Windows Analysis Report
DHL AWB_NO_92847309329.exe

AI detected suspicious sample

Source: Yara match	File source: 12.2.rjOyFV.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL AWB_NO_92847309329.exe.45864a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL AWB_NO_92847309329.exe.3b55670.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rjOyFV.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL AWB_NO_92847309329.exe.45864a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL AWB_NO_92847309329.exe.3b55670.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL AWB_NO_92847309329.exe.3a7e790.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.1865601373.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4182257195.0000000001587000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1865064204.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1806575207.0000000004586000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1806575207.0000000003A69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL AWB_NO_92847309329.exe PID: 3120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL AWB_NO_92847309329.exe PID: 7244, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rjOyFV.exe PID: 7524, type: MEMORYSTR

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: DHL AWB_NO_92847309329.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe

Code function: 12_2_004315EC CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,

12_2_004315EC

Source: DHL AWB_NO_92847309329.exe, 00000000.00000002.1806575207.0000000003A69000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_428393a5-5

Source: DHL AWB_NO_92847309329.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: DHL AWB_NO_92847309329.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: slCn.pdbSHA256y! source: DHL AWB_NO_92847309329.exe, rjOyFV.exe.0.dr
Source:	Binary string: slCn.pdb source: DHL AWB_NO_92847309329.exe, rjOyFV.exe.0.dr

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_0041A01B FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	12_2_0041A01B
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_0040B28E FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	12_2_0040B28E
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_0040838E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	12_2_0040838E
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_004087A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	12_2_004087A0
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_00407848 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	12_2_00407848
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_004068CD FindFirstFileW,FindNextFileW,	12_2_004068CD
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_0040AA71 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	12_2_0040AA71
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_00417AAB FindFirstFileW,FindNextFileW,FindNextFileW,	12_2_00417AAB
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_0040AC78 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	12_2_0040AC78

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe

Code function: 12_2_00406D28 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

12_2_00406D28

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49736 -> 96.9.210.71:52411

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: windowsocttehe.duckdns.org

Uses dynamic DNS services

Source: unknown

DNS query: name: windowsocttehe.duckdns.org

Source: global traffic

TCP traffic: 192.168.2.4:49736 -> 96.9.210.71:52411

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 178.237.33.50 178.237.33.50

Source: Joe Sandbox View

ASN Name: NEWMEDIAEXPRESS-AS-APNewMediaExpressPteLtdSG NEWMEDIAEXPRESS-AS-APNewMediaExpressPteLtdSG

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49741 -> 178.237.33.50:80

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe

Code function: 12_2_0041936B InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

12_2_0041936B

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: windowsocttehe.duckdns.org
Source: global traffic	DNS traffic detected: DNS query: geoplugin.net

Source: DHL AWB_NO_92847309329.exe, 00000006.00000002.4182257195.0000000001587000.00000004.00000020.00020000.00000000.sdmp, DHL AWB_NO_92847309329.exe, 00000006.00000002.4182257195.00000000015CF000.00000004.00000020.00020000.00000000.sdmp, rjOyFV.exe	String found in binary or memory: http://geoplugin.net/json.gp
Source: DHL AWB_NO_92847309329.exe, 00000006.00000002.4182257195.0000000001587000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp&
Source: DHL AWB_NO_92847309329.exe, 00000000.00000002.1806575207.0000000003A69000.00000004.00000800.00020000.00000000.sdmp, DHL AWB_NO_92847309329.exe, 00000000.00000002.1806575207.0000000004586000.00000004.00000800.00020000.00000000.sdmp, rjOyFV.exe, 0000000C.00000002.1865064204.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: DHL AWB_NO_92847309329.exe, 00000006.00000002.4182257195.0000000001587000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpSystem32
Source: DHL AWB_NO_92847309329.exe, 00000006.00000002.4182257195.0000000001587000.00000004.00000020.00020000.00000000.sdmp, DHL AWB_NO_92847309329.exe, 00000006.00000002.4182257195.00000000015CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpl
Source: DHL AWB_NO_92847309329.exe, 00000006.00000002.4182257195.0000000001587000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpm
Source: DHL AWB_NO_92847309329.exe, 00000000.00000002.1805270956.0000000002AA8000.00000004.00000800.00020000.00000000.sdmp, rjOyFV.exe, 00000007.00000002.1866548298.0000000002E98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: DHL AWB_NO_92847309329.exe, rjOyFV.exe.0.dr	String found in binary or memory: http://tempuri.org/DatabaseWalletDataSet.xsd
Source: DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp, DHL AWB_NO_92847309329.exe, 00000000.00000002.1810117079.0000000005A50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe

Code function: 12_2_00409340 SetWindowsHookExA 0000000D,0040932C,00000000

12_2_00409340

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe

Code function: 12_2_0040A65A OpenClipboard,GetClipboardData,CloseClipboard,

12_2_0040A65A

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe

Code function: 12_2_00414EC1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

12_2_00414EC1

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe

Code function: 12_2_0040A65A OpenClipboard,GetClipboardData,CloseClipboard,

12_2_0040A65A

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe

Code function: 12_2_00409468 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,

12_2_00409468

E-Banking Fraud

Contains functionalty to change the wallpaper

Source: Yara match	File source: 12.2.rjOyFV.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL AWB_NO_92847309329.exe.45864a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL AWB_NO_92847309329.exe.3b55670.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rjOyFV.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL AWB_NO_92847309329.exe.45864a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL AWB_NO_92847309329.exe.3b55670.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL AWB_NO_92847309329.exe.3a7e790.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.1865601373.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4182257195.0000000001587000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1865064204.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1806575207.0000000004586000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1806575207.0000000003A69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL AWB_NO_92847309329.exe PID: 3120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL AWB_NO_92847309329.exe PID: 7244, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rjOyFV.exe PID: 7524, type: MEMORYSTR

Spam, unwanted Advertisements and Ransom Demands

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe

Code function: 12_2_0041A76C SystemParametersInfoW,

12_2_0041A76C

System Summary

Malicious sample detected (through community Yara rule)

Source: 12.2.rjOyFV.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 12.2.rjOyFV.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 12.2.rjOyFV.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0.2.DHL AWB_NO_92847309329.exe.45864a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.DHL AWB_NO_92847309329.exe.45864a0.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.DHL AWB_NO_92847309329.exe.45864a0.1.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0.2.DHL AWB_NO_92847309329.exe.3b55670.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.DHL AWB_NO_92847309329.exe.3b55670.3.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.DHL AWB_NO_92847309329.exe.3b55670.3.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 12.2.rjOyFV.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 12.2.rjOyFV.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 12.2.rjOyFV.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0.2.DHL AWB_NO_92847309329.exe.45864a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.DHL AWB_NO_92847309329.exe.45864a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0.2.DHL AWB_NO_92847309329.exe.3b55670.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.DHL AWB_NO_92847309329.exe.3b55670.3.raw.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0.2.DHL AWB_NO_92847309329.exe.3a7e790.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.DHL AWB_NO_92847309329.exe.3a7e790.2.raw.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0000000C.00000002.1865064204.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000C.00000002.1865064204.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0000000C.00000002.1865064204.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 00000000.00000002.1806575207.0000000004586000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000000.00000002.1806575207.0000000003A69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: DHL AWB_NO_92847309329.exe PID: 3120, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: rjOyFV.exe PID: 7524, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe

Code function: 12_2_00414DB4 ExitWindowsEx,LoadLibraryA,GetProcAddress,

12_2_00414DB4

Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Code function: 0_2_00C9D324	0_2_00C9D324
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Code function: 0_2_072A96E0	0_2_072A96E0
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Code function: 0_2_072A0040	0_2_072A0040
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Code function: 0_2_072AC700	0_2_072AC700
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Code function: 0_2_072AB7C8	0_2_072AB7C8
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Code function: 0_2_072AE618	0_2_072AE618
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Code function: 0_2_072AC6F0	0_2_072AC6F0
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Code function: 0_2_072A96D0	0_2_072A96D0
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Code function: 0_2_072AC2A8	0_2_072AC2A8
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Code function: 0_2_072AC2C8	0_2_072AC2C8
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Code function: 0_2_072AE1E0	0_2_072AE1E0
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Code function: 0_2_072A0006	0_2_072A0006
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Code function: 0_2_072ACB28	0_2_072ACB28
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Code function: 0_2_072ACB38	0_2_072ACB38
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Code function: 0_2_072A4B48	0_2_072A4B48
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Code function: 0_2_072A4B58	0_2_072A4B58
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Code function: 0_2_072A396F	0_2_072A396F
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Code function: 0_2_072A3980	0_2_072A3980
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Code function: 0_2_0C34392A	0_2_0C34392A
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 7_2_0144D324	7_2_0144D324
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 7_2_05367020	7_2_05367020
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 7_2_05360006	7_2_05360006
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 7_2_05360040	7_2_05360040
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 7_2_05366FE7	7_2_05366FE7
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 7_2_073296E0	7_2_073296E0
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 7_2_07320040	7_2_07320040
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 7_2_0732C700	7_2_0732C700
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 7_2_0732B7C8	7_2_0732B7C8
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 7_2_0732E618	7_2_0732E618
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 7_2_0732C6F0	7_2_0732C6F0
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 7_2_073296D0	7_2_073296D0
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 7_2_0732C2A8	7_2_0732C2A8
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 7_2_0732C2C8	7_2_0732C2C8
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 7_2_0732E1E0	7_2_0732E1E0
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 7_2_07320006	7_2_07320006
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 7_2_07325C60	7_2_07325C60
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 7_2_0732CB38	7_2_0732CB38
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 7_2_07324B58	7_2_07324B58
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 7_2_07324B48	7_2_07324B48
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 7_2_0732396F	7_2_0732396F
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 7_2_07323980	7_2_07323980
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 7_2_0A6F2ED8	7_2_0A6F2ED8
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_00425152	12_2_00425152
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_00435286	12_2_00435286
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_004513D4	12_2_004513D4
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_0045050B	12_2_0045050B
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_00436510	12_2_00436510
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_004316FB	12_2_004316FB
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_0043569E	12_2_0043569E
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_00443700	12_2_00443700
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_004257FB	12_2_004257FB
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_004128E3	12_2_004128E3
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_00425964	12_2_00425964
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_0041B917	12_2_0041B917
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_0043D9CC	12_2_0043D9CC
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_00435AD3	12_2_00435AD3
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_00424BC3	12_2_00424BC3
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_0043DBFB	12_2_0043DBFB
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_0044ABA9	12_2_0044ABA9
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_00433C0B	12_2_00433C0B
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_00434D8A	12_2_00434D8A
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_0043DE2A	12_2_0043DE2A
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_0041CEAF	12_2_0041CEAF
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_00435F08	12_2_00435F08

