Edit tour

Windows Analysis Report
Jaws.exe

Overview

General Information

Sample name:	Jaws.exe
Analysis ID:	1534241
MD5:	82a93f4476efbfee119eb6cec32b0e8d
SHA1:	447aa1e180bd5d26388bbdb699ecae2477d24162
SHA256:	2d42e49addb09860700c9862f7416ee6da56a06d5a8580bede68ae7dac28993a
Tags:	exeStealcstealeruser-kddx0178318
Infos:

Detection

Stealc

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Writes to foreign memory regions

Checks if the current process is being debugged

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Jaws.exe (PID: 5376 cmdline: "C:\Users\user\Desktop\Jaws.exe" MD5: 82A93F4476EFBFEE119EB6CEC32B0E8D)

BitLockerToGo.exe (PID: 4340 cmdline: "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe" MD5: A64BEAB5D4516BECA4C40B25DC0C1CD8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://45.66.248.237/9e6547173a597645.php", "Botnet": "s5"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.2522681012.0000000002990000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000001.00000002.2523138286.0000000002D87000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2306788327.0000000002A8E000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2306788327.0000000002A3A000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000001.00000002.2522728061.00000000029F2000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2306788327.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000001.00000002.2522728061.0000000002A2A000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: Jaws.exe PID: 5376	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 4340	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 4340	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
1.2.BitLockerToGo.exe.2990000.0.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.Jaws.exe.2be2000.6.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.Jaws.exe.2a3a000.5.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.Jaws.exe.2a3a000.5.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.Jaws.exe.2be2000.6.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
1.2.BitLockerToGo.exe.2990000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 1 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.2306788327.0000000002A3A000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: StealC {"C2 url": "http://45.66.248.237/9e6547173a597645.php", "Botnet": "s5"}

Multi AV Scanner detection for submitted file

Source: Jaws.exe

ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: Jaws.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Jaws.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: Jaws.exe, 00000000.00000002.2306788327.00000000029FE000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: Jaws.exe, 00000000.00000002.2306788327.00000000029FE000.00000004.00001000.00020000.00000000.sdmp

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://45.66.248.237/9e6547173a597645.php

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 45.66.248.237Connection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View

ASN Name: FREERANGECLOUDCA FREERANGECLOUDCA

Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.237
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.237
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.237
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.237
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.237

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 45.66.248.237Connection: Keep-AliveCache-Control: no-cache

Source: BitLockerToGo.exe, 00000001.00000002.2523138286.0000000002D87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.66.248.237
Source: BitLockerToGo.exe, 00000001.00000002.2523138286.0000000002D87000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.2523138286.0000000002DD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.66.248.237/
Source: BitLockerToGo.exe, 00000001.00000002.2523138286.0000000002DD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.66.248.237/;
Source: Jaws.exe, program.js.0.dr	String found in binary or memory: http://json-schema.org/draft-07/schema
Source: program.js.0.dr	String found in binary or memory: http://json-schema.org/draft-07/schema#
Source: Jaws.exe, program.js.0.dr	String found in binary or memory: http://json-schema.org/schema
Source: Jaws.exe	String found in binary or memory: https://GOMIPS64rva20u64rva22u64.satconv.signext00000000proto:
Source: Jaws.exe, program.js.0.dr	String found in binary or memory: https://aws.amazon.com
Source: Jaws.exe	String found in binary or memory: https://doi.org/GTB
Source: Jaws.exe, program.js.0.dr	String found in binary or memory: https://github.com/aws/jsii
Source: Jaws.exe, program.js.0.dr	String found in binary or memory: https://github.com/aws/jsii.git
Source: Jaws.exe, program.js.0.dr	String found in binary or memory: https://github.com/aws/jsii/issues
Source: program.js.0.dr	String found in binary or memory: https://github.com/jprichardson/node-fs-extra/issues/269
Source: program.js.0.dr	String found in binary or memory: https://raw.githubusercontent.com/ajv-validator/ajv/master/lib/refs/data.json#

Source: Jaws.exe, 00000000.00000002.2306788327.00000000029FE000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs Jaws.exe

Source: Jaws.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal92.troj.evad.winEXE@3/4@0/1

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_029A8680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

1_2_029A8680

Source: C:\Users\user\Desktop\Jaws.exe

File created: C:\Users\user\AppData\Local\Temp\jsii-runtime.656451430

Jump to behavior

Source: Jaws.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Jaws.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Jaws.exe

