.....n.....y.i..7.."...+...<.u.........60...h......@<.-.E3.u...}..Q..D........"z...f.a........=G..b'...lD.......c'...&`<..E......J..62z.....R......@.o.D...m...}.y..%....6..a..p...'.....?....o.c!...b=.h...3.....e?{0.'.........60...nb....@..I.B..d%...c?.Y.FW.f.Z..@c?y....e....fA..h...f...l.._m..3.6#..g.1........2O......%'.4.8...)?y...

C:\Users\user\AppData\Local\Temp\aut589D.tmp

Process:	C:\Users\user\AppData\Local\directory\name.exe
File Type:	data
Category:	dropped
Size (bytes):	435094
Entropy (8bit):	7.988688030415207
Encrypted:	false
SSDEEP:	6144:AB8QymyCNA026bs/OG+skFxZObHmJwlx8edLelM0gDskRO79BDUk15J0nfIxag:c8jXXms/O7FrOykbLf0gDXc79BokWwL
MD5:	3B359F0E0BB258EC851BDF1D17A9F448
SHA1:	9F1D46562F12D11C70DFC7215A4862E5A7D6B876
SHA-256:	4552D49989780CC2EBBF5CC50454ECE310078ECE1B67A2D9A496DB3F4C00E585
SHA-512:	DD2153A6961846F237CA2234410D98936728864F1E3508D77E8546B990F97BBE50E0A182FF2E9C7ABC5BA9DB6BFD08D6A5F574F41BF4C7E95A7BA0D0B2FFD79A
Malicious:	false
Preview:	EA06........ZM.iM..j.~O..L..h3..&.Q.S..y.(.d....i..I.....g..4.sD.....l..w..`X...E+..i3y..X..%U.}^.=.L....j....T..[.K.6y.2g..K..c...dy9L>Y.A~y..an.B.Y../go.v..........\|..d...~.O.$.B%.>.'.......R....z6...H+.)..O....y..W...X......Fj.JV..l.....7.>.K3..F[-.......%q..a5j.......u...f....9...i} ...@...x...Q...-^.&.K)s...mH.K.SZX..,.......Fq......e..5...V@W....h.).....Nr.0.............>.E...S.l.S.ut...y.`....8.I.:.......zd..d.Q.ed.d.S......j.Rj6.]JQ".N).t.B.R'4Yh.i<............up.B.l..j5....d.Q..~......$S`.Fz.2..3.U8.d....~........Y..my.E).Y..F.Kj......w..&4ip.Y.......sz..'......L..m....s2.S......J..m`.$j............G..\&.)..9....9.C~.Pl._..9..kq.Tes.F.U...u&...~47.u[s...+.i....X(.k.&M...a.ZL?....h..C..g..M..A.S.~yQ.....\.....2<P.LY.........24P.L\o.......21..LRq......C..Z..k..io....... .j.F...j....k......R[6.l.P.]...=y..o..f.....?..ZM...9.l%1I....R..........TZe&.B...;..:.E.}..,o........U2C...&..-.wN.}+...;~....9.Ig..'=..8...X..i.