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: String function: 00402073 appears 51 times
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: String function: 00432B90 appears 53 times
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: String function: 00432525 appears 41 times

Source: DHL AWB_NO_92847309329.exe, 00000000.00000000.1728391720.000000000067C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameslCn.exeF vs DHL AWB_NO_92847309329.exe
Source: DHL AWB_NO_92847309329.exe, 00000000.00000002.1806575207.0000000003A69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs DHL AWB_NO_92847309329.exe
Source: DHL AWB_NO_92847309329.exe, 00000000.00000002.1799386530.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs DHL AWB_NO_92847309329.exe
Source: DHL AWB_NO_92847309329.exe, 00000000.00000002.1811890323.0000000009A50000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs DHL AWB_NO_92847309329.exe
Source: DHL AWB_NO_92847309329.exe	Binary or memory string: OriginalFilenameslCn.exeF vs DHL AWB_NO_92847309329.exe

Source: DHL AWB_NO_92847309329.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 12.2.rjOyFV.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 12.2.rjOyFV.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 12.2.rjOyFV.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0.2.DHL AWB_NO_92847309329.exe.45864a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.DHL AWB_NO_92847309329.exe.45864a0.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.DHL AWB_NO_92847309329.exe.45864a0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0.2.DHL AWB_NO_92847309329.exe.3b55670.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.DHL AWB_NO_92847309329.exe.3b55670.3.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.DHL AWB_NO_92847309329.exe.3b55670.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 12.2.rjOyFV.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 12.2.rjOyFV.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 12.2.rjOyFV.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0.2.DHL AWB_NO_92847309329.exe.45864a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.DHL AWB_NO_92847309329.exe.45864a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0.2.DHL AWB_NO_92847309329.exe.3b55670.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.DHL AWB_NO_92847309329.exe.3b55670.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0.2.DHL AWB_NO_92847309329.exe.3a7e790.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.DHL AWB_NO_92847309329.exe.3a7e790.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0000000C.00000002.1865064204.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000C.00000002.1865064204.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0000000C.00000002.1865064204.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 00000000.00000002.1806575207.0000000004586000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000000.00000002.1806575207.0000000003A69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: DHL AWB_NO_92847309329.exe PID: 3120, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: rjOyFV.exe PID: 7524, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: DHL AWB_NO_92847309329.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: rjOyFV.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.DHL AWB_NO_92847309329.exe.7000000.4.raw.unpack, at4ONG9F0NYCELN5Tj.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.DHL AWB_NO_92847309329.exe.3a7e790.2.raw.unpack, at4ONG9F0NYCELN5Tj.cs	Cryptographic APIs: 'CreateDecryptor'