ReversingLabs: Detection: 55%

Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain
Source: Jaws.exe	String found in binary or memory: $github.com/mmcloughlin/addchain/meta
Source: Jaws.exe	String found in binary or memory: $descriptor.FileOptions_OptimizeMode$func(gob.encEngine) gob.encEngine$map.bucket[reflect.Type]gob.gobType$github.com/mmcloughlin/addchain/meta%struct { F uintptr; X0 *sync.Mutex }
Source: Jaws.exe	String found in binary or memory: &github.com/mmcloughlin/addchain/acc/ir
Source: Jaws.exe	String found in binary or memory: 'github.com/mmcloughlin/addchain/acc/ast
Source: Jaws.exe	String found in binary or memory: 'atomic.Pointer[encoding/gob.encEngine]'struct { F uintptr; X0 gob.typeInfo }'github.com/mmcloughlin/addchain/acc/ast(func(bisect.dedup, bisect.dedup) bool
Source: Jaws.exe	String found in binary or memory: (github.com/mmcloughlin/addchain/acc/pass
Source: Jaws.exe	String found in binary or memory: (descriptor.GeneratedCodeInfo_Annotation(github.com/mmcloughlin/addchain/acc/pass(struct { F uintptr; X0 int; X1 string })validateSetNetworkConfigurationParameters
Source: Jaws.exe	String found in binary or memory: .github.com/mmcloughlin/addchain/internal/print
Source: Jaws.exe	String found in binary or memory: .github.com/mmcloughlin/addchain/internal/print/*awsapprunner.jsiiProxy_CfnVpcIngressConnection/validateSetObservabilityConfigurationParameters
Source: Jaws.exe	String found in binary or memory: Cgithub.com/consensys/gnark-crypto/field/generator/internal/addchain
Source: Jaws.exe	String found in binary or memory: Span>protobuf:"varint,2,rep,packed,name=span" json:"span,omitempty"Cgithub.com/consensys/gnark-crypto/field/generator/internal/addchainCstruct { F uintptr; X0 gob.encOp; X1 *gob.encOp; X2 int; X3 int }
Source: Jaws.exe	String found in binary or memory: merge_operatormax_open_filesmem_table_sizebytes_per_syncmin_flush_rateGetSystemTimesresources/bin/resources/lib/fragment-startfragment-end %p: %02d/%02d
Source: Jaws.exe	String found in binary or memory: gogoproto.protosizergogoproto.customtypegogoproto.customnamegogoproto.wktpointerinvalid map key typeJavaOuterClassname: PhpGenericServices: invalid nil Durationmmcloughlin/addchainBSD 3-Clause LicenseMorocco Standard TimeNamibia Standard TimeAlaskan Standard TimeCentral Standard TimePacific Standard TimeEastern Standard TimeSE Asia Standard TimeArabian Standard TimeMagadan Standard TimeMyanmar Standard TimeYakutsk Standard TimeBelarus Standard TimeRussian Standard TimeRomance Standard TimeSaratov Standard TimeNorfolk Standard Timetime zone offset hourinstanceConfigurationInstanceConfigurationrepositoryDescriptionrepositoryCloneUrlGrcrepositoryCloneUrlSshBRANCH_OR_TAG_CREATEDBRANCH_OR_TAG_DELETEDBRANCH_OR_TAG_UPDATEDRepositoryDescriptionRepositoryCloneUrlGrcRepositoryCloneUrlSshrepositoryCatalogDataRepositoryCatalogDatatrace/breakpoint trapuser defined signal 1user defined signal 2link has been severedpackage not installedblock device requiredstate not recoverableread-only file systemstale NFS file handleReadDirectoryChangesWNetGetJoinInformationreflect.Value.ComplexWSALookupServiceNextAWSALookupServiceNextWWSARemoveServiceClassWSCUnInstallNameSpaceWSCWriteProviderOrderWSAAsyncGetHostByAddrWSAAsyncGetHostByNameWSAAsyncGetServByPortWSAAsyncGetServByNameWSACancelAsyncRequestWSAUnhookBlockingHookWSACancelBlockingCallSafeArrayUnaccessDataSysAllocStringByteLenQueryPathOfRegTypeLibVARIANT_UserUnmarshalLPSAFEARRAY_UnmarshalSafeArrayCreateVectorOleCreateFontIndirectSami (Southern) (sma)Tajik (Cyrillic) (tg)Arabic Jordan (ar-JO)Arabic Kuwait (ar-KW)Arabic U.a.e. (ar-AE)Breton France (br-FR)Catalan Spain (ca-ES)Dutch Belgium (nl-BE)English India (en-IN)French Canada (fr-CA)French France (fr-FR)Fulah Nigeria (ff-NG)Hebrew Israel (he-IL)Irish Ireland (ga-IE)Italian Italy (it-IT)Kannada India (kn-IN)Maltese Malta (mt-MT)Marathi India (mr-IN)Polish Poland (pl-PL)Punjabi India (pa-IN)Quechua Peru (quz-PE)Sakha Russia (sah-RU)Spanish Chile (es-CL)Spanish Spain (es-ES)Syriac Syria (syr-SY)Thai Thailand (th-TH)Wolof Senegal (wo-SN)unsupported operationnegative shift amountsystem goroutine waitconcurrent map writes/gc/heap/allocs:bytesruntime: work.nwait= previous allocCount=, levelBits[level] = runtime: searchIdx = runtime: mappedReady=runtime: totalMapped=defer on system stackpanic on system stackasync stack too largestartm: m is spinningstartlockedm: m has pfindrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime: newstack at runtime: newstack sp=runtime: confused by pcHeader.textStart= timer data corruptionfeature not supportedhttp: invalid patternPrecondition RequiredInternal Server Errorkey is not comparableafter top-level valuein string escape codeunknown ABI part kind of unexported methodunexpected value stepreflect.Value.SetZeroreflect.Value.Pointerreflect.Value.SetUint186264514923095703125931322574615478515625X25519Kyber768Draft00policyValidationBeta1aws-cdk-lib.CfnOutputconstraintDescriptionadministrationRoleArnregiste
Source: Jaws.exe	String found in binary or memory: bootstrap type already present: attrObservabilityConfigurationArnAttrObservabilityConfigurationArntoo large block number: bitlen %dbytes.Buffer.Grow: negative countaws-cdk-lib.aws_ecr.CfnRepositoryaws-cdk-lib.aws_ecr.LifecycleRuleaws-cdk-lib.aws_ecr.TagMutabilityrelease of handle with refcount 0crypto/aes: output not full blockbytes.Reader.Seek: invalid whencetoo many levels of symbolic linksInitializeProcThreadAttributeListImage base beyond allowed addressThunk AddressOfData beyond limitsCentral Kurdish Iraq (ku-Arab-IQ)Norwegian (Bokmal) Norway (nb-NO)could not find signer certificateinvalid VS_VERSION_INFO block. %ssync: RUnlock of unlocked RWMutexslice bounds out of range [%x:%y]runtime: memory allocated by OS [misrounded allocation in sysAllocconcurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert short slice passed to readGCStatsruntime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: goroutine stack exceeds runtime: text offset out of rangetimer period must be non-negativetoo many concurrent timer firingsruntime: name offset out of rangeruntime: type offset out of rangeapplication/x-www-form-urlencodedhttp: multiple registrations for reflect: slice index out of rangereflect: NumOut of non-func type of method on nil interface valuereflect: Field index out of rangereflect: array index out of rangereflect.Value.Equal: invalid Kind to pointer to array with length 142108547152020037174224853515625710542735760100185871124267578125aws-cdk-lib.CfnHookDefaultVersionaws-cdk-lib.CfnModuleVersionPropsaws-cdk-lib.CfnTrafficRoutingTypeaws-cdk-lib.CfnWaitConditionPropsaws-cdk-lib.GetContextValueResultaws-cdk-lib.IFragmentConcatenatoraws-cdk-lib.IStableNumberProduceraws-cdk-lib.IStableStringProduceraws-cdk-lib.SizeConversionOptionsaws-cdk-lib.StageSynthesisOptionsaws-cdk-lib.TimeConversionOptionsrlp: non-canonical integer formatcan't Reset derived EncoderBufferaws-cdk-lib.aws_events.CfnArchiveaws-cdk-lib.aws_events.Connectionaws-cdk-lib.aws_events.EventFieldaws-cdk-lib.aws_events.HttpMethodattrPermissionsBoundaryUsageCountaws-cdk-lib.aws_iam.CfnRolePolicyaws-cdk-lib.aws_iam.CfnUserPolicyaws-cdk-lib.aws_iam.ManagedPolicyaws-cdk-lib.aws_iam.PrincipalBaseaws-cdk-lib.aws_iam.SamlPrincipalaws-cdk-lib.aws_iam.StarPrincipalaws-cdk-lib.aws_iam.CfnGroupPropsAttrPermissionsBoundaryUsageCountaws-cdk-lib.aws_iam.ISamlProvideraws-cdk-lib.aws_iam.LazyRolePropsaws-cdk-lib.aws_kms.CfnReplicaKeyaws-cdk-lib.aws_kms.CfnAliasPropsFloat.GobDecode: buffer too smallCryptAcquireCertificatePrivateKeyGetVolumeNameForVolumeMountPointWSetupDiGetDeviceRegistryPropert
Source: Jaws.exe	String found in binary or memory: bootstrap type already present: attrObservabilityConfigurationArnAttrObservabilityConfigurationArntoo large block number: bitlen %dbytes.Buffer.Grow: negative countaws-cdk-lib.aws_ecr.CfnRepositoryaws-cdk-lib.aws_ecr.LifecycleRuleaws-cdk-lib.aws_ecr.TagMutabilityrelease of handle with refcount 0crypto/aes: output not full blockbytes.Reader.Seek: invalid whencetoo many levels of symbolic linksInitializeProcThreadAttributeListImage base beyond allowed addressThunk AddressOfData beyond limitsCentral Kurdish Iraq (ku-Arab-IQ)Norwegian (Bokmal) Norway (nb-NO)could not find signer certificateinvalid VS_VERSION_INFO block. %ssync: RUnlock of unlocked RWMutexslice bounds out of range [%x:%y]runtime: memory allocated by OS [misrounded allocation in sysAllocconcurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert short slice passed to readGCStatsruntime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: goroutine stack exceeds runtime: text offset out of rangetimer period must be non-negativetoo many concurrent timer firingsruntime: name offset out of rangeruntime: type offset out of rangeapplication/x-www-form-urlencodedhttp: multiple registrations for reflect: slice index out of rangereflect: NumOut of non-func type of method on nil interface valuereflect: Field index out of rangereflect: array index out of rangereflect.Value.Equal: invalid Kind to pointer to array with length 142108547152020037174224853515625710542735760100185871124267578125aws-cdk-lib.CfnHookDefaultVersionaws-cdk-lib.CfnModuleVersionPropsaws-cdk-lib.CfnTrafficRoutingTypeaws-cdk-lib.CfnWaitConditionPropsaws-cdk-lib.GetContextValueResultaws-cdk-lib.IFragmentConcatenatoraws-cdk-lib.IStableNumberProduceraws-cdk-lib.IStableStringProduceraws-cdk-lib.SizeConversionOptionsaws-cdk-lib.StageSynthesisOptionsaws-cdk-lib.TimeConversionOptionsrlp: non-canonical integer formatcan't Reset derived EncoderBufferaws-cdk-lib.aws_events.CfnArchiveaws-cdk-lib.aws_events.Connectionaws-cdk-lib.aws_events.EventFieldaws-cdk-lib.aws_events.HttpMethodattrPermissionsBoundaryUsageCountaws-cdk-lib.aws_iam.CfnRolePolicyaws-cdk-lib.aws_iam.CfnUserPolicyaws-cdk-lib.aws_iam.ManagedPolicyaws-cdk-lib.aws_iam.PrincipalBaseaws-cdk-lib.aws_iam.SamlPrincipalaws-cdk-lib.aws_iam.StarPrincipalaws-cdk-lib.aws_iam.CfnGroupPropsAttrPermissionsBoundaryUsageCountaws-cdk-lib.aws_iam.ISamlProvideraws-cdk-lib.aws_iam.LazyRolePropsaws-cdk-lib.aws_kms.CfnReplicaKeyaws-cdk-lib.aws_kms.CfnAliasPropsFloat.GobDecode: buffer too smallCryptAcquireCertificatePrivateKeyGetVolumeNameForVolumeMountPointWSetupDiGetDeviceRegistryPropert
Source: Jaws.exe	String found in binary or memory: pebble/table: %d: unknown merger %spebble: invalid call to virtualLast%d extra bits on block, should be 0can only encode up to 64K sequenceszero matchoff and matchlen (%d) > 0proto: internal error: bad wiretypeduration: %#v: seconds out of rangebad type for XXX_extensions field: protobuf tag field not an integer: cockroach.errorspb.EncodedErrorLeaftruncated input (or invalid offset)file %q has a name conflict over %vfound wrong type: got %v, want enumvarint,62022,opt,name=enum_stringervarint,63017,opt,name=marshaler_allgogoproto.goproto_enum_stringer_allvarint,64004,opt,name=verbose_equaldelimiters may only be "{}" or "<>"string field contains invalid UTF-8%v already implements proto.Messagegoogle.protobuf.FieldOptions_JSTypegoogle.protobuf.FileDescriptorProtogoogle.protobuf.EnumDescriptorProtogoogle.protobuf.UninterpretedOption&descriptor.ServiceDescriptorProto{\A[_\pL][_\pL\p{Nd}]*(\.\.\.\|\?)?\zTime.UnmarshalBinary: invalid lengthattrAutoScalingConfigurationRevisionaws-cdk-lib.aws_apprunner.CfnServiceAttrAutoScalingConfigurationRevisionlocale not found when calling %s: %vcrypto/cipher: input not full blocksbytes: Repeat output length overflowbytes.Reader.ReadAt: negative offsetbytes.Reader.Seek: negative positionaccessing a corrupted shared libraryfailure to read data directories: %vfail to read section relocations: %vfail to read string table length: %vstrings.Builder.Grow: negative countstrings: Join output length overflowThunk Address Of Data too spread outPower PC with floating point supportCherokee United States (chr-Cher-US)Chinese (Traditional) Taiwan (zh-TW)English United Arab Emirates (en-AE)lfstack node allocated from the heap) is larger than maximum page size (key size not a multiple of key alignruntime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescruntime: inconsistent write deadlineUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime: mcall called on m->g0 stackstartm: P required for spinning=true) is not Grunnable or Gscanrunnable
Source: Jaws.exe	String found in binary or memory: pebble/table: %d: unknown merger %spebble: invalid call to virtualLast%d extra bits on block, should be 0can only encode up to 64K sequenceszero matchoff and matchlen (%d) > 0proto: internal error: bad wiretypeduration: %#v: seconds out of rangebad type for XXX_extensions field: protobuf tag field not an integer: cockroach.errorspb.EncodedErrorLeaftruncated input (or invalid offset)file %q has a name conflict over %vfound wrong type: got %v, want enumvarint,62022,opt,name=enum_stringervarint,63017,opt,name=marshaler_allgogoproto.goproto_enum_stringer_allvarint,64004,opt,name=verbose_equaldelimiters may only be "{}" or "<>"string field contains invalid UTF-8%v already implements proto.Messagegoogle.protobuf.FieldOptions_JSTypegoogle.protobuf.FileDescriptorProtogoogle.protobuf.EnumDescriptorProtogoogle.protobuf.UninterpretedOption&descriptor.ServiceDescriptorProto{\A[_\pL][_\pL\p{Nd}]*(\.\.\.\|\?)?\zTime.UnmarshalBinary: invalid lengthattrAutoScalingConfigurationRevisionaws-cdk-lib.aws_apprunner.CfnServiceAttrAutoScalingConfigurationRevisionlocale not found when calling %s: %vcrypto/cipher: input not full blocksbytes: Repeat output length overflowbytes.Reader.ReadAt: negative offsetbytes.Reader.Seek: negative positionaccessing a corrupted shared libraryfailure to read data directories: %vfail to read section relocations: %vfail to read string table length: %vstrings.Builder.Grow: negative countstrings: Join output length overflowThunk Address Of Data too spread outPower PC with floating point supportCherokee United States (chr-Cher-US)Chinese (Traditional) Taiwan (zh-TW)English United Arab Emirates (en-AE)lfstack node allocated from the heap) is larger than maximum page size (key size not a multiple of key alignruntime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescruntime: inconsistent write deadlineUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime: mcall called on m->g0 stackstartm: P required for spinning=true) is not Grunnable or Gscanrunnable
Source: Jaws.exe	String found in binary or memory: Memory allocated from the heap that is reserved for stack space, whether or not it is currently in-use. Currently, this represents all stack memory for goroutines. It also includes all OS thread stacks in non-cgo programs. Note that stacks may be allocated differently in the future, and this may change.Distribution of individual non-GC-related stop-the-world pause latencies. This is the time from deciding to stop the world until the world is started again. Some of this time is spent getting all threads to stop (measured directly in /sched/pauses/stopping/other:seconds). Bucket counts increase monotonically.Distribution of individual GC-related stop-the-world stopping latencies. This is the time it takes from deciding to stop the world until all Ps are stopped. This is a subset of the total GC-related stop-the-world time (/sched/pauses/total/gc:seconds). During this time, some threads may be executing. Bucket counts increase monotonically.You have encountered an unexpected error.
Source: Jaws.exe	String found in binary or memory: Memory allocated from the heap that is reserved for stack space, whether or not it is currently in-use. Currently, this represents all stack memory for goroutines. It also includes all OS thread stacks in non-cgo programs. Note that stacks may be allocated differently in the future, and this may change.Distribution of individual non-GC-related stop-the-world pause latencies. This is the time from deciding to stop the world until the world is started again. Some of this time is spent getting all threads to stop (measured directly in /sched/pauses/stopping/other:seconds). Bucket counts increase monotonically.Distribution of individual GC-related stop-the-world stopping latencies. This is the time it takes from deciding to stop the world until all Ps are stopped. This is a subset of the total GC-related stop-the-world time (/sched/pauses/total/gc:seconds). During this time, some threads may be executing. Bucket counts increase monotonically.You have encountered an unexpected error.