C:\Users\user\AppData\Local\Temp\aut58FC.tmp

Process:	C:\Users\user\AppData\Local\directory\name.exe
File Type:	data
Category:	dropped
Size (bytes):	16506
Entropy (8bit):	7.575140850617736
Encrypted:	false
SSDEEP:	384:T0fPw2X19Oc+FtDTRuqsvHUddjObP7P9kJ0UXPT3kdxzsAvRZp:TSwy/MFBBsv6djObPBkOiPCxQGV
MD5:	64C0A461DAEA97226D05D1A92A219D77
SHA1:	42E64F7F89BB396A969F35FE8E8446E184D9E97A
SHA-256:	A797284C52DC19C38B2A640294F221C0225FEF47FD194DACE17A966055615054
SHA-512:	6297133A731F0AD60CDF1F2E74B40FA2A51A8D987096B924023627AD7A6268B34352E827BD99952FBDA1932A25E3E882106704F52DF7481EFBD192ABAFCC9910
Malicious:	false
Preview:	EA06...".L&.J..q4..........O.8....'VP..X..>I..'....?nd.%......;...\|.p...p.[.X..?.....l....1.r.....'.4...' ..h...od.).. +.$....6.....<.....Q.....0.o.l.Q......P.o.f...................<.,.......f@e_........~.@.o.Fl...X.y.....g..9.....[....Ic.....?.y....4...,..?.H<...U......@.o..c......g...l..c...8..@.>...G.H.....D}.0(...d.q...l\|.P(...h........Q...........l`Q..D......... J_......-......@./.p.E.....6@./.;..[..9}.....1......._hw...d...C.... eG.......`....n..!..}..vP&.;............."l....X@...C?.a....&... OW..6.J....?.K(Q..[0....&._. 4W.9....&._.$.%#.H...f._.hK......M.`..)..W.m4....E...9..W.Z#...M..?../.py....~.0..."."..M.3.......".......6.....n.....y.i..7.."...+...<.u.........60...h......@<.-.E3.u...}..Q..D........"z...f.a........=G..b'...lD.......c'...&`<..E......J..62z.....R......@.o.D...m...}.y..%....6..a..p...'.....?....o.c!...b=.h...3.....e?{0.'.........60...nb....@..I.B..d%...c?.Y.FW.f.Z..@c?y....e....fA..h...f...l.._m..3.6#..g.1........2O......%'.4.8...)?y...

C:\Users\user\AppData\Local\Temp\aut8A2C.tmp

Process:	C:\Users\user\AppData\Local\directory\name.exe
File Type:	data
Category:	dropped
Size (bytes):	435094
Entropy (8bit):	7.988688030415207
Encrypted:	false
SSDEEP:	6144:AB8QymyCNA026bs/OG+skFxZObHmJwlx8edLelM0gDskRO79BDUk15J0nfIxag:c8jXXms/O7FrOykbLf0gDXc79BokWwL
MD5:	3B359F0E0BB258EC851BDF1D17A9F448
SHA1:	9F1D46562F12D11C70DFC7215A4862E5A7D6B876
SHA-256:	4552D49989780CC2EBBF5CC50454ECE310078ECE1B67A2D9A496DB3F4C00E585
SHA-512:	DD2153A6961846F237CA2234410D98936728864F1E3508D77E8546B990F97BBE50E0A182FF2E9C7ABC5BA9DB6BFD08D6A5F574F41BF4C7E95A7BA0D0B2FFD79A
Malicious:	false
Preview:	EA06........ZM.iM..j.~O..L..h3..&.Q.S..y.(.d....i..I.....g..4.sD.....l..w..`X...E+..i3y..X..%U.}^.=.L....j....T..[.K.6y.2g..K..c...dy9L>Y.A~y..an.B.Y../go.v..........\|..d...~.O.$.B%.>.'.......R....z6...H+.)..O....y..W...X......Fj.JV..l.....7.>.K3..F[-.......%q..a5j.......u...f....9...i} ...@...x...Q...-^.&.K)s...mH.K.SZX..,.......Fq......e..5...V@W....h.).....Nr.0.............>.E...S.l.S.ut...y.`....8.I.:.......zd..d.Q.ed.d.S......j.Rj6.]JQ".N).t.B.R'4Yh.i<............up.B.l..j5....d.Q..~......$S`.Fz.2..3.U8.d....~........Y..my.E).Y..F.Kj......w..&4ip.Y.......sz..'......L..m....s2.S......J..m`.$j............G..\&.)..9....9.C~.Pl._..9..kq.Tes.F.U...u&...~47.u[s...+.i....X(.k.&M...a.ZL?....h..C..g..M..A.S.~yQ.....\.....2<P.LY.........24P.L\o.......21..LRq......C..Z..k..io....... .j.F...j....k......R[6.l.P.]...=y..o..f.....?..ZM...9.l%1I....R..........TZe&.B...;..:.E.}..,o........U2C...&..-.wN.}+...;~....9.Ig..'=..8...X..i.