Source: 0.2.DHL AWB_NO_92847309329.exe.9a50000.5.raw.unpack, ujnbt23axdywEjt9d5.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.DHL AWB_NO_92847309329.exe.9a50000.5.raw.unpack, owon38FMyAnPm1ZsOx.cs	Security API names: _0020.SetAccessControl
Source: 0.2.DHL AWB_NO_92847309329.exe.9a50000.5.raw.unpack, owon38FMyAnPm1ZsOx.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.DHL AWB_NO_92847309329.exe.9a50000.5.raw.unpack, owon38FMyAnPm1ZsOx.cs	Security API names: _0020.AddAccessRule
Source: 0.2.DHL AWB_NO_92847309329.exe.3c0c490.0.raw.unpack, ujnbt23axdywEjt9d5.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.DHL AWB_NO_92847309329.exe.3c0c490.0.raw.unpack, owon38FMyAnPm1ZsOx.cs	Security API names: _0020.SetAccessControl
Source: 0.2.DHL AWB_NO_92847309329.exe.3c0c490.0.raw.unpack, owon38FMyAnPm1ZsOx.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.DHL AWB_NO_92847309329.exe.3c0c490.0.raw.unpack, owon38FMyAnPm1ZsOx.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winEXE@18/12@8/2

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe

Code function: 12_2_00415C90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,

12_2_00415C90

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe

Code function: 12_2_0040E2E7 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,Process32NextW,CloseHandle,

12_2_0040E2E7

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe

Code function: 12_2_00419493 FindResourceA,LoadResource,LockResource,SizeofResource,

12_2_00419493

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe

Code function: 12_2_00418A00 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

12_2_00418A00

Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe

File created: C:\Users\user\AppData\Roaming\rjOyFV.exe

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6968:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7472:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5232:120:WilError_03
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Mutant created: \Sessions\1\BaseNamedObjects\764-0XPV9J

Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe

File created: C:\Users\user\AppData\Local\Temp\tmpE78A.tmp

Source: DHL AWB_NO_92847309329.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: DHL AWB_NO_92847309329.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: rjOyFV.exe.0.dr	Binary or memory string: INSERT INTO Games (user_id, wins, ties, losses) VALUES ((SELECT id FROM Users WHERE id = {0}), 0, 1, 0);tiesaUPDATE Games SET ties = {0} WHERE user_id = {1};
Source: rjOyFV.exe.0.dr	Binary or memory string: INSERT INTO Games (user_id, wins, ties, losses) VALUES ((SELECT id FROM Users WHERE id = {0}), 1, 0, 0);winsaUPDATE Games SET wins = {0} WHERE user_id = {1};
Source: rjOyFV.exe.0.dr	Binary or memory string: INSERT INTO Games (user_id, wins, ties, losses) VALUES ((SELECT id FROM Users WHERE id = {0}), 0, 0, 1);

Source: DHL AWB_NO_92847309329.exe

ReversingLabs: Detection: 39%

Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe

File read: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe

Source: unknown	Process created: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe "C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe"
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rjOyFV.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rjOyFV" /XML "C:\Users\user\AppData\Local\Temp\tmpE78A.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process created: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe "C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\rjOyFV.exe C:\Users\user\AppData\Roaming\rjOyFV.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rjOyFV" /XML "C:\Users\user\AppData\Local\Temp\tmp36E.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process created: C:\Users\user\AppData\Roaming\rjOyFV.exe "C:\Users\user\AppData\Roaming\rjOyFV.exe"
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process created: C:\Users\user\AppData\Roaming\rjOyFV.exe "C:\Users\user\AppData\Roaming\rjOyFV.exe"
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rjOyFV.exe"	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rjOyFV" /XML "C:\Users\user\AppData\Local\Temp\tmpE78A.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process created: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe "C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rjOyFV" /XML "C:\Users\user\AppData\Local\Temp\tmp36E.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process created: C:\Users\user\AppData\Roaming\rjOyFV.exe "C:\Users\user\AppData\Roaming\rjOyFV.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process created: C:\Users\user\AppData\Roaming\rjOyFV.exe "C:\Users\user\AppData\Roaming\rjOyFV.exe"	Jump to behavior

Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

.NET source code contains method to dynamically call methods (often used by packers)

Source: DHL AWB_NO_92847309329.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: DHL AWB_NO_92847309329.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: DHL AWB_NO_92847309329.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: slCn.pdbSHA256y! source: DHL AWB_NO_92847309329.exe, rjOyFV.exe.0.dr
Source:	Binary string: slCn.pdb source: DHL AWB_NO_92847309329.exe, rjOyFV.exe.0.dr

Data Obfuscation

Source: 0.2.DHL AWB_NO_92847309329.exe.7000000.4.raw.unpack, at4ONG9F0NYCELN5Tj.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{cPRyvIfYviaTKciquO(typeof(IntPtr).TypeHandle),cPRyvIfYviaTKciquO(typeof(Type).TypeHandle)})
Source: 0.2.DHL AWB_NO_92847309329.exe.3a7e790.2.raw.unpack, at4ONG9F0NYCELN5Tj.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{cPRyvIfYviaTKciquO(typeof(IntPtr).TypeHandle),cPRyvIfYviaTKciquO(typeof(Type).TypeHandle)})