Source: Jaws.exe	String found in binary or memory: Distribution of individual non-GC-related stop-the-world stopping latencies. This is the time it takes from deciding to stop the world until all Ps are stopped. This is a subset of the total non-GC-related stop-the-world time (/sched/pauses/total/other:seconds). During this time, some threads may be executing. Bucket counts increase monotonically.GC cycle the last time the GC CPU limiter was enabled. This metric is useful for diagnosing the root cause of an out-of-memory error, because the limiter trades memory for CPU time when the GC's CPU time gets too high. This is most likely to occur with use of SetMemoryLimit. The first GC cycle is cycle 1, so a value of 0 indicates that it was never enabled.Distribution of individual GC-related stop-the-world pause latencies. This is the time from deciding to stop the world until the world is started again. Some of this time is spent getting all threads to stop (this is measured directly in /sched/pauses/stopping/gc:seconds), during which some threads may still be running. Bucket counts increase monotonically.Estimated total CPU time spent performing GC tasks on spare CPU resources that the Go scheduler could not otherwise find a use for. This should be subtracted from the total GC CPU time to obtain a measure of compulsory GC CPU time. This metric is an overestimate, and not directly comparable to system CPU time measurements. Compare only with other /cpu/classes metrics.Estimated total available CPU time for user Go code or the Go runtime, as defined by GOMAXPROCS. In other words, GOMAXPROCS integrated over the wall-clock duration this process has been executing for. This metric is an overestimate, and not directly comparable to system CPU time measurements. Compare only with other /cpu/classes metrics. Sum of all metrics in /cpu/classes.Stack memory allocated by the underlying operating system. In non-cgo programs this metric is currently zero. This may change in the future.In cgo programs this metric includes OS thread stacks allocated directly from the OS. Currently, this only accounts for one stack in c-shared and c-archive build modes, and other sources of stacks from the OS are not measured. This too may change in the future.Estimated total CPU time spent with the application paused by the GC. Even if only one thread is running during the pause, this is computed as GOMAXPROCS times the pause latency because nothing else can be executing. This is the exact sum of samples in /sched/pauses/total/gc:seconds if each sample is multiplied by GOMAXPROCS at the time it is taken. This metric is an overestimate, and not directly comparable to system CPU time measurements. Compare only with other /cpu/classes metrics.----AdlmAfakAghbAhomArabAranArmiArmnAvstBaliBamuBassBatkBengBhksBlisBopoBrahBraiBugiBuhdCakmCansCariChamCherChrsCirtCoptCpmnCprtCyrlCyrsDevaDiakDogrDsrtDuplEgydEgyhEgypElbaElymEthiGeokGeorGlagGongGonmGothGranGrekGujrGuruHanbHangHaniHanoHansHantHatrHebrHiraHluwHmngHmnpHrktHungIndsItalJamoJavaJpanJ
Source: Jaws.exe	String found in binary or memory: Distribution of individual non-GC-related stop-the-world stopping latencies. This is the time it takes from deciding to stop the world until all Ps are stopped. This is a subset of the total non-GC-related stop-the-world time (/sched/pauses/total/other:seconds). During this time, some threads may be executing. Bucket counts increase monotonically.GC cycle the last time the GC CPU limiter was enabled. This metric is useful for diagnosing the root cause of an out-of-memory error, because the limiter trades memory for CPU time when the GC's CPU time gets too high. This is most likely to occur with use of SetMemoryLimit. The first GC cycle is cycle 1, so a value of 0 indicates that it was never enabled.Distribution of individual GC-related stop-the-world pause latencies. This is the time from deciding to stop the world until the world is started again. Some of this time is spent getting all threads to stop (this is measured directly in /sched/pauses/stopping/gc:seconds), during which some threads may still be running. Bucket counts increase monotonically.Estimated total CPU time spent performing GC tasks on spare CPU resources that the Go scheduler could not otherwise find a use for. This should be subtracted from the total GC CPU time to obtain a measure of compulsory GC CPU time. This metric is an overestimate, and not directly comparable to system CPU time measurements. Compare only with other /cpu/classes metrics.Estimated total available CPU time for user Go code or the Go runtime, as defined by GOMAXPROCS. In other words, GOMAXPROCS integrated over the wall-clock duration this process has been executing for. This metric is an overestimate, and not directly comparable to system CPU time measurements. Compare only with other /cpu/classes metrics. Sum of all metrics in /cpu/classes.Stack memory allocated by the underlying operating system. In non-cgo programs this metric is currently zero. This may change in the future.In cgo programs this metric includes OS thread stacks allocated directly from the OS. Currently, this only accounts for one stack in c-shared and c-archive build modes, and other sources of stacks from the OS are not measured. This too may change in the future.Estimated total CPU time spent with the application paused by the GC. Even if only one thread is running during the pause, this is computed as GOMAXPROCS times the pause latency because nothing else can be executing. This is the exact sum of samples in /sched/pauses/total/gc:seconds if each sample is multiplied by GOMAXPROCS at the time it is taken. This metric is an overestimate, and not directly comparable to system CPU time measurements. Compare only with other /cpu/classes metrics.----AdlmAfakAghbAhomArabAranArmiArmnAvstBaliBamuBassBatkBengBhksBlisBopoBrahBraiBugiBuhdCakmCansCariChamCherChrsCirtCoptCpmnCprtCyrlCyrsDevaDiakDogrDsrtDuplEgydEgyhEgypElbaElymEthiGeokGeorGlagGongGonmGothGranGrekGujrGuruHanbHangHaniHanoHansHantHatrHebrHiraHluwHmngHmnpHrktHungIndsItalJamoJavaJpanJ
Source: Jaws.exe	String found in binary or memory: depgithub.com/hashicorp/hc-installv0.9.0h1:2dIk8LcvANwtv3QZLckxcjyF5w8KVtiMxu6G6eLhghE=
Source: Jaws.exe	String found in binary or memory: depgithub.com/mmcloughlin/addchainv0.4.0h1:SobOdjm2xLj1KkXN5/n0xTIWyZA2+s99UCY1iPfkHRY=
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/bigint.Equal
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/bigint.EqualInt64
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/bigint.Pow2
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/bigint.One
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/bigint.Mask
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/bigint.Ones
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/bigints.Contains
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/bigints.Index
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.Chain.Clone
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/bigints.Clone
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Chain).AppendClone
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/bigint.Clone
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.Chain.End
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.Chain.Ops
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.Chain.Op
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.Chain.Program
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/bigint.Zero
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.Chain.Validate
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.Chain.Produces
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.Chain.Superset
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.Chain.IsAscending
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.Op.IsDouble
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.Op.Operands
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.Op.Uses
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Program).Shift
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Program).Double
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Program).Add
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.Program.boundscheck
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.Program.Doubles
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.Program.Count
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.Program.Adds
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.Program.Evaluate
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.New
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.Program.ReadCounts
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.Program.Dependencies
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Chain).Clone
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Chain).End
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Chain).IsAscending
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Chain).Op
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Chain).Ops
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Chain).Produces
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Chain).Program
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Chain).Superset
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Chain).Validate
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Op).IsDouble
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Op).Operands
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Op).Uses
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Program).Adds
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Program).Count
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Program).Dependencies
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Program).Doubles
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Program).Evaluate
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain.(*Program).ReadCounts
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.(*Program).AddInstruction
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.Program.Output
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.Program.Clone
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.Instruction.Clone
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.Operand.Clone
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.Program.String
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.Operand.String
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.Instruction.Operands
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.Instruction.String
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.Add.Inputs
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.Add.Clone
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.Add.String
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.Double.Inputs
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.Double.Clone
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.Double.String
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.Shift.Inputs
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.Shift.Clone
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.Shift.String
Source: Jaws.exe	String found in binary or memory: type:.eq.github.com/mmcloughlin/addchain/acc/ir.Operand
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.(*Operand).Clone
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.(*Operand).String
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.(*Instruction).Clone
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.(*Instruction).Operands
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.(*Instruction).String
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.(*Program).Clone
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.(*Program).Output
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.(*Program).String
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.(*Add).Clone
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.(*Add).Inputs
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.(*Add).String
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.(*Double).Clone
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.(*Double).Inputs
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.(*Double).String
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.(*Shift).Clone
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.(*Shift).Inputs
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ir.(*Shift).String
Source: Jaws.exe	String found in binary or memory: type:.eq.github.com/mmcloughlin/addchain/acc/ir.Instruction
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/errutil.AssertionFailure
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/print.(*Printer).Linef
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/print.(*Printer).NL
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/print.(*Printer).Printf
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/print.(*Printer).SetError
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/print.NewTabWriter
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/print.New
Source: Jaws.exe	String found in binary or memory: type:.eq.github.com/mmcloughlin/addchain/internal/print.Printer
Source: Jaws.exe	String found in binary or memory: type:.eq.github.com/mmcloughlin/addchain/internal/print.TabWriter
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ast.Identifier.Precedence
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/ast.(*Identifier).Precedence
Source: Jaws.exe	String found in binary or memory: type:.eq.github.com/mmcloughlin/addchain/acc/ast.Statement
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/pass.init
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/pass.NameBinaryValues
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/pass.NameOperands
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/pass.NameBinaryRuns
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/pass.init.NameBinaryRuns.NameOperands.func4
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/pass.init.NameBinaryRuns.func2
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/pass.init.NameBinaryValues.NameOperands.func3
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/pass.init.NameBinaryValues.func1
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/pass.Compile
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/errutil.UnexpectedType
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/pass.Eval
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/pass.Func.Execute
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/pass.Exec
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/pass.Concat
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/pass.Exec.Concat.func1
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/pass.CanonicalizeOperands
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/acc/pass.(*Func).Execute
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/bigvector.init
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/meta.init
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/meta.(*Properties).CheckCitable
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/meta.(*Properties).IsRelease
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/meta.(*Properties).WriteCitation
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/meta.(*Properties).ReleaseTime
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/meta.(*Properties).Title
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/meta.(*Properties).WriteCitation.func2
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/meta.(*Properties).WriteCitation.func1
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/meta.(*Properties).RepositoryURL
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/meta.(*Properties).Module
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/meta.(*Properties).DOIURL
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/meta.doiurl
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/print.(*TabWriter).Flush
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/internal/print.(*Printer).Error
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/meta.(*Properties).Citation
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/meta.(*Properties).ReleaseTag
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/meta.(*Properties).ReleaseURL
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain/meta.(*Properties).ConceptDOIURL
Source: Jaws.exe	String found in binary or memory: type:.eq.github.com/mmcloughlin/addchain/meta.Properties
Source: Jaws.exe	String found in binary or memory: net/addrselect.go
Source: Jaws.exe	String found in binary or memory: github.com/aws/jsii-runtime-go@v1.103.1/internal/kernel/load.go
Source: Jaws.exe	String found in binary or memory: github.com/decred/dcrd/dcrec/secp256k1/v4@v4.0.1/loadprecomputed.go
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain@v0.4.0/internal/bigint/bigint.go
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain@v0.4.0/internal/bigints/bigints.go
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain@v0.4.0/chain.go
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain@v0.4.0/program.go
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain@v0.4.0/acc/ir/ir.go
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain@v0.4.0/internal/errutil/errutil.go
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain@v0.4.0/internal/print/printer.go
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain@v0.4.0/acc/ast/ast.go
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain@v0.4.0/acc/pass/naming.go
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain@v0.4.0/acc/pass/eval.go
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain@v0.4.0/acc/pass/pass.go
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain@v0.4.0/internal/bigvector/bigvector.go
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain@v0.4.0/meta/meta.go
Source: Jaws.exe	String found in binary or memory: github.com/mmcloughlin/addchain@v0.4.0/meta/cite.go
Source: Jaws.exe	String found in binary or memory: github.com/saferwall/pe@v1.5.4/loadconfig.go

