Windows Analysis Report
CustomPayload.exe

Overview

General Information

Sample name:	CustomPayload.exe
Analysis ID:	1508677
MD5:	0025bd5b725a83366b8fc30c6b5c65bf
SHA1:	484f6760a8e49df78b1cc3ce1f5620f193864f28
SHA256:	c5cfe951aae6cc74e6e8f1d9c33e15fd1b1bbb34066a10cec27fc62e81d86548
Infos:

Detection

Score:	3
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Classification

Signatures

Source: CustomPayload.exe

Static PE information: certificate valid

Source: CustomPayload.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: WC:\code\devops\devops\Tools\Installer\CustomPayload\obj\Release\net48\CustomPayload.pdb source: CustomPayload.exe, 00000000.00000002.2158633400.0000017DBB331000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Desktop\CustomPayload.pdb/ source: CustomPayload.exe, 00000000.00000002.2158266664.0000017DB96D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: WERAEE5.tmp.dmp.5.dr
Source:	Binary string: C:\code\devops\devops\Tools\Installer\CustomPayload\obj\Release\net48\CustomPayload.pdbSHA256 source: CustomPayload.exe
Source:	Binary string: System.ni.pdbRSDS source: WERAEE5.tmp.dmp.5.dr
Source:	Binary string: CustomPayload.pdb source: CustomPayload.exe, 00000000.00000002.2158633400.0000017DBB331000.00000004.00000800.00020000.00000000.sdmp, WERAEE5.tmp.dmp.5.dr
Source:	Binary string: +C:\Users\user\Desktop\CustomPayload.pdbh source: CustomPayload.exe, 00000000.00000002.2158633400.0000017DBB331000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WERAEE5.tmp.dmp.5.dr
Source:	Binary string: System.Core.pdb source: WERAEE5.tmp.dmp.5.dr
Source:	Binary string: C:\code\devops\devops\Tools\Installer\CustomPayload\obj\Release\net48\CustomPayload.pdb source: CustomPayload.exe
Source:	Binary string: System.pdb0 source: WERAEE5.tmp.dmp.5.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERAEE5.tmp.dmp.5.dr
Source:	Binary string: System.ni.pdb source: WERAEE5.tmp.dmp.5.dr
Source:	Binary string: System.pdb source: WERAEE5.tmp.dmp.5.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERAEE5.tmp.dmp.5.dr
Source:	Binary string: System.Core.ni.pdb source: WERAEE5.tmp.dmp.5.dr

Source: Amcache.hve.5.dr

String found in binary or memory: http://upx.sf.net

One or more processes crash

Source: C:\Users\user\Desktop\CustomPayload.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3796 -s 856

Source: classification engine

Classification label: clean3.winEXE@3/6@0/0

Source: C:\Users\user\Desktop\CustomPayload.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2404:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3796

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\5f6995d0-3cbb-4a83-ba98-08f4f88fddad

Jump to behavior

Source: CustomPayload.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: CustomPayload.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\CustomPayload.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\CustomPayload.exe

File read: C:\Users\user\Desktop\CustomPayload.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\CustomPayload.exe "C:\Users\user\Desktop\CustomPayload.exe"
Source: C:\Users\user\Desktop\CustomPayload.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\CustomPayload.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3796 -s 856

Source: C:\Users\user\Desktop\CustomPayload.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\CustomPayload.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CustomPayload.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\CustomPayload.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\CustomPayload.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\CustomPayload.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\CustomPayload.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\CustomPayload.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CustomPayload.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\CustomPayload.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: C:\Users\user\Desktop\CustomPayload.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\CustomPayload.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: CustomPayload.exe