.NET source code contains potential unpacker

Source: DHL AWB_NO_92847309329.exe, FormLogin.cs	.Net Code: InitializeComponent
Source: rjOyFV.exe.0.dr, FormLogin.cs	.Net Code: InitializeComponent
Source: 0.2.DHL AWB_NO_92847309329.exe.9a50000.5.raw.unpack, owon38FMyAnPm1ZsOx.cs	.Net Code: U22irSVtQR System.Reflection.Assembly.Load(byte[])
Source: 0.2.DHL AWB_NO_92847309329.exe.3c0c490.0.raw.unpack, owon38FMyAnPm1ZsOx.cs	.Net Code: U22irSVtQR System.Reflection.Assembly.Load(byte[])

Source: DHL AWB_NO_92847309329.exe

Static PE information: 0x9D2FE497 [Sat Jul 26 16:53:43 2053 UTC]

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe

Code function: 12_2_0041A8DA LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

12_2_0041A8DA

Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Code function: 0_2_072A8F80 pushfd ; retf	0_2_072A8F81
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 7_2_07328F80 pushfd ; retf	7_2_07328F81
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_004000D8 push es; iretd	12_2_004000D9
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_0040008C push es; iretd	12_2_0040008D
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_004542E6 push ecx; ret	12_2_004542F9
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_0045B4FD push esi; ret	12_2_0045B506
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_00432BD6 push ecx; ret	12_2_00432BE9
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_00454C08 push eax; ret	12_2_00454C26

Source: DHL AWB_NO_92847309329.exe	Static PE information: section name: .text entropy: 7.96145220092769
Source: rjOyFV.exe.0.dr	Static PE information: section name: .text entropy: 7.96145220092769