Source: C:\Users\user\Desktop\Jaws.exe

File read: C:\Users\user\Desktop\Jaws.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Jaws.exe "C:\Users\user\Desktop\Jaws.exe"
Source: C:\Users\user\Desktop\Jaws.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Source: C:\Users\user\Desktop\Jaws.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Jaws.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\Jaws.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Jaws.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Jaws.exe

Static file information: File size 24606720 > 1048576

Source: Jaws.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x97f200
Source: Jaws.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0xd08000

Source: Jaws.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: Jaws.exe, 00000000.00000002.2306788327.00000000029FE000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: Jaws.exe, 00000000.00000002.2306788327.00000000029FE000.00000004.00001000.00020000.00000000.sdmp

Source: Jaws.exe

Static PE information: section name: .symtab

Source: C:\Users\user\Desktop\Jaws.exe	Code function: 0_3_02C88853 push esi; ret		0_3_02C88857
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_029AB035 push ecx; ret		1_2_029AB048

Source: C:\Users\user\Desktop\Jaws.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_029A7ED0 GetSystemInfo,

1_2_029A7ED0

Source: BitLockerToGo.exe, 00000001.00000002.2523138286.0000000002D87000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwaredl
Source: BitLockerToGo.exe, 00000001.00000002.2523138286.0000000002DE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: BitLockerToGo.exe, 00000001.00000002.2523138286.0000000002D87000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: BitLockerToGo.exe, 00000001.00000002.2523138286.0000000002DB3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: Jaws.exe, 00000000.00000002.2302285658.0000000000A4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_029945C0 VirtualProtect ?,00000004,00000100,00000000

1_2_029945C0

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_029A9750 mov eax, dword ptr fs:[00000030h]

1_2_029A9750

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: Jaws.exe PID: 5376, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 4340, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\Jaws.exe

Memory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2990000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Jaws.exe

Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2990000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Jaws.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 67E008	Jump to behavior
Source: C:\Users\user\Desktop\Jaws.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2990000	Jump to behavior
Source: C:\Users\user\Desktop\Jaws.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2991000	Jump to behavior
Source: C:\Users\user\Desktop\Jaws.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 29AE000	Jump to behavior
Source: C:\Users\user\Desktop\Jaws.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 29BB000	Jump to behavior
Source: C:\Users\user\Desktop\Jaws.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2BEC000	Jump to behavior

Source: C:\Users\user\Desktop\Jaws.exe

Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: GetLocaleInfoA,

1_2_029A7B90

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\Jaws.exe	Queries volume information: C:\Users\user\Desktop\Jaws.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Jaws.exe	Queries volume information: C:\Windows VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Jaws.exe	Queries volume information: C:\Windows\AppReadiness VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Jaws.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Jaws.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Jaws.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_029A7850 GetUserNameA,

1_2_029A7850

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_029A7A30 GetTimeZoneInformation,

1_2_029A7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 1.2.BitLockerToGo.exe.2990000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Jaws.exe.2be2000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Jaws.exe.2a3a000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Jaws.exe.2a3a000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Jaws.exe.2be2000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.BitLockerToGo.exe.2990000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2522681012.0000000002990000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2523138286.0000000002D87000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2306788327.0000000002A8E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2306788327.0000000002A3A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2522728061.00000000029F2000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2306788327.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2522728061.0000000002A2A000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 4340, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 1.2.BitLockerToGo.exe.2990000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Jaws.exe.2be2000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Jaws.exe.2a3a000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Jaws.exe.2a3a000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Jaws.exe.2be2000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.BitLockerToGo.exe.2990000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2522681012.0000000002990000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2523138286.0000000002D87000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2306788327.0000000002A8E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2306788327.0000000002A3A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2522728061.00000000029F2000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2306788327.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2522728061.0000000002A2A000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 4340, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	311 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Disable or Modify Tools	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	311 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	32 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Jaws.exe	55%	ReversingLabs	Win32.Spyware.Stealc

Domains and IPs

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://45.66.248.237/9e6547173a597645.php	true		unknown
http://45.66.248.237/	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://doi.org/GTB	Jaws.exe	false	unknown
http://45.66.248.237	BitLockerToGo.exe, 00000001.00000002.2523138286.0000000002D87000.00000004.00000020.00020000.00000000.sdmp	true	unknown
https://GOMIPS64rva20u64rva22u64.satconv.signext00000000proto:	Jaws.exe	false	unknown
https://github.com/aws/jsii.git	Jaws.exe, program.js.0.dr	false	unknown
https://github.com/aws/jsii	Jaws.exe, program.js.0.dr	false	unknown
http://json-schema.org/draft-07/schema#	program.js.0.dr	false	unknown
https://aws.amazon.com	Jaws.exe, program.js.0.dr	false	unknown
http://json-schema.org/schema	Jaws.exe, program.js.0.dr	false	unknown
http://45.66.248.237/;	BitLockerToGo.exe, 00000001.00000002.2523138286.0000000002DD5000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://github.com/aws/jsii/issues	Jaws.exe, program.js.0.dr	false	unknown
https://github.com/jprichardson/node-fs-extra/issues/269	program.js.0.dr	false	unknown
https://raw.githubusercontent.com/ajv-validator/ajv/master/lib/refs/data.json#	program.js.0.dr	false	unknown
http://json-schema.org/draft-07/schema	Jaws.exe, program.js.0.dr	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.66.248.237	unknown	Russian Federation		53356	FREERANGECLOUDCA	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1534241
Start date and time:	2024-10-15 18:14:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Jaws.exe
Detection:	MAL
Classification:	mal92.troj.evad.winEXE@3/4@0/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 99% Number of executed functions: 25 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Jaws.exe, PID 5376 because there are no executed function
VT rate limit hit for: Jaws.exe

Created / dropped Files

C:\Users\user\AppData\Local\Temp\jsii-runtime.656451430\bin\jsii-runtime.js

Download File

Process:	C:\Users\user\Desktop\Jaws.exe
File Type:	C++ source, ASCII text, with very long lines (324), with escape sequences
Category:	dropped
Size (bytes):	138639
Entropy (8bit):	4.286369825068587
Encrypted:	false
SSDEEP:	1536:ZMjsdRCCXpnzopj7/5dLopnQPporDa6meL4xmJ:fenLo9QP+lmeL4IJ
MD5:	A7C8367F8B900617374F5D3FAC86DFD7
SHA1:	6BDEAB34FA632083B2578708EB0C50443ED5E9A9
SHA-256:	E4F82DB7579D84B2DDB49B16A8CBD8256D86751473D1A86B4B31D1E3963BA0FA
SHA-512:	2C2E9D5445F4BDFBCA7F35881E9D133373145B40D26ECB9B122E60DD343B580FA3BC70C8B981B4AE7E3D9B8C4EA90C6A77F7328A60CBE0F2515EE364AD0CB0A3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	var __webpack_modules__ = {. 821: (module, __unused_webpack_exports, __webpack_require__) => {. "use strict";. module = __webpack_require__.nmd(module);. const wrapAnsi16 = (fn, offset) => (...args) => {. const code = fn(...args);. return `.[${code + offset}m`;. };. const wrapAnsi256 = (fn, offset) => (...args) => {. const code = fn(...args);. return `.[${38 + offset};5;${code}m`;. };. const wrapAnsi16m = (fn, offset) => (...args) => {. const rgb = fn(...args);. return `.[${38 + offset};2;${rgb[0]};${rgb[1]};${rgb[2]}m`;. };. const ansi2ansi = n => n;. const rgb2rgb = (r, g, b) => [ r, g, b ];. const setLazyProperty = (object, property, get) => {. Object.defineProperty(object, property, {. get: () => {. const value = get();. Object.defineProperty(object, property, {.