C:\Users\user\AppData\Local\Temp\aut8A9B.tmp

Process:	C:\Users\user\AppData\Local\directory\name.exe
File Type:	data
Category:	dropped
Size (bytes):	16506
Entropy (8bit):	7.575140850617736
Encrypted:	false
SSDEEP:	384:T0fPw2X19Oc+FtDTRuqsvHUddjObP7P9kJ0UXPT3kdxzsAvRZp:TSwy/MFBBsv6djObPBkOiPCxQGV
MD5:	64C0A461DAEA97226D05D1A92A219D77
SHA1:	42E64F7F89BB396A969F35FE8E8446E184D9E97A
SHA-256:	A797284C52DC19C38B2A640294F221C0225FEF47FD194DACE17A966055615054
SHA-512:	6297133A731F0AD60CDF1F2E74B40FA2A51A8D987096B924023627AD7A6268B34352E827BD99952FBDA1932A25E3E882106704F52DF7481EFBD192ABAFCC9910
Malicious:	false
Preview:	EA06...".L&.J..q4..........O.8....'VP..X..>I..'....?nd.%......;...\|.p...p.[.X..?.....l....1.r.....'.4...' ..h...od.).. +.$....6.....<.....Q.....0.o.l.Q......P.o.f...................<.,.......f@e_........~.@.o.Fl...X.y.....g..9.....[....Ic.....?.y....4...,..?.H<...U......@.o..c......g...l..c...8..@.>...G.H.....D}.0(...d.q...l\|.P(...h........Q...........l`Q..D......... J_......-......@./.p.E.....6@./.;..[..9}.....1......._hw...d...C.... eG.......`....n..!..}..vP&.;............."l....X@...C?.a....&... OW..6.J....?.K(Q..[0....&._. 4W.9....&._.$.%#.H...f._.hK......M.`..)..W.m4....E...9..W.Z#...M..?../.py....~.0..."."..M.3.......".......6.....n.....y.i..7.."...+...<.u.........60...h......@<.-.E3.u...}..Q..D........"z...f.a........=G..b'...lD.......c'...&`<..E......J..62z.....R......@.o.D...m...}.y..%....6..a..p...'.....?....o.c!...b=.h...3.....e?{0.'.........60...nb....@..I.B..d%...c?.Y.FW.f.Z..@c?y....e....fA..h...f...l.._m..3.6#..g.1........2O......%'.4.8...)?y...

C:\Users\user\AppData\Local\Temp\intemeration

Process:	C:\Users\user\Desktop\jv4ri.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	258082
Entropy (8bit):	2.7962903456826793
Encrypted:	false
SSDEEP:	192:L9tu9P9lt9yJ969wa9dY9109cV9csqm0CpY+XzEa69FIoQKM5CfdeQVL3xAnonwU:6
MD5:	853BE9124B51E48F5D850A835321CE11
SHA1:	27873A837151FB53B7656C34A565745B84E38342
SHA-256:	BB2A93BD61D6F95E4C9F0D4129D38633270DF2128C57B97F5406655861030D0B
SHA-512:	192D1B16B630BA3237F19F5BAD187304B035C2C5C07AF9DB05C7F4DF763121D8B682A732D8728068DD92BD3D6BEF2ED98C8C3EFFFD0CFC87126894108E1B23FD
Malicious:	false
Preview:	6044B18406044B184x6044B18456044B18456044B18486044B184b6044B184e6044B184c6044B18486044B18416044B184e6044B184c6044B184c6044B184c6044B18406044B18426044B18406044B18406044B18406044B18406044B18456044B18466044B18456044B18476044B184b6044B18486044B18466044B184b6044B18406044B18406044B18406044B18406044B18406044B18406044B18466044B18466044B18486044B18496044B18446044B18456044B18486044B18446044B184b6044B18496044B18466044B18456044B18406044B18406044B18406044B18406044B18406044B18406044B18466044B18466044B18486044B18496044B18446044B184d6044B18486044B18466044B184b6044B184a6044B18476044B18426044B18406044B18406044B18406044B18406044B18406044B18406044B18466044B18466044B18486044B18496044B18456044B18456044B18486044B18486044B184b6044B18486044B18466044B184e6044B18406044B18406044B18406044B18406044B18406044B18406044B18466044B18466044B18486044B18496044B18446044B18456044B18486044B184a6044B184b6044B18496044B18466044B18456044B18406044B18406044B18406044B18406044B18406044B18406044B18466044B18466044B18486044B18496044B18446