Source: 0.2.DHL AWB_NO_92847309329.exe.9a50000.5.raw.unpack, FwUsfGsLcp9SV5JmiRr.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'EOyfSS0i0n', 'vbDftDYtbn', 'zVDfpTLgP9', 'hNofOs2IkJ', 'MJOf2qjgLq', 'fM4fxuhxHX', 'WpHfQh7wJp'
Source: 0.2.DHL AWB_NO_92847309329.exe.9a50000.5.raw.unpack, w7fBJrZ8R5E16gwMrB.cs	High entropy of concatenated method names: 'xFSUKjivnb', 'rnoUu3gOtV', 'xiNUbUHtI5', 'YNeUvRMVCt', 'vjdUHKJPyq', 'oRNUCAy6M6', 'DbcUFuRfPU', 'jQJUjoWTyo', 'pJ7UcfsRQJ', 'fYiU7S93x9'
Source: 0.2.DHL AWB_NO_92847309329.exe.9a50000.5.raw.unpack, OBuQL1b1bZCTxNc2AO.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'WTshD6kHka', 'NvGhY4fbjQ', 'aRLhzqEcSb', 'FtVLw2iRw6', 'dtJLsmnCqf', 'wyoLhXqMkT', 'wvcLLnMuRx', 'i8bqYuK9EmLYVuNvKXj'
Source: 0.2.DHL AWB_NO_92847309329.exe.9a50000.5.raw.unpack, OFFj3MxvZrR3IWDV4Q.cs	High entropy of concatenated method names: 'DcMBZO4Nrb', 'SZFBYdfdYT', 'BBeUw7ZNgW', 'PysUs8bE2g', 'CXsB0ohwpE', 'bHhBGroshw', 'uwCBdRiTAP', 'XOGBSiGL8X', 'A6VBtM9Bvs', 'WwQBpHborX'
Source: 0.2.DHL AWB_NO_92847309329.exe.9a50000.5.raw.unpack, TUmCwnPmDMweLntJdj.cs	High entropy of concatenated method names: 'ir4v4aKFdM', 'sMpvasxOk1', 'xOSbgXwH6a', 'LfAbeby7wh', 'k0lb9mi6cl', 'UI8b59f51O', 'uQpbWOcuto', 'NRxbqbWim8', 'zRebXdqswy', 'rSabNH2BcJ'
Source: 0.2.DHL AWB_NO_92847309329.exe.9a50000.5.raw.unpack, lmOwuLeCnoJX9fQ2RL.cs	High entropy of concatenated method names: 'CGaHyOpaQV', 'MXqH8pKaD1', 'T46HrwwrJm', 'LbDHIMDkEN', 'S1vHEPoFs6', 'U9EHaPRtIX', 'QB0HmcXpOt', 'B5fHPyf9eo', 'Gpuy3u4BQmtlVpTnSi2', 'KjC35741MhILkXSiiuZ'
Source: 0.2.DHL AWB_NO_92847309329.exe.9a50000.5.raw.unpack, dCqRcmdw9F2EyofPbR.cs	High entropy of concatenated method names: 'n11M3Yq2AF', 'ghxMmqlqbE', 'oI6M6yOQtk', 'erkM1iueXP', 'DZWMe649Sp', 'hlJM9WL1Dn', 'THLMWOwLeA', 'eN3Mqj5yV4', 'TnKMNYw98j', 'TdXM0vjDxA'
Source: 0.2.DHL AWB_NO_92847309329.exe.9a50000.5.raw.unpack, X8VgHhD0b6twgSkh0B.cs	High entropy of concatenated method names: 'c0MU6XaZh2', 'mX0U1yOgck', 'qrCUg5Vhcd', 'S38UedCnks', 'HCEUSofwu3', 'Tl3U9KGpSW', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.DHL AWB_NO_92847309329.exe.9a50000.5.raw.unpack, l3UePJshXGu7lflrnWF.cs	High entropy of concatenated method names: 'LI4f8AdT1J', 'vQlfnf0pK2', 'LgPfr5wsYf', 'bZj7jusOoGep39ViEW4', 'XXykSNsd8Zlq87Bi8gM', 'tbk86HsUt8rI8iL1YZM', 'g14ykesAEKj6KcSTyI6'
Source: 0.2.DHL AWB_NO_92847309329.exe.9a50000.5.raw.unpack, AZxXtJhPeEscRauqTp.cs	High entropy of concatenated method names: 'Sshr0SmRH', 'l5oIDglu1', 'XcdEXoWOn', 'V1baKOBkO', 'PjXml2saj', 'dlTPTeZEq', 'vAdMGi3YsRnS1I2lQG', 'zsVUWFV8iX8k7vH8v7', 'I1kUrbhib', 'GX1fkAdVw'
Source: 0.2.DHL AWB_NO_92847309329.exe.9a50000.5.raw.unpack, ujnbt23axdywEjt9d5.cs	High entropy of concatenated method names: 'RH1uS3YOGq', 'YZeuteKguV', 'w5Oup2mpT0', 'V5WuOaxm63', 'XNvu2xksrF', 'UQduxHmUma', 'HiAuQIsvUN', 'r7fuZ2tkPI', 'OPluDDSkav', 'svhuYYVUxL'
Source: 0.2.DHL AWB_NO_92847309329.exe.9a50000.5.raw.unpack, AyLfqWSdg49u33fu78.cs	High entropy of concatenated method names: 'PVgJNPe2bG', 'feCJGD7mvM', 'qkFJShCUK1', 'ABAJtgVAfy', 'zDtJ12dSQl', 'edTJg2ml22', 'YuiJeIIyYo', 'dlIJ9eCND4', 'NMZJ5MHPSY', 'SSpJW5xKra'