C:\Users\user\AppData\Local\Temp\jsii-runtime.656451430\bin\jsii-runtime.js.map

Download File

Process:	C:\Users\user\Desktop\Jaws.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	218125
Entropy (8bit):	5.457704584855637
Encrypted:	false
SSDEEP:	3072:zKHyW445CPl85X3GJXlAnFhvMvOqGPUqdShdY5S8DoDT1JyBwJbMaky9nwe+L/Iq:LWY4KTvqd8dYQ8uJcwSy9nQ
MD5:	0FEFBA04D8BBEDD2CFF7EB75C3834847
SHA1:	054D11200D77C1B5DFB3B98A33973623619D34BE
SHA-256:	DBBDB23093B0732EE1504F79D3835B1C6B2E3F526AB42A6DA381E6CEC2648AE5
SHA-512:	3CEAA01275E2DEC044BA5F8D41092EB4F28E62CDAD24A71C8F7F57E4C48B709568C8C376BF2B048DC989810FB8EB91F2D944379804D5D85480A26663FC3F90FE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	{"version":3,"file":"bin/jsii-runtime.js","mappings":";;;;QAEA,MAAMA,aAAa,CAACC,IAAIC,WAAW,IAAIC;YACtC,MAAMC,OAAOH,MAAME;YACnB,OAAO,KAAUC,OAAOF;AAAS;QAGlC,MAAMG,cAAc,CAACJ,IAAIC,WAAW,IAAIC;YACvC,MAAMC,OAAOH,MAAME;YACnB,OAAO,KAAU,KAAKD,YAAYE;AAAO;QAG1C,MAAME,cAAc,CAACL,IAAIC,WAAW,IAAIC;YACvC,MAAMI,MAAMN,MAAME;YAClB,OAAO,KAAU,KAAKD,YAAYK,IAAI,MAAMA,IAAI,MAAMA,IAAI;AAAK;QAGhE,MAAMC,YAAYC,KAAKA;QACvB,MAAMC,UAAU,CAACC,GAAGC,GAAGC,MAAM,EAACF,GAAGC,GAAGC;QAEpC,MAAMC,kBAAkB,CAACC,QAAQC,UAAUC;YAC1CC,OAAOC,eAAeJ,QAAQC,UAAU;gBACvCC,KAAK;oBACJ,MAAMG,QAAQH;oBAEdC,OAAOC,eAAeJ,QAAQC,UAAU;wBACvCI;wBACAC,YAAY;wBACZC,cAAc;;oBAGf,OAAOF;AAAK;gBAEbC,YAAY;gBACZC,cAAc;;AACb;QAIH,IAAIC;QACJ,MAAMC,oBAAoB,CAACC,MAAMC,aAAaC,UAAUC;YACvD,IAAIL,iBAAiBM,WAAW;gBAC/BN,eAAe,oBAAQ;AACxB;YAEA,MAAMrB,SAAS0B,eAAe,KAAK;YACnC,MAAME,SAAS,CAAC;YAEhB,KAAK,OAAOC,aAAaC,UAAUd,OAAOe,QAAQV,eAAe;gBAChE,MAAMW,OAAOH,gBAAgB,WAAW,SAASA;gBACjD,IAAIA,gBAAgBL,aAAa;oBAChCI,OAAOI,QAAQT,KAAKE,UAAUzB;AAC/B,uBAAO,WAAW8B,UAAU,UAAU;oBACrCF,OAAOI,Q

C:\Users\user\AppData\Local\Temp\jsii-runtime.656451430\lib\program.js

Download File

Process:	C:\Users\user\Desktop\Jaws.exe
File Type:	ASCII text, with very long lines (489)
Category:	dropped
Size (bytes):	802466
Entropy (8bit):	4.298722687837962
Encrypted:	false
SSDEEP:	6144:Z6TjefxOXTNwk8mCkCbCp4wrZaWvZEIhU4FFEY+cbCtNYbIgoxrV2z1J:Z6TjefxOXTNUkCbCp42aW4NwL
MD5:	4C6E1287B2F6060C1E0F386B0B47959A
SHA1:	0FA0C721B6848D78C73FCF74BB37891A17FF0999
SHA-256:	C8DB5A41C7EC02EB2F1F20A6CD544DB215246AD9D566EA9494D63521B9B1E271
SHA-512:	0FF6A037A413BE93DCB3C1B4C26CB9938025F34D9AA20818FBDED5B4B00BC89DCBA9EB58756BAFBA852CA972C058BDDB087E9CB58C9B442AC936C93590E14C13
Malicious:	false
Reputation:	low
Preview:	var __webpack_modules__ = {. 1165: (module, __unused_webpack_exports, __webpack_require__) => {. "use strict";. const fs = __webpack_require__(9896);. const path = __webpack_require__(6928);. const LCHOWN = fs.lchown ? "lchown" : "chown";. const LCHOWNSYNC = fs.lchownSync ? "lchownSync" : "chownSync";. const needEISDIRHandled = fs.lchown && !process.version.match(/v1[1-9]+\./) && !process.version.match(/v10\.[6-9]/);. const lchownSync = (path, uid, gid) => {. try {. return fs[LCHOWNSYNC](path, uid, gid);. } catch (er) {. if (er.code !== "ENOENT") throw er;. }. };. const chownSync = (path, uid, gid) => {. try {. return fs.chownSync(path, uid, gid);. } catch (er) {. if (er.code !== "ENOENT") throw er;. }. };. const handleEISDIR = needEISDIRHandled ? (path, uid, gid, cb) => er => {.

C:\Users\user\AppData\Local\Temp\jsii-runtime.656451430\lib\program.js.map

Download File

Process:	C:\Users\user\Desktop\Jaws.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1155588
Entropy (8bit):	5.4159552687244155
Encrypted:	false
SSDEEP:	12288:D2DUMiOfGYFO/1pf0ThVUhI2PoEMuCfzT/2ZoEC74RiCfulDlJ:MZFO/1pf9hI2EjT/2ZoEC74RiCfulDlJ
MD5:	BE06DF1EE810220598CAE6D42AE2FD77
SHA1:	5DD0B0F101FDE69B49E37947380431D75D26125C
SHA-256:	09E18C6FA27068005DA8BCBB802C70B1C182866274478C684A4AB652ACAF2BBD
SHA-512:	BF40F52E37DFDBEE4AC4F562A28520893D3C8C13FDDB7A94E94458B1E8591162EADF3A4BE401A2FF6C2CE2449721F3F036C2B41571BB3C491E7F648595BAA8FA
Malicious:	false
Reputation:	low
Preview:	{"version":3,"file":"lib/program.js","mappings":";;;QACA,MAAMA,KAAK,oBAAQ;QACnB,MAAMC,OAAO,oBAAQ;QAGrB,MAAMC,SAASF,GAAGG,SAAS,WAAW;QAEtC,MAAMC,aAAaJ,GAAGK,aAAa,eAAe;QAGlD,MAAMC,oBAAoBN,GAAGG,WAC1BI,QAAQC,QAAQC,MAAM,kBACtBF,QAAQC,QAAQC,MAAM;QAEzB,MAAMJ,aAAa,CAACJ,MAAMS,KAAKC;YAC7B;gBACE,OAAOX,GAAGI,YAAYH,MAAMS,KAAKC;AACnC,cAAE,OAAOC;gBACP,IAAIA,GAAGC,SAAS,UACd,MAAMD;AACV;AAAA;QAIF,MAAME,YAAY,CAACb,MAAMS,KAAKC;YAC5B;gBACE,OAAOX,GAAGc,UAAUb,MAAMS,KAAKC;AACjC,cAAE,OAAOC;gBACP,IAAIA,GAAGC,SAAS,UACd,MAAMD;AACV;AAAA;QAIF,MAAMG,eACJT,oBAAoB,CAACL,MAAMS,KAAKC,KAAKK,OAAOJ;YAI1C,KAAKA,MAAMA,GAAGC,SAAS,UACrBG,GAAGJ,UAEHZ,GAAGiB,MAAMhB,MAAMS,KAAKC,KAAKK;AAAE,YAE7B,CAACE,GAAGC,IAAIC,KAAKJ,OAAOA;QAGxB,MAAMK,mBACJf,oBAAoB,CAACL,MAAMS,KAAKC;YAC9B;gBACE,OAAON,WAAWJ,MAAMS,KAAKC;AAC/B,cAAE,OAAOC;gBACP,IAAIA,GAAGC,SAAS,UACd,MAAMD;gBACRE,UAAUb,MAAMS,KAAKC;AACvB;AAAA,YAEA,CAACV,MAAMS,KAAKC,QAAQN,WAAWJ,MAAMS,KAAKC;QAG9C,MAAMW,cAAcf,QAAQC;QAC5B,IAAIe,UAAU,CAACtB,MAAMuB,SAASR,OAAOhB,GAAGuB,QAAQtB,MAAMuB,SAASR;Q

WriteFile, WriteConsoleW, WerSetFlags, WerGetFlags, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, VirtualFree, VirtualAlloc, TlsAlloc, SwitchToThread, SuspendThread, SetWaitableTimer, SetUnhandledExceptionFilter, SetProcessPriorityBoost, SetEvent, SetErrorMode, SetConsoleCtrlHandler, ResumeThread, RaiseFailFastException, PostQueuedCompletionStatus, LoadLibraryW, LoadLibraryExW, SetThreadContext, GetThreadContext, GetSystemInfo, GetSystemDirectoryA, GetStdHandle, GetQueuedCompletionStatusEx, GetProcessAffinityMask, GetProcAddress, GetErrorMode, GetEnvironmentStringsW, GetCurrentThreadId, GetConsoleMode, FreeEnvironmentStringsW, ExitProcess, DuplicateHandle, CreateWaitableTimerExW, CreateThread, CreateIoCompletionPort, CreateEventA, CloseHandle, AddVectoredExceptionHandler

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 15, 2024 18:16:01.812586069 CEST	49760	80	192.168.2.4	45.66.248.237
Oct 15, 2024 18:16:01.817580938 CEST	80	49760	45.66.248.237	192.168.2.4
Oct 15, 2024 18:16:01.817724943 CEST	49760	80	192.168.2.4	45.66.248.237
Oct 15, 2024 18:16:01.817962885 CEST	49760	80	192.168.2.4	45.66.248.237
Oct 15, 2024 18:16:01.822916985 CEST	80	49760	45.66.248.237	192.168.2.4
Oct 15, 2024 18:16:10.345334053 CEST	80	49760	45.66.248.237	192.168.2.4
Oct 15, 2024 18:16:10.345429897 CEST	49760	80	192.168.2.4	45.66.248.237
Oct 15, 2024 18:16:10.345546007 CEST	49760	80	192.168.2.4	45.66.248.237
Oct 15, 2024 18:16:10.350455999 CEST	80	49760	45.66.248.237	192.168.2.4

HTTP Request Dependency Graph

45.66.248.237

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49760	45.66.248.237	80	4340	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
Oct 15, 2024 18:16:01.817962885 CEST	88	OUT	GET / HTTP/1.1 Host: 45.66.248.237 Connection: Keep-Alive Cache-Control: no-cache

Target ID:	0
Start time:	12:15:40
Start date:	15/10/2024
Path:	C:\Users\user\Desktop\Jaws.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Jaws.exe"
Imagebase:	0xf40000
File size:	24'606'720 bytes
MD5 hash:	82A93F4476EFBFEE119EB6CEC32B0E8D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2306788327.0000000002A8E000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2306788327.0000000002A3A000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2306788327.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:15:51
Start date:	15/10/2024
Path:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Imagebase:	0x950000
File size:	231'736 bytes
MD5 hash:	A64BEAB5D4516BECA4C40B25DC0C1CD8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.2522681012.0000000002990000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.2523138286.0000000002D87000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.2522728061.00000000029F2000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.2522728061.0000000002A2A000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	19%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2%
Total number of Nodes:	1159
Total number of Limit Nodes:	6