C:\Users\user\AppData\Local\directory\name.exe

Process:	C:\Users\user\Desktop\jv4ri.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	826368
Entropy (8bit):	7.981854223673753
Encrypted:	false
SSDEEP:	24576:4BXu9HGaVHUVeaBzcvMgTvk+39ABn8ApTZl:4w9VHUVebvjT19ABfp
MD5:	B17E1003BB9BBE58E090C7752447C016
SHA1:	A159B486E535469D4C49B227D27608F2AD48288E
SHA-256:	D24D76D03365122AA5A4A7828A2D14368066DA840AE8945CF595A6B17CECA700
SHA-512:	05077E35558E1BB636596D7A8C6B66F9554ECF8E057F61C3CF7F4AF91C19F898943A5DC8B1F13914B231E09671A36631E2490E0B32799250537A375DAD83AF3A
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r...........#.S..._@'.S...R.k.S....".S...RichR...................PE..L....B.f.........."......p...@...P.......`........@.......................................@...@.......@.....................P...$.......P/..................t...........................................H...........................................UPX0.....P..............................UPX1.....p...`...d..................@....rsrc....@.......4...h..............@..............................................................................................................................................................................................................................................................................................................................................................3.91.UPX!....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs

Process:	C:\Users\user\AppData\Local\directory\name.exe
File Type:	data
Category:	dropped
Size (bytes):	270
Entropy (8bit):	3.4297698362729916
Encrypted:	false
SSDEEP:	6:DMM8lfm3OOQdUfclo5ZsUEZ+lX1Al1AE6nriIM8lfQVn:DsO+vNlzQ1A1z4mA2n
MD5:	3DA73F5D6073C0D8F7B9CEE8DF5035A7
SHA1:	D4B44315FD7C6171A9CC03899A00E593AE78CDE7
SHA-256:	1F2D7E91D96B7DA16BC230D9C519E5E0A6A78FCD6B3468E590D5A97239BB420B
SHA-512:	CE2041AA9AAFE863C44296E4ED58BA207E4849584AB057B93354F10679DC1BFAE50241EEDAD74DCC4D7AF6C8ADC3A97E4581F56E5E71955651D52BA866ED763B
Malicious:	true
Preview:	S.e.t. .W.s.h.S.h.e.l.l. .=. .C.r.e.a.t.e.O.b.j.e.c.t.(.".W.S.c.r.i.p.t...S.h.e.l.l.".)...W.s.h.S.h.e.l.l...R.u.n. .".C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.d.i.r.e.c.t.o.r.y.\.n.a.m.e...e.x.e.".,. .1...S.e.t. .W.s.h.S.h.e.l.l. .=. .N.o.t.h.i.n.g...

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.422217525488068
Encrypted:	false
SSDEEP:	6144:qSvfpi6ceLP/9skLmb0OTyWSPHaJG8nAgeMZMMhA2fX4WABlEnNA0uhiTw:ZvloTyW+EZMM6DFyi03w
MD5:	6D7CE8FBEAC1B888D888F048C600DC5D
SHA1:	66E56F156A2559F2F892759CEB5DC148382ADC69
SHA-256:	7E992D367C1D79D96182878744E97B956374EA9BA8C2FFC1E35DCF52536B32B0
SHA-512:	4C294A1A1BCAEF20144E8CDEF28CF49CA2D445DA536551C6D3E494BEC3BA4AC797B5E21AA81773E2BDC4400B0C2C77809903C943FA3B625035319D267CCAA5E3
Malicious:	false
Preview:	regf?...?....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Entropy (8bit):	7.981854223673753
TrID:	Win32 Executable (generic) a (10002005/4) 99.39% UPX compressed Win32 Executable (30571/9) 0.30% Win32 EXE Yoda's Crypter (26571/9) 0.26% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	jv4ri.exe
File size:	826'368 bytes
MD5:	b17e1003bb9bbe58e090c7752447c016
SHA1:	a159b486e535469d4c49b227d27608f2ad48288e
SHA256:	d24d76d03365122aa5a4a7828a2d14368066da840ae8945cf595a6b17ceca700
SHA512:	05077e35558e1bb636596d7a8c6b66f9554ecf8e057f61c3cf7f4af91c19f898943a5dc8b1f13914b231e09671a36631e2490e0b32799250537a375dad83af3a
SSDEEP:	24576:4BXu9HGaVHUVeaBzcvMgTvk+39ABn8ApTZl:4w9VHUVebvjT19ABfp
TLSH:	3A0523D23EEA671BD4E042BADC53A530781B40E583F73B8D944FDAD2B96BBC0A851074
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