Source: 0.2.DHL AWB_NO_92847309329.exe.9a50000.5.raw.unpack, UEkifs6ZaAsx2fSjGX.cs	High entropy of concatenated method names: 'TFAHTEm4eA', 'kgjHuT0reb', 'kGEHvRjV4r', 'qc9HCJw7Xc', 'KLoHFOtvxL', 'grjv2oyFDY', 'KEFvxRRZhG', 'HW3vQ79sSc', 'SGkvZo0MRC', 'SddvDTlTIi'
Source: 0.2.DHL AWB_NO_92847309329.exe.9a50000.5.raw.unpack, g3jT4JugK4ciYhi4t6.cs	High entropy of concatenated method names: 'Dispose', 'oX7sDea0pY', 'KI6h1rG4lc', 'h1y11FPkaM', 'eV7sYfBJr8', 'u5Esz16gwM', 'ProcessDialogKey', 'zBZhw8VgHh', 'Ob6hstwgSk', 'c0BhhyDNbn'
Source: 0.2.DHL AWB_NO_92847309329.exe.9a50000.5.raw.unpack, bvfL6fmZhaIH14ikJV.cs	High entropy of concatenated method names: 'YohbIN56St', 'X9rbEGpQkL', 'NhFb3uybl4', 'gGebmvjnqO', 'RAQbJTwloI', 'kLtbA16I95', 'a1ebBtCtZE', 'UTxbUUBc3C', 'axrbo6tLb3', 'FnIbfmwymo'
Source: 0.2.DHL AWB_NO_92847309329.exe.9a50000.5.raw.unpack, wDNbn3YOSvqCWu6qit.cs	High entropy of concatenated method names: 'liBoscUDhP', 'z9roL6Npf1', 'tZqoiLOoyk', 'U0roKKokIF', 'EEvouD1Bpk', 'wdbovGRtZN', 'lLaoHsKcoJ', 'BrOUQKNNuO', 'goRUZDJX8I', 'gssUDj0PgS'
Source: 0.2.DHL AWB_NO_92847309329.exe.9a50000.5.raw.unpack, ob7GS2WUxTdes4RfPh.cs	High entropy of concatenated method names: 'VouCKHWf0d', 'c1nCb4up35', 'hVICHHdoFS', 'xu6HYkGwEv', 'pHmHzkW5fO', 'aq8Cw5HM4p', 'b3aCsc175c', 'fXWChcJkv5', 'AvUCLnmMTO', 'njTCiIEnQf'
Source: 0.2.DHL AWB_NO_92847309329.exe.9a50000.5.raw.unpack, owon38FMyAnPm1ZsOx.cs	High entropy of concatenated method names: 'lMVLTxymBL', 'cF8LKFILki', 'EqsLulluoy', 'NuBLbVJ3Jh', 'bcULvSqehS', 'IGYLHONutH', 'XAyLCkriTn', 'iN1LF78R5w', 'yASLj9sOcP', 'Wi3LcglEjO'
Source: 0.2.DHL AWB_NO_92847309329.exe.9a50000.5.raw.unpack, hmyUGRXdVcpbArMirs.cs	High entropy of concatenated method names: 'cdDC8MPXlv', 'GkVCnOO9hf', 'st7CrCu1lA', 'yQHCI8Znyt', 'oK6C41OWZL', 'whFCEYS8qq', 'wdECab5IEW', 'I0eC3Lf2KM', 'vuhCmxcrYo', 'p0tCPVqGjA'
Source: 0.2.DHL AWB_NO_92847309329.exe.9a50000.5.raw.unpack, NY2la8sw3wYuYX3jq1v.cs	High entropy of concatenated method names: 'Vu4o8n8o4e', 'iybonTlRFT', 'Me2ordfdD7', 'yjdoIQJipX', 'baeo4adyfe', 'IE0oEiEFN3', 'tphoarklj2', 'oFKo3vqZAj', 'YD9omb7Vi7', 'iI7oPZvuDk'
Source: 0.2.DHL AWB_NO_92847309329.exe.9a50000.5.raw.unpack, NY3q5EOhSKedXn4Rvg.cs	High entropy of concatenated method names: 'US3Bc814ko', 'NoNB71WYu0', 'ToString', 'hnbBKMQqVs', 'h8HBucQitA', 'YQbBbBVW84', 'oZdBvnRir3', 'HONBHu4vjn', 'DWMBCLwyb3', 'SaeBFihk6h'
Source: 0.2.DHL AWB_NO_92847309329.exe.9a50000.5.raw.unpack, oYOuN0ie7Bxa0Vofoe.cs	High entropy of concatenated method names: 'kyRsCjnbt2', 'CxdsFywEjt', 'sZhscaIH14', 'dkJs7VpUmC', 'ytJsJdj2Ek', 'dfssAZaAsx', 'otcPmaU6GP4VsbBuIc', 'B652xrA4eShiDlgeAD', 'tRqssYvBMD', 'PIWsLkEqL8'
Source: 0.2.DHL AWB_NO_92847309329.exe.7000000.4.raw.unpack, MainForm.cs	High entropy of concatenated method names: 'YgSHuitkd', 'aiP2N9Y7C', 'gHQx79i6W', 'AGv9PUWi3', 'QMsbTCblb', 'beIGikGSa', 'clTPOt4ON', 'fF0vNYCEL', 'C5TCjFvvv', 'ln3BTm5Rw'
Source: 0.2.DHL AWB_NO_92847309329.exe.7000000.4.raw.unpack, at4ONG9F0NYCELN5Tj.cs	High entropy of concatenated method names: 'nVoxarmF975Urj2p8sJ', 'tIta6WmWAkGE6iVCWgt', 'Y8N2DklRel', 'hpreq0m6Xcu1pidWj9b', 'KFC0XvmT5N8D2LR210h', 'a5foommXYpDAHBV6LjL', 'd3wYgimbV84NAc2fo7p', 'ItvPp5mqvV1adE08UOg', 'KA7rbWmJ0EMRNxYE2Vd', 'PPtPBAmQMyT7QpfjJpI'