Executed Functions

Function 029A8680 Relevance: 6.1, APIs: 4, Instructions: 77
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,029B05B7), ref: 029A86CA
Process32First.KERNEL32(?,00000128), ref: 029A86DE
Process32Next.KERNEL32(?,00000128), ref: 029A86F3
CloseHandle.KERNELBASE(?), ref: 029A8761

Memory Dump Source

Source File: 00000001.00000002.2522681012.0000000002990000.00000040.00000400.00020000.00000000.sdmp, Offset: 02990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2990000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 74cc716840213eb5557bca44158812c551f4353f69f1bd2f59d67b78c0cfb178
Instruction ID: 3ef5d0fe0d30bbe67df003ef20a5a02e9af21fbe6951262b5e63d7d8a08b0784
Opcode Fuzzy Hash: 74cc716840213eb5557bca44158812c551f4353f69f1bd2f59d67b78c0cfb178
Instruction Fuzzy Hash: FB316B71941218ABDB64EF54CC64FEEB77DFF85700F0045A9E50AA2190EB306A45CFE0

Function 029945C0 Relevance: 3.1, APIs: 2, Instructions: 114
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,029A69FB), ref: 0299460E
VirtualProtect.KERNELBASE(?,00000004,00000100,00000000), ref: 0299479C

Memory Dump Source

Source File: 00000001.00000002.2522681012.0000000002990000.00000040.00000400.00020000.00000000.sdmp, Offset: 02990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2990000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID:
API String ID: 1542196881-0
Opcode ID: 6de9c28704685f4520f4184605d14eb3efb81c39061ae0d21dee4d70ddaab5af
Instruction ID: 51127acffb54adb61a5ea7ba06b85f9b2f3095280ca718c627e93ce727f61858
Opcode Fuzzy Hash: 6de9c28704685f4520f4184605d14eb3efb81c39061ae0d21dee4d70ddaab5af
Instruction Fuzzy Hash: FB411371ACC314EBF7165FE4E98F9AC7B70AF89702B428864F94399140C6709461DBB1

Function 029A7B90 Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNELBASE(?,00000002,?,00000200), ref: 029A7C62

Memory Dump Source

Source File: 00000001.00000002.2522681012.0000000002990000.00000040.00000400.00020000.00000000.sdmp, Offset: 02990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2990000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: a387e3197a7264913c2541b0f8487c3b1fa208515ac450a468372695922969bc
Instruction ID: cc1b31286da8705ed14cbb754abf185621b0052d900134a8663cd526b7486d1e
Opcode Fuzzy Hash: a387e3197a7264913c2541b0f8487c3b1fa208515ac450a468372695922969bc
Instruction Fuzzy Hash: F8413C71941218ABDB64DB94DCA9BEEB379FF84700F104599E50AA2280DB742F85CFE0

Function 029A7A30 Relevance: 1.5, APIs: 1, Instructions: 49timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNELBASE(?,?,?,?,00000000,00000000,?,?,00000000,?,029B0E10,00000000,?,00000000,00000000,?), ref: 029A7A7D

Memory Dump Source

Source File: 00000001.00000002.2522681012.0000000002990000.00000040.00000400.00020000.00000000.sdmp, Offset: 02990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2990000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID:
API String ID: 565725191-0
Opcode ID: 6c16a686ddfb1554709c4709a48b4fccc46c975675e54f3dff2dafc22d1a7532
Instruction ID: 5d2cad9e374f7033411e9b5bc06018d662255c1a05839b0dc63cd3be97e52b5e
Opcode Fuzzy Hash: 6c16a686ddfb1554709c4709a48b4fccc46c975675e54f3dff2dafc22d1a7532
Instruction Fuzzy Hash: 131182B1D86228EBEB108F54DC59FAAB778FB44711F004799E906932C0D7741A40CF90

Function 029A7850 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(00000104,00000104), ref: 029A789F

Memory Dump Source

Source File: 00000001.00000002.2522681012.0000000002990000.00000040.00000400.00020000.00000000.sdmp, Offset: 02990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2990000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 9fe47fa766a05acffaaa5f234f7bffc7917f54f6c7557627867220b2deb6812d
Instruction ID: 44f8d84becd038b072eac9fc8d0fa8e783b7419c48c0deab97b762c558a6472d
Opcode Fuzzy Hash: 9fe47fa766a05acffaaa5f234f7bffc7917f54f6c7557627867220b2deb6812d
Instruction Fuzzy Hash: 39F04FB1D85208ABD700DF98D95ABAEFBB8EB04751F10065AFA05E3680D7792504CBE1

Function 029A7ED0 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(029B0E2C), ref: 029A7F00

Memory Dump Source

Source File: 00000001.00000002.2522681012.0000000002990000.00000040.00000400.00020000.00000000.sdmp, Offset: 02990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2990000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: e04717374cf7096c137664faab868183b5c514613dbcbcc29a7e6a4705179f7a
Instruction ID: 5ac22489e20d02ed0e7b8619c8e03204288c08139763ceb1a71319a52ecd84ad
Opcode Fuzzy Hash: e04717374cf7096c137664faab868183b5c514613dbcbcc29a7e6a4705179f7a
Instruction Fuzzy Hash: A5F06DB1A41208EBDB10CF85DC55FEAF7BCFB48A24F000A69F51593680E7756A148BE0

Function 029A9C10 Relevance: 12.7, APIs: 8, Instructions: 684
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?,?,029A5CA3,?,00000034,00000064,029A6600,?,0000002C,00000064,029A65A0,?,00000030,00000064,Function_00015AD0,?), ref: 029AA03D
LoadLibraryA.KERNELBASE(?,?,029A5CA3,?,00000034,00000064,029A6600,?,0000002C,00000064,029A65A0,?,00000030,00000064,Function_00015AD0,?), ref: 029AA04E
LoadLibraryA.KERNELBASE(?,?,029A5CA3,?,00000034,00000064,029A6600,?,0000002C,00000064,029A65A0,?,00000030,00000064,Function_00015AD0,?), ref: 029AA060
LoadLibraryA.KERNELBASE(?,?,029A5CA3,?,00000034,00000064,029A6600,?,0000002C,00000064,029A65A0,?,00000030,00000064,Function_00015AD0,?), ref: 029AA072
LoadLibraryA.KERNELBASE(?,?,029A5CA3,?,00000034,00000064,029A6600,?,0000002C,00000064,029A65A0,?,00000030,00000064,Function_00015AD0,?), ref: 029AA083
LoadLibraryA.KERNELBASE(?,?,029A5CA3,?,00000034,00000064,029A6600,?,0000002C,00000064,029A65A0,?,00000030,00000064,Function_00015AD0,?), ref: 029AA095
LoadLibraryA.KERNELBASE(?,?,029A5CA3,?,00000034,00000064,029A6600,?,0000002C,00000064,029A65A0,?,00000030,00000064,Function_00015AD0,?), ref: 029AA0A7
LoadLibraryA.KERNELBASE(?,?,029A5CA3,?,00000034,00000064,029A6600,?,0000002C,00000064,029A65A0,?,00000030,00000064,Function_00015AD0,?), ref: 029AA0B8

Memory Dump Source

Source File: 00000001.00000002.2522681012.0000000002990000.00000040.00000400.00020000.00000000.sdmp, Offset: 02990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2990000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 802b6f7e332ea1eb350529028ea2d44a887f9dd7a3e525cf654d5b73f13d50cf
Instruction ID: 405fd0f2d69184578aa68637af02e8cb2de60f951f28480e65aba7c5e575186d
Opcode Fuzzy Hash: 802b6f7e332ea1eb350529028ea2d44a887f9dd7a3e525cf654d5b73f13d50cf
Instruction Fuzzy Hash: 62624CB5EC2241AFC344DFA8E5B89D63BF9F74C2813148D1AAA09C3244F73AA561CF51

Function 029A8320 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 196
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00020019,00000000,029B05B6), ref: 029A83A4
RegEnumKeyExA.KERNELBASE(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 029A8426
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00020019,00000000), ref: 029A847B

Strings

?, xrefs: 029A837A

Memory Dump Source

Source File: 00000001.00000002.2522681012.0000000002990000.00000040.00000400.00020000.00000000.sdmp, Offset: 02990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2990000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Open$Enum
String ID: ?
API String ID: 462099255-1684325040
Opcode ID: ac5222b44b439bea26c3e082993a72db23ae368141d56ab28abab3dbcf9b3e06
Instruction ID: 0570fd75c398f2197212d6446afa3920220427f34379ae76475b7bd5586621fa
Opcode Fuzzy Hash: ac5222b44b439bea26c3e082993a72db23ae368141d56ab28abab3dbcf9b3e06
Instruction Fuzzy Hash: A7812D71951218ABEB64DB54CCA4FEAB7B9FF48700F008699E10AA7180DF716B85CFD4

Function 029A7500 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 029A757F

Strings

\, xrefs: 029A7560
C, xrefs: 029A754C
:, xrefs: 029A755C

Memory Dump Source

Source File: 00000001.00000002.2522681012.0000000002990000.00000040.00000400.00020000.00000000.sdmp, Offset: 02990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2990000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID: :$C$\
API String ID: 2039140958-3809124531
Opcode ID: fabbab66815a012d1d0ff2c40ba79e14a283ca66605cb77d202f23af3aa7c310
Instruction ID: 3d760448c6d272f5b11ab46e098195a6ce3d6e0f2f6f79908cdf7c54dc326655
Opcode Fuzzy Hash: fabbab66815a012d1d0ff2c40ba79e14a283ca66605cb77d202f23af3aa7c310
Instruction Fuzzy Hash: 494180B1D41348ABDB10DF94DC65BEEBBB8EF48704F000599E50AA7280E775AA44CFE5

Function 029A8100 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(00000040,00000040,00000000), ref: 029A8158
__aulldiv.LIBCMT ref: 029A8172
__aulldiv.LIBCMT ref: 029A8180

Strings

@, xrefs: 029A814D

Memory Dump Source

Source File: 00000001.00000002.2522681012.0000000002990000.00000040.00000400.00020000.00000000.sdmp, Offset: 02990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2990000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: __aulldiv$GlobalMemoryStatus
String ID: @
API String ID: 2185283323-2766056989
Opcode ID: fba8bf388f57c7aca37ac5de4d28552f1d72794c69f9c1c43d73df80ba0992e1
Instruction ID: 2e5c818dcc94e0f2241d81a1e4c57ec84878aca3d5b74502c13cae5796783f04
Opcode Fuzzy Hash: fba8bf388f57c7aca37ac5de4d28552f1d72794c69f9c1c43d73df80ba0992e1
Instruction Fuzzy Hash: 5721F9B1E44318ABEB00DFD4CC59FAEB7B8FB44B50F104519F605BB280D77969018BA5