File Icon


Icon Hash:	0f0dcc9a8acc490f

Static PE Info

General

Entrypoint:	0x54c0b0
Entrypoint Section:	UPX1
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66DA42F5 [Thu Sep 5 23:47:01 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	fc6683d30d9f25244a50fd5357825e79

Entrypoint Preview

Instruction
pushad
mov esi, 004F6000h
lea edi, dword ptr [esi-000F5000h]
push edi
jmp 00007F9FD47BE70Dh
nop
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
add ebx, ebx
jne 00007F9FD47BE709h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F9FD47BE6EFh
mov eax, 00000001h
add ebx, ebx
jne 00007F9FD47BE709h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
add ebx, ebx
jnc 00007F9FD47BE70Dh
jne 00007F9FD47BE72Ah
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F9FD47BE721h
dec eax
add ebx, ebx
jne 00007F9FD47BE709h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
jmp 00007F9FD47BE6D6h
add ebx, ebx
jne 00007F9FD47BE709h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
jmp 00007F9FD47BE754h
xor ecx, ecx
sub eax, 03h
jc 00007F9FD47BE713h
shl eax, 08h
mov al, byte ptr [esi]
inc esi
xor eax, FFFFFFFFh
je 00007F9FD47BE777h
sar eax, 1
mov ebp, eax
jmp 00007F9FD47BE70Dh
add ebx, ebx
jne 00007F9FD47BE709h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F9FD47BE6CEh
inc ecx
add ebx, ebx
jne 00007F9FD47BE709h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F9FD47BE6C0h
add ebx, ebx
jne 00007F9FD47BE709h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jnc 00007F9FD47BE6F1h
jne 00007F9FD47BE70Bh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007F9FD47BE6E6h
add ecx, 02h
cmp ebp, FFFFFB00h
adc ecx, 02h
lea edx, dword ptr [edi+ebp]
cmp ebp, FFFFFFFCh
jbe 00007F9FD47BE710h
mov al, byte ptr [edx]

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD5 build 40629
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1bff50	0x424	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x14d000	0x72f50	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1c0374	0xc	.rsrc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x14c294	0x48	UPX1
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0xf5000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0xf6000	0x57000	0x56400	5fcb5e9dc3fafe6169a6239ed7042f67	False	0.9873188405797102	data	7.935611316659627	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x14d000	0x74000	0x73400	9e6c7904014ead3ac19cf87555242024	False	0.9930708547993492	data	7.993884705816442	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x14d45c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0x14d588	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0x14d6b4	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0x14d7e0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	Great Britain	0.26011560693641617
RT_MENU	0xc8d38	0x50	empty	English	Great Britain	0
RT_STRING	0xc8d88	0x594	empty	English	Great Britain	0
RT_STRING	0xc931c	0x68a	empty	English	Great Britain	0
RT_STRING	0xc99a8	0x490	empty	English	Great Britain	0
RT_STRING	0xc9e38	0x5fc	empty	English	Great Britain	0
RT_STRING	0xca434	0x65c	empty	English	Great Britain	0
RT_STRING	0xcaa90	0x466	empty	English	Great Britain	0
RT_STRING	0xcaef8	0x158	empty	English	Great Britain	0
RT_RCDATA	0x14dd4c	0x71cd0	data			1.0003239453540658
RT_GROUP_ICON	0x1bfa20	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x1bfa38	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x1bfa50	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x1bfa68	0x14	data	English	Great Britain	1.25
RT_VERSION	0x1bfa80	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x1bfb60	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
KERNEL32.DLL	LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
ADVAPI32.dll	GetAce
COMCTL32.dll	ImageList_Remove
COMDLG32.dll	GetOpenFileNameW
GDI32.dll	LineTo
IPHLPAPI.DLL	IcmpSendEcho
MPR.dll	WNetUseConnectionW
ole32.dll	CoGetObject
OLEAUT32.dll	VariantInit
PSAPI.DLL	GetProcessMemoryInfo
SHELL32.dll	DragFinish
USER32.dll	GetDC
USERENV.dll	LoadUserProfileW
UxTheme.dll	IsThemeActive
VERSION.dll	VerQueryValueW
WININET.dll	FtpOpenFileW
WINMM.dll	timeGetTime
WSOCK32.dll	connect