Static PE information: certificate valid

Source: initial sample

Static PE information: Valid certificate with Microsoft Issuer

Source: CustomPayload.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: CustomPayload.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: CustomPayload.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: WC:\code\devops\devops\Tools\Installer\CustomPayload\obj\Release\net48\CustomPayload.pdb source: CustomPayload.exe, 00000000.00000002.2158633400.0000017DBB331000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Desktop\CustomPayload.pdb/ source: CustomPayload.exe, 00000000.00000002.2158266664.0000017DB96D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: WERAEE5.tmp.dmp.5.dr
Source:	Binary string: C:\code\devops\devops\Tools\Installer\CustomPayload\obj\Release\net48\CustomPayload.pdbSHA256 source: CustomPayload.exe
Source:	Binary string: System.ni.pdbRSDS source: WERAEE5.tmp.dmp.5.dr
Source:	Binary string: CustomPayload.pdb source: CustomPayload.exe, 00000000.00000002.2158633400.0000017DBB331000.00000004.00000800.00020000.00000000.sdmp, WERAEE5.tmp.dmp.5.dr
Source:	Binary string: +C:\Users\user\Desktop\CustomPayload.pdbh source: CustomPayload.exe, 00000000.00000002.2158633400.0000017DBB331000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WERAEE5.tmp.dmp.5.dr
Source:	Binary string: System.Core.pdb source: WERAEE5.tmp.dmp.5.dr
Source:	Binary string: C:\code\devops\devops\Tools\Installer\CustomPayload\obj\Release\net48\CustomPayload.pdb source: CustomPayload.exe
Source:	Binary string: System.pdb0 source: WERAEE5.tmp.dmp.5.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERAEE5.tmp.dmp.5.dr
Source:	Binary string: System.ni.pdb source: WERAEE5.tmp.dmp.5.dr
Source:	Binary string: System.pdb source: WERAEE5.tmp.dmp.5.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERAEE5.tmp.dmp.5.dr
Source:	Binary string: System.Core.ni.pdb source: WERAEE5.tmp.dmp.5.dr

Binary contains a suspicious time stamp

Source: CustomPayload.exe

Static PE information: 0xD06529FF [Wed Oct 16 07:53:35 2080 UTC]

Source: C:\Users\user\Desktop\CustomPayload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CustomPayload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CustomPayload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CustomPayload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CustomPayload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CustomPayload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CustomPayload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CustomPayload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CustomPayload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CustomPayload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CustomPayload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CustomPayload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CustomPayload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CustomPayload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CustomPayload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\Desktop\CustomPayload.exe	Memory allocated: 17DB98B0000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\CustomPayload.exe	Memory allocated: 17DD3330000 memory reserve \| memory write watch			Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\CustomPayload.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\CustomPayload.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\CustomPayload.exe

Memory allocated: page read and write | page guard

Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\CustomPayload.exe

Queries volume information: C:\Users\user\Desktop\CustomPayload.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\CustomPayload.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

ID:	1508677
Product:	CloudBasic
Start time:	15:36:47
Start date:	10.09.2024
Sample:	CustomPayload.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	0025bd5b725a83366b8fc30c6b5c65bf
SHA1:	484f6760a8e49df78b1cc3ce1f5620f193864f28
SHA256:	c5cfe951aae6cc74e6e8f1d9c33e15fd1b1bbb34066a10cec27fc62e81d86548
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_CustomPayload.ex_5035bc726e39bdc2f26a93f32e1c85a4add9d2_22e67bdd_eabe1e55-6226-428b-b477-e1d723350c71\Report.wer	Unicode text, UTF-16, little-endian text, with CRLF line terminators	F0D7978D46EA1D9427719AF1BC00EC0C	2677927ECFE3FB65593AC8BD244A41C952A9AB00	F1EFBCF283AD9F4F294985F1839708500F9531C1788A663F3ED7B21D0EC9CD5C
C:\ProgramData\Microsoft\Windows\WER\Temp\WERAEE5.tmp.dmp	Mini DuMP crash report, 16 streams, Tue Sep 10 13:37:39 2024, 0x1205a4 type	79EBDACFA40978AC549A1E9885B70C8F	0158A478F78BEAD366415B8DBB474A45049186C8	AF63885E117658A93D3EF35CF4D6E9EC65E30A434528F5FBD97F919699EEE352
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB09C.tmp.WERInternalMetadata.xml	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators	2142D8772EA46ACB334E44062275124D	B9B1B5C2F309226B8295D552130318FAF58E5E23	8E5EDE896800D9716BC3C528E950EDFF005FA88106F0E2396931C232957EB6E3
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB0CB.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	70270FB4FFC66E40496FAD1F6E9B2317	518E1489C266D8AF7FE45AEB2212CE38D47A2E46	F6CB7B4E4BD03DDB32B782A46FABF36DA5881841D7766979E52CACB758EF7B8C
C:\Windows\appcompat\Programs\Amcache.hve	MS Windows registry file, NT/2000 or above	59EF3AA34B0946AB2E2D26BB3AE6C87C	3515E1C5A09E3DAD629CF42ECD9D4315CACF0480	59062CDD5246C8E043033F5B1E37572E8B87063EE7B40145512098ABFAC32F1C
\Device\ConDrv	ASCII text, with CRLF, LF line terminators	346FD26346EB238D298C3217095504DC	00B6D23EE00276BDB94383712ECA1EDF080F1053	07D34AABB38F983B17B998B8943D1BB7C2590906901B9224490B891BB4E02F06

Windows Analysis Report
CustomPayload.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Screenshots

Behavior Graph

Network Map

Windows Analysis Report CustomPayload.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Screenshots

Behavior Graph

Network Map

Windows Analysis Report
CustomPayload.exe