Function 02991220 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(00000040,?,00000000,00000040), ref: 0299123E
__aulldiv.LIBCMT ref: 02991258
__aulldiv.LIBCMT ref: 02991266

Strings

@, xrefs: 02991233

Memory Dump Source

Source File: 00000001.00000002.2522681012.0000000002990000.00000040.00000400.00020000.00000000.sdmp, Offset: 02990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2990000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: __aulldiv$GlobalMemoryStatus
String ID: @
API String ID: 2185283323-2766056989
Opcode ID: 91fbf0ce04d46ffa52cd4618d3f76c70bf4f6f1aee903683770cac1834b99ff8
Instruction ID: 62b7e9e7c0660ce378d696d4fb9abefc0c92c7dd353eb1526fa99184e9524b13
Opcode Fuzzy Hash: 91fbf0ce04d46ffa52cd4618d3f76c70bf4f6f1aee903683770cac1834b99ff8
Instruction Fuzzy Hash: A3016DB0E40309BBEF10EBE4CC59B9EBB78BB44715F208448E70AB62C0D77456418B99

Function 02996280 Relevance: 6.2, APIs: 4, Instructions: 191
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 029947B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 02994849

InternetOpenA.WININET(029B0DFE,00000001,00000000,00000000,00000000,029B0DFB), ref: 029962E1
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 02996335
HttpOpenRequestA.WININET(00000000,029B1A28,?,?,00000000,00000000,00400100,00000000), ref: 02996385
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 029963D1

Memory Dump Source

Source File: 00000001.00000002.2522681012.0000000002990000.00000040.00000400.00020000.00000000.sdmp, Offset: 02990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2990000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectCrackSend
String ID:
API String ID: 612470270-0
Opcode ID: 02eab515b4eb4d731faf3f82df8555b88087707d0e30d41a39daaab578b44cee
Instruction ID: b6d774df06571270db6e9186a4c1cc181e8bac5c20838d4669559c94a70f19c1
Opcode Fuzzy Hash: 02eab515b4eb4d731faf3f82df8555b88087707d0e30d41a39daaab578b44cee
Instruction Fuzzy Hash: E4716F71A40318ABEF14DFA4CC68BEE7779BF44700F108558E50AAB1C4DBB56A85CF91

Function 029A9860 Relevance: 4.7, APIs: 3, Instructions: 212
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?,?,029A6A00), ref: 029A9A9A
LoadLibraryA.KERNELBASE(?,?,029A6A00), ref: 029A9AAB
LoadLibraryA.KERNELBASE(?,?,029A6A00), ref: 029A9ACF

Memory Dump Source

Source File: 00000001.00000002.2522681012.0000000002990000.00000040.00000400.00020000.00000000.sdmp, Offset: 02990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2990000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b87330d929bee50466bb1752653f2576d8486bdfd69c482d2ddba77feb5db6f9
Instruction ID: 502090e998399276f9e7cd591c93c612bd1fde0d30c1c91316e369d5cb4cefcb
Opcode Fuzzy Hash: b87330d929bee50466bb1752653f2576d8486bdfd69c482d2ddba77feb5db6f9
Instruction Fuzzy Hash: 8EA16EB5EC32419FD344EFA8E5B8AD637F9F74C2817144D1AAA09C3244F73AA561CB90

Function 029947B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 60
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCrackUrlA.WININET(00000000,00000000), ref: 02994849

Strings

<, xrefs: 029947C9

Memory Dump Source

Source File: 00000001.00000002.2522681012.0000000002990000.00000040.00000400.00020000.00000000.sdmp, Offset: 02990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2990000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: CrackInternet
String ID: <
API String ID: 1381609488-4251816714
Opcode ID: 804a31713cd55c7b0fd088c397a8dd712eee4793f8834227e94b31f7ddbce776
Instruction ID: 36c3f681e1a6168f0ad96e0576ef1a960636fec15c7e9607cfeb186835d10ba8
Opcode Fuzzy Hash: 804a31713cd55c7b0fd088c397a8dd712eee4793f8834227e94b31f7ddbce776
Instruction Fuzzy Hash: 99213BB1D00219ABDF14DFA4E859BED7B75FF44320F108225E966A7280EB706A15CFD1

Function 02994FB0 Relevance: 3.1, APIs: 2, Instructions: 82
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 02994FD1
KiUserExceptionDispatcher.NTDLL(00000000,?,00000001), ref: 0299508A

Memory Dump Source

Source File: 00000001.00000002.2522681012.0000000002990000.00000040.00000400.00020000.00000000.sdmp, Offset: 02990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2990000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: AllocateDispatcherExceptionHeapUser
String ID:
API String ID: 3515689010-0
Opcode ID: f5abc1ab1f2bc569083cc32539cf96db5ecc5b3210252d9825b6d40903fd58b0
Instruction ID: 341b8a831775629ea2ca920d2c61e1474f1694467b37d2926c5e937ce3496c22
Opcode Fuzzy Hash: f5abc1ab1f2bc569083cc32539cf96db5ecc5b3210252d9825b6d40903fd58b0
Instruction Fuzzy Hash: B431F3B4E40218ABDB20CF54DC95BDDB7B4EB48704F5085D9EA09A7280DB706AD5CF98

Function 029A83DC Relevance: 3.1, APIs: 2, Instructions: 64
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegEnumKeyExA.KERNELBASE(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 029A8426
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00020019,00000000), ref: 029A847B
RegQueryValueExA.KERNELBASE(00000000,?,00000000,000F003F,?,00000400), ref: 029A84EC
RegQueryValueExA.KERNELBASE(00000000,?,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,029B0B34), ref: 029A8599
RegCloseKey.KERNELBASE(00000000), ref: 029A8608

Memory Dump Source

Source File: 00000001.00000002.2522681012.0000000002990000.00000040.00000400.00020000.00000000.sdmp, Offset: 02990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2990000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseEnumOpen
String ID:
API String ID: 2041898428-0
Opcode ID: c28c4e2f5ee87049655f7349e117df43133df794f97366d29991e4c4ea687873
Instruction ID: 15f3b225c77f642b427dc9614df1371fe055da3174e11c0cc1af1be735175090
Opcode Fuzzy Hash: c28c4e2f5ee87049655f7349e117df43133df794f97366d29991e4c4ea687873
Instruction Fuzzy Hash: E62119B1951228ABEB24DB54DCA5FE9B3B8FB48700F00C5D8E609A7180DF716A85CFD4

Function 029A7E00 Relevance: 3.1, APIs: 2, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00020119,?), ref: 029A7E5E
RegQueryValueExA.KERNELBASE(?,?,00000000,00000000,000000FF,000000FF), ref: 029A7E7F

Memory Dump Source

Source File: 00000001.00000002.2522681012.0000000002990000.00000040.00000400.00020000.00000000.sdmp, Offset: 02990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2990000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: OpenQueryValue
String ID:
API String ID: 4153817207-0
Opcode ID: 27023bc099717e44f503b71cfe3867b8e2e23d810200978e5e0900e8e6a134d0
Instruction ID: 685ffd214e2014678366c8f94fdf0840ade1d542382be30cf6c0633e2c0e706a
Opcode Fuzzy Hash: 27023bc099717e44f503b71cfe3867b8e2e23d810200978e5e0900e8e6a134d0
Instruction Fuzzy Hash: 52113AB1A80205ABD700DBD4D96AFEFBBB8EB44B50F104919FA05E7280E77569108BE0

Function 029A7690 Relevance: 3.0, APIs: 2, Instructions: 43
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00020119,00000000), ref: 029A76DD
RegQueryValueExA.KERNELBASE(00000000,?,00000000,00000000,?,000000FF), ref: 029A76FE

Memory Dump Source

Source File: 00000001.00000002.2522681012.0000000002990000.00000040.00000400.00020000.00000000.sdmp, Offset: 02990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2990000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: OpenQueryValue
String ID:
API String ID: 4153817207-0
Opcode ID: 10c3b3c89b9357d35d7a0f9202f52f2c7db928abdcd13380eafacaf5883ad473
Instruction ID: 26d1d0a0941ccaa5eeb8c9aa3fc24002b31335b9b3e7bfbc0cbae70c1f244ab6
Opcode Fuzzy Hash: 10c3b3c89b9357d35d7a0f9202f52f2c7db928abdcd13380eafacaf5883ad473
Instruction Fuzzy Hash: B601FFB5E81304BBDB00DBE4D96AFEEB7BCEB48741F104854FE05D7280E675A9148B90

Function 029A7720 Relevance: 3.0, APIs: 2, Instructions: 42
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00020119,029A76B9), ref: 029A775B
RegQueryValueExA.KERNELBASE(029A76B9,029B0AAC,00000000,00000000,?,000000FF), ref: 029A777A

Memory Dump Source

Source File: 00000001.00000002.2522681012.0000000002990000.00000040.00000400.00020000.00000000.sdmp, Offset: 02990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2990000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: OpenQueryValue
String ID:
API String ID: 4153817207-0
Opcode ID: 0c7cc63df25698adb8b64ab818339782a482df3d7f65583547c4e0fd245c3831
Instruction ID: 418d47ee0ba34a4a05cb01a4fc59799d594031c865eca0f519a1fa42cb5e0074
Opcode Fuzzy Hash: 0c7cc63df25698adb8b64ab818339782a482df3d7f65583547c4e0fd245c3831
Instruction Fuzzy Hash: 8E01F4B5E80308BBE700DBE4DC59FEEB7B8EB44741F104555FA05E7281E67165508B91

Function 029A69F0 Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 02991160: GetSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,029A6A17,029B0AEF), ref: 0299116A

Part of subcall function 02991110: VirtualAllocExNuma.KERNELBASE(00000000,?,?,029A6A1C), ref: 02991132

Part of subcall function 02991220: GlobalMemoryStatusEx.KERNELBASE(00000040,?,00000000,00000040), ref: 0299123E
Part of subcall function 02991220: __aulldiv.LIBCMT ref: 02991258
Part of subcall function 02991220: __aulldiv.LIBCMT ref: 02991266

GetUserDefaultLCID.KERNELBASE ref: 029A6A26

Part of subcall function 029A7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 029A789F

Part of subcall function 029A78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 029A792F

Memory Dump Source

Source File: 00000001.00000002.2522681012.0000000002990000.00000040.00000400.00020000.00000000.sdmp, Offset: 02990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2990000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: NameUser__aulldiv$AllocComputerDefaultGlobalInfoMemoryNumaStatusSystemVirtual
String ID:
API String ID: 3178950686-0
Opcode ID: 6a33b913cea02474a943d5226bd82c68f7ee6ae4d69904c20a44fc4cf7028201
Instruction ID: 3747a8572fe104a6b8454ebf07fa50f5c84c55da1324c40ad9e89f905dbf1867
Opcode Fuzzy Hash: 6a33b913cea02474a943d5226bd82c68f7ee6ae4d69904c20a44fc4cf7028201
Instruction Fuzzy Hash: FE31E771D41309ABDB44FBE4D875BEE777ABF84340F104928E512A6190EF706A05CEE5