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-06T21:56:59.201852+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49704	45.95.169.104	2404	TCP
2024-09-06T21:57:23.529980+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49721	45.95.169.104	2404	TCP
2024-09-06T21:57:23.529980+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49722	45.95.169.104	2404	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 6, 2024 21:56:58.460700989 CEST	49704	2404	192.168.2.5	45.95.169.104
Sep 6, 2024 21:56:58.465568066 CEST	2404	49704	45.95.169.104	192.168.2.5
Sep 6, 2024 21:56:58.465643883 CEST	49704	2404	192.168.2.5	45.95.169.104
Sep 6, 2024 21:56:58.477237940 CEST	49704	2404	192.168.2.5	45.95.169.104
Sep 6, 2024 21:56:58.482157946 CEST	2404	49704	45.95.169.104	192.168.2.5
Sep 6, 2024 21:56:59.157486916 CEST	2404	49704	45.95.169.104	192.168.2.5
Sep 6, 2024 21:56:59.201852083 CEST	49704	2404	192.168.2.5	45.95.169.104
Sep 6, 2024 21:56:59.311888933 CEST	2404	49704	45.95.169.104	192.168.2.5
Sep 6, 2024 21:56:59.316292048 CEST	49704	2404	192.168.2.5	45.95.169.104
Sep 6, 2024 21:56:59.321089029 CEST	2404	49704	45.95.169.104	192.168.2.5
Sep 6, 2024 21:56:59.321161985 CEST	49704	2404	192.168.2.5	45.95.169.104
Sep 6, 2024 21:56:59.326046944 CEST	2404	49704	45.95.169.104	192.168.2.5
Sep 6, 2024 21:57:00.001950026 CEST	2404	49704	45.95.169.104	192.168.2.5
Sep 6, 2024 21:57:00.003623962 CEST	49704	2404	192.168.2.5	45.95.169.104
Sep 6, 2024 21:57:00.008390903 CEST	2404	49704	45.95.169.104	192.168.2.5
Sep 6, 2024 21:57:00.155252934 CEST	2404	49704	45.95.169.104	192.168.2.5
Sep 6, 2024 21:57:00.201827049 CEST	49704	2404	192.168.2.5	45.95.169.104
Sep 6, 2024 21:57:22.795455933 CEST	49721	2404	192.168.2.5	45.95.169.104
Sep 6, 2024 21:57:22.798368931 CEST	49722	2404	192.168.2.5	45.95.169.104
Sep 6, 2024 21:57:22.800288916 CEST	2404	49721	45.95.169.104	192.168.2.5
Sep 6, 2024 21:57:22.800352097 CEST	49721	2404	192.168.2.5	45.95.169.104
Sep 6, 2024 21:57:22.803178072 CEST	2404	49722	45.95.169.104	192.168.2.5
Sep 6, 2024 21:57:22.803235054 CEST	49722	2404	192.168.2.5	45.95.169.104
Sep 6, 2024 21:57:22.804219961 CEST	49721	2404	192.168.2.5	45.95.169.104
Sep 6, 2024 21:57:22.807635069 CEST	49722	2404	192.168.2.5	45.95.169.104
Sep 6, 2024 21:57:22.809112072 CEST	2404	49721	45.95.169.104	192.168.2.5
Sep 6, 2024 21:57:22.812450886 CEST	2404	49722	45.95.169.104	192.168.2.5
Sep 6, 2024 21:57:23.474173069 CEST	2404	49722	45.95.169.104	192.168.2.5
Sep 6, 2024 21:57:23.477284908 CEST	2404	49721	45.95.169.104	192.168.2.5
Sep 6, 2024 21:57:23.529979944 CEST	49721	2404	192.168.2.5	45.95.169.104
Sep 6, 2024 21:57:23.529979944 CEST	49722	2404	192.168.2.5	45.95.169.104
Sep 6, 2024 21:57:23.620095015 CEST	2404	49722	45.95.169.104	192.168.2.5
Sep 6, 2024 21:57:23.622539997 CEST	2404	49721	45.95.169.104	192.168.2.5
Sep 6, 2024 21:57:23.670605898 CEST	49722	2404	192.168.2.5	45.95.169.104
Sep 6, 2024 21:57:23.670624018 CEST	49721	2404	192.168.2.5	45.95.169.104
Sep 6, 2024 21:57:27.905349016 CEST	49704	2404	192.168.2.5	45.95.169.104
Sep 6, 2024 21:57:27.905464888 CEST	49721	2404	192.168.2.5	45.95.169.104
Sep 6, 2024 21:57:27.905503035 CEST	49722	2404	192.168.2.5	45.95.169.104