Source: 0.2.DHL AWB_NO_92847309329.exe.3c0c490.0.raw.unpack, FwUsfGsLcp9SV5JmiRr.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'EOyfSS0i0n', 'vbDftDYtbn', 'zVDfpTLgP9', 'hNofOs2IkJ', 'MJOf2qjgLq', 'fM4fxuhxHX', 'WpHfQh7wJp'
Source: 0.2.DHL AWB_NO_92847309329.exe.3c0c490.0.raw.unpack, w7fBJrZ8R5E16gwMrB.cs	High entropy of concatenated method names: 'xFSUKjivnb', 'rnoUu3gOtV', 'xiNUbUHtI5', 'YNeUvRMVCt', 'vjdUHKJPyq', 'oRNUCAy6M6', 'DbcUFuRfPU', 'jQJUjoWTyo', 'pJ7UcfsRQJ', 'fYiU7S93x9'
Source: 0.2.DHL AWB_NO_92847309329.exe.3c0c490.0.raw.unpack, OBuQL1b1bZCTxNc2AO.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'WTshD6kHka', 'NvGhY4fbjQ', 'aRLhzqEcSb', 'FtVLw2iRw6', 'dtJLsmnCqf', 'wyoLhXqMkT', 'wvcLLnMuRx', 'i8bqYuK9EmLYVuNvKXj'
Source: 0.2.DHL AWB_NO_92847309329.exe.3c0c490.0.raw.unpack, OFFj3MxvZrR3IWDV4Q.cs	High entropy of concatenated method names: 'DcMBZO4Nrb', 'SZFBYdfdYT', 'BBeUw7ZNgW', 'PysUs8bE2g', 'CXsB0ohwpE', 'bHhBGroshw', 'uwCBdRiTAP', 'XOGBSiGL8X', 'A6VBtM9Bvs', 'WwQBpHborX'
Source: 0.2.DHL AWB_NO_92847309329.exe.3c0c490.0.raw.unpack, TUmCwnPmDMweLntJdj.cs	High entropy of concatenated method names: 'ir4v4aKFdM', 'sMpvasxOk1', 'xOSbgXwH6a', 'LfAbeby7wh', 'k0lb9mi6cl', 'UI8b59f51O', 'uQpbWOcuto', 'NRxbqbWim8', 'zRebXdqswy', 'rSabNH2BcJ'
Source: 0.2.DHL AWB_NO_92847309329.exe.3c0c490.0.raw.unpack, lmOwuLeCnoJX9fQ2RL.cs	High entropy of concatenated method names: 'CGaHyOpaQV', 'MXqH8pKaD1', 'T46HrwwrJm', 'LbDHIMDkEN', 'S1vHEPoFs6', 'U9EHaPRtIX', 'QB0HmcXpOt', 'B5fHPyf9eo', 'Gpuy3u4BQmtlVpTnSi2', 'KjC35741MhILkXSiiuZ'
Source: 0.2.DHL AWB_NO_92847309329.exe.3c0c490.0.raw.unpack, dCqRcmdw9F2EyofPbR.cs	High entropy of concatenated method names: 'n11M3Yq2AF', 'ghxMmqlqbE', 'oI6M6yOQtk', 'erkM1iueXP', 'DZWMe649Sp', 'hlJM9WL1Dn', 'THLMWOwLeA', 'eN3Mqj5yV4', 'TnKMNYw98j', 'TdXM0vjDxA'
Source: 0.2.DHL AWB_NO_92847309329.exe.3c0c490.0.raw.unpack, X8VgHhD0b6twgSkh0B.cs	High entropy of concatenated method names: 'c0MU6XaZh2', 'mX0U1yOgck', 'qrCUg5Vhcd', 'S38UedCnks', 'HCEUSofwu3', 'Tl3U9KGpSW', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.DHL AWB_NO_92847309329.exe.3c0c490.0.raw.unpack, l3UePJshXGu7lflrnWF.cs	High entropy of concatenated method names: 'LI4f8AdT1J', 'vQlfnf0pK2', 'LgPfr5wsYf', 'bZj7jusOoGep39ViEW4', 'XXykSNsd8Zlq87Bi8gM', 'tbk86HsUt8rI8iL1YZM', 'g14ykesAEKj6KcSTyI6'
Source: 0.2.DHL AWB_NO_92847309329.exe.3c0c490.0.raw.unpack, AZxXtJhPeEscRauqTp.cs	High entropy of concatenated method names: 'Sshr0SmRH', 'l5oIDglu1', 'XcdEXoWOn', 'V1baKOBkO', 'PjXml2saj', 'dlTPTeZEq', 'vAdMGi3YsRnS1I2lQG', 'zsVUWFV8iX8k7vH8v7', 'I1kUrbhib', 'GX1fkAdVw'
Source: 0.2.DHL AWB_NO_92847309329.exe.3c0c490.0.raw.unpack, ujnbt23axdywEjt9d5.cs	High entropy of concatenated method names: 'RH1uS3YOGq', 'YZeuteKguV', 'w5Oup2mpT0', 'V5WuOaxm63', 'XNvu2xksrF', 'UQduxHmUma', 'HiAuQIsvUN', 'r7fuZ2tkPI', 'OPluDDSkav', 'svhuYYVUxL'
Source: 0.2.DHL AWB_NO_92847309329.exe.3c0c490.0.raw.unpack, AyLfqWSdg49u33fu78.cs	High entropy of concatenated