Function 029A78E0 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32(?,00000104), ref: 029A792F

Memory Dump Source

Source File: 00000001.00000002.2522681012.0000000002990000.00000040.00000400.00020000.00000000.sdmp, Offset: 02990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2990000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 959d34442b7ba763576553b7f3bee90a0b879000db8c09b79797e6d53322a906
Instruction ID: 8dff9e780922a130b2de523092d8904952bf6a3fbe6474eebc7bb3282c6532e7
Opcode Fuzzy Hash: 959d34442b7ba763576553b7f3bee90a0b879000db8c09b79797e6d53322a906
Instruction Fuzzy Hash: 580162B1945304EBD710DF94D955BEEFBB8FB44B51F10461AE945E3280D37555008BE1

Function 029A9470 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 029A94A5

Memory Dump Source

Source File: 00000001.00000002.2522681012.0000000002990000.00000040.00000400.00020000.00000000.sdmp, Offset: 02990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2990000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: 810baead1ac2c081a0cd93ffadece811934ffd2ae684178a511e28818efd3392
Instruction ID: 171a8069732953a5e32376b4b7e214475460d5753e5c7eb9596301302b09d84b
Opcode Fuzzy Hash: 810baead1ac2c081a0cd93ffadece811934ffd2ae684178a511e28818efd3392
Instruction Fuzzy Hash: 9CF05E74D4020CFBDB04DFA4D86AFEE77B8EB08700F004498BA0997280E6B16A85CB90

Function 02991110 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualAllocExNuma.KERNELBASE(00000000,?,?,029A6A1C), ref: 02991132

Memory Dump Source

Source File: 00000001.00000002.2522681012.0000000002990000.00000040.00000400.00020000.00000000.sdmp, Offset: 02990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2990000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: AllocNumaVirtual
String ID:
API String ID: 4233825816-0
Opcode ID: 01ad4d2f8673ec6cd9d2693c06475b5e39dae6ee8a891092b484482c8c433f2c
Instruction ID: a422567b20e29f12d814fe83c5986133cfb2862d3d46305017ef62598061e0f4
Opcode Fuzzy Hash: 01ad4d2f8673ec6cd9d2693c06475b5e39dae6ee8a891092b484482c8c433f2c
Instruction Fuzzy Hash: 4BE0E670DC6348FFEB106BA59C1EB497678AB04B51F104554F60DB71C0D6B526109A99

Function 02991160 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,029A6A17,029B0AEF), ref: 0299116A

Memory Dump Source

Source File: 00000001.00000002.2522681012.0000000002990000.00000040.00000400.00020000.00000000.sdmp, Offset: 02990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2990000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 977a070ff14e6772a7b8abc73e2b9f96bedb41b13d9bc4fda5071eb1337e3ca0
Instruction ID: 0b64e4be14b0ea50f4d2ed35d14455cc254ced8f20a748ab4ece18f100204814
Opcode Fuzzy Hash: 977a070ff14e6772a7b8abc73e2b9f96bedb41b13d9bc4fda5071eb1337e3ca0
Instruction Fuzzy Hash: 94D05E74D4130DDBCB00DFE0D8596DDBB78FB08222F001995D805A3340EA306491CAA5

Function 029910A0 Relevance: 1.3, APIs: 1, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,17C841C0,00003000,00000004,?,?,?,0299114E,?,?,029A6A1C), ref: 029910B3

Memory Dump Source

Source File: 00000001.00000002.2522681012.0000000002990000.00000040.00000400.00020000.00000000.sdmp, Offset: 02990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2990000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: bd5dcf0307fb3ea202f594ab0a4bae552d401b0a8b1f0c36d949a71682dd0be4
Instruction ID: a03da29c124f4b59841625f597925f40c6b51107b019373e26b4130840e6776d
Opcode Fuzzy Hash: bd5dcf0307fb3ea202f594ab0a4bae552d401b0a8b1f0c36d949a71682dd0be4
Instruction Fuzzy Hash: 40F08971A81314BBEB149AA89C69FEEB7DCE705B55F301844F504E7280D5725E00DA94

Non-executed Functions

Function 029A9750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2522681012.0000000002990000.00000040.00000400.00020000.00000000.sdmp, Offset: 02990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2990000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 029AC742 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 029AC74E

Part of subcall function 029ABF9F: __getptd_noexit.LIBCMT ref: 029ABFA2
Part of subcall function 029ABF9F: __amsg_exit.LIBCMT ref: 029ABFAF

__getptd.LIBCMT ref: 029AC765
__amsg_exit.LIBCMT ref: 029AC773
__lock.LIBCMT ref: 029AC783
__updatetlocinfoEx_nolock.LIBCMT ref: 029AC797

Memory Dump Source

Source File: 00000001.00000002.2522681012.0000000002990000.00000040.00000400.00020000.00000000.sdmp, Offset: 02990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2990000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 09131afdb98b8610bc8f3c3cd2095ec2c837a3272dca6ad7a399e26404e178ff
Instruction ID: 27b60770a6ceb14471e4998ea5916be6e1378e712959aca190378ca6fba4cd00
Opcode Fuzzy Hash: 09131afdb98b8610bc8f3c3cd2095ec2c837a3272dca6ad7a399e26404e178ff
Instruction Fuzzy Hash: 5BF0BE32D447109FE722BBB89875B9D33E26F80728F24455AE408AE2C0DB645980CFD6

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FREERANGECLOUDCA	Setup-Pro.exe	Get hash	malicious	Stealc, Vidar	Browse	45.66.249.162
	forest.exe	Get hash	malicious	Unknown	Browse	45.66.249.249
	forest.exe	Get hash	malicious	Unknown	Browse	45.66.249.249
	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	23.129.35.4
	SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Get hash	malicious	Raccoon Stealer v2	Browse	193.142.147.59
	SecuriteInfo.com.Trojan.PackedNET.2334.3801.19434.exe	Get hash	malicious	PureLog Stealer, Raccoon Stealer v2, SmokeLoader	Browse	193.142.147.59
	Setup.exe	Get hash	malicious	AsyncRAT, HTMLPhisher, Clipboard Hijacker, Phorpiex, PureLog Stealer, Raccoon Stealer v2, RedLine	Browse	193.142.147.59
	http://www.brookskushman.com	Get hash	malicious	Unknown	Browse	45.66.248.122
	http://www.prestigetransportation.com	Get hash	malicious	Unknown	Browse	45.66.248.122
	https://dutchpopp.com	Get hash	malicious	Unknown	Browse	45.66.248.122

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.572472506368371
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Jaws.exe
File size:	24'606'720 bytes
MD5:	82a93f4476efbfee119eb6cec32b0e8d
SHA1:	447aa1e180bd5d26388bbdb699ecae2477d24162
SHA256:	2d42e49addb09860700c9862f7416ee6da56a06d5a8580bede68ae7dac28993a
SHA512:	8e187e5a981a8ff1d973639d3c490458aec01d6d834f1294afa2e0dc3ab1090585343b8b197ae01bde6bd2d4b28517c0f1702660190997f79bc95c1779919f77
SSDEEP:	196608:myzc9QJc6oymFtxRGb+0KCDYIf8Cn3UAoIfM:XcrM8HGbgCD0Cn3sIfM
TLSH:	CE473940FA8B95F1DA034931509F622F23345D059B28DACBFB4DBA19FB37A964D37209
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........Vw...................................h...@..........................P{.......w...@................................

Entrypoint:	0x47bdf0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	1aae8bf580c846f39c71c05898e57e88

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1730000	0x44c	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x17b3000	0x1f54	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1731000	0x80fdc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x168afa0	0xb4	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x97f118	0x97f200	af983ca16b74e0f5891d173e3b552689	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x981000	0xd07fb8	0xd08000	468d1d9347169c143d3e0dcfec33eeab	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1689000	0xa6220	0x6ca00	aa6ec7b11e1cc6b36addc73d3bf384b1	False	0.37792856372266975	data	5.645494557957102	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x1730000	0x44c	0x600	fe55a28e7d311f89fadf84e2eb906c74	False	0.3580729166666667	OpenPGP Public Key	3.8964879594940283	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x1731000	0x80fdc	0x81000	d6c291a0432736bff20409460438e8b5	False	0.5456959332606589	data	6.674834598762316	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.symtab	0x17b2000	0x4	0x200	07b5472d347d42780469fb2654b7fc54	False	0.02734375	data	0.020393135236084953	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x17b3000	0x1f54	0x2000	e428af0060efcf228a7fac6f50fe1622	False	0.3306884765625	data	4.667329787524857	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x17b31d4	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.5675675675675675
RT_ICON	0x17b32fc	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	English	United States	0.4486994219653179
RT_ICON	0x17b3864	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.4637096774193548
RT_ICON	0x17b3b4c	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	English	United States	0.3935018050541516
RT_GROUP_ICON	0x17b43f4	0x3e	data	English	United States	0.8387096774193549
RT_VERSION	0x17b4434	0x4f4	data	English	United States	0.26735015772870663
RT_MANIFEST	0x17b4928	0x62c	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4240506329113924

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Jaws.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\jsii-runtime.656451430\bin\jsii-runtime.js

C:\Users\user\AppData\Local\Temp\jsii-runtime.656451430\bin\jsii-runtime.js.map

C:\Users\user\AppData\Local\Temp\jsii-runtime.656451430\lib\program.js

C:\Users\user\AppData\Local\Temp\jsii-runtime.656451430\lib\program.js.map

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

Windows Analysis Report
Jaws.exe

Function 029A8680 Relevance: 6.1, APIs: 4, Instructions: 77
processCOMMON

Function 029945C0 Relevance: 3.1, APIs: 2, Instructions: 114
memoryCOMMON

Function 029A9C10 Relevance: 12.7, APIs: 8, Instructions: 684
libraryCOMMON

Function 029A8320 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 196
registryCOMMON

Function 029A7500 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 106
COMMON

Function 029A8100 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67
COMMON

Function 02991220 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41
COMMON

Function 02996280 Relevance: 6.2, APIs: 4, Instructions: 191
networkCOMMON

Function 029A9860 Relevance: 4.7, APIs: 3, Instructions: 212
libraryCOMMON

Function 029947B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 60
networkCOMMON

Function 02994FB0 Relevance: 3.1, APIs: 2, Instructions: 82
memoryCOMMON

Function 029A83DC Relevance: 3.1, APIs: 2, Instructions: 64
registryCOMMON

Function 029A7E00 Relevance: 3.1, APIs: 2, Instructions: 58
registryCOMMON

Function 029A7690 Relevance: 3.0, APIs: 2, Instructions: 43
registryCOMMON

Function 029A7720 Relevance: 3.0, APIs: 2, Instructions: 42
registryCOMMON