Target ID:	0
Start time:	15:56:52
Start date:	06/09/2024
Path:	C:\Users\user\Desktop\jv4ri.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\jv4ri.exe"
Imagebase:	0xc70000
File size:	826'368 bytes
MD5 hash:	B17E1003BB9BBE58E090C7752447C016
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	15:56:54
Start date:	06/09/2024
Path:	C:\Users\user\AppData\Local\directory\name.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\jv4ri.exe"
Imagebase:	0x20000
File size:	826'368 bytes
MD5 hash:	B17E1003BB9BBE58E090C7752447C016
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000002.00000002.2040296471.0000000003F80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000002.00000002.2040296471.0000000003F80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000002.00000002.2040296471.0000000003F80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000002.00000002.2040296471.0000000003F80000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000002.00000002.2040296471.0000000003F80000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000002.00000002.2040296471.0000000003F80000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	3
Start time:	15:56:55
Start date:	06/09/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\jv4ri.exe"
Imagebase:	0x170000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	15:56:55
Start date:	06/09/2024
Path:	C:\Users\user\AppData\Local\directory\name.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\directory\name.exe"
Imagebase:	0x20000
File size:	826'368 bytes
MD5 hash:	B17E1003BB9BBE58E090C7752447C016
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000004.00000002.2055858818.00000000036B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000002.2055858818.00000000036B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000004.00000002.2055858818.00000000036B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000004.00000002.2055858818.00000000036B0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000004.00000002.2055858818.00000000036B0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000004.00000002.2055858818.00000000036B0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Target ID:	5
Start time:	15:56:57
Start date:	06/09/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\directory\name.exe"
Imagebase:	0x170000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000005.00000002.2348733537.000000000522F000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000005.00000002.2347910354.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000005.00000002.2347910354.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000005.00000002.2347910354.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000005.00000002.2347910354.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000005.00000002.2347910354.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000005.00000002.2347910354.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000005.00000002.2348427875.0000000003400000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000005.00000002.2348445947.0000000003412000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	15:56:58
Start date:	06/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 736
Imagebase:	0xee0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	15:57:08
Start date:	06/09/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs"
Imagebase:	0x7ff75af90000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	15:57:08
Start date:	06/09/2024
Path:	C:\Users\user\AppData\Local\directory\name.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\directory\name.exe"
Imagebase:	0x20000
File size:	826'368 bytes
MD5 hash:	B17E1003BB9BBE58E090C7752447C016
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000B.00000002.2182098787.00000000036C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000B.00000002.2182098787.00000000036C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000B.00000002.2182098787.00000000036C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000B.00000002.2182098787.00000000036C0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000000B.00000002.2182098787.00000000036C0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 0000000B.00000002.2182098787.00000000036C0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Target ID:	12
Start time:	15:57:09
Start date:	06/09/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\directory\name.exe"
Imagebase:	0x170000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000C.00000002.2181376722.0000000003000000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000C.00000002.2181096608.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000C.00000002.2181096608.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000C.00000002.2181096608.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000C.00000002.2181096608.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000000C.00000002.2181096608.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 0000000C.00000002.2181096608.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	true

Target ID:	16
Start time:	15:57:21
Start date:	06/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 784
Imagebase:	0xee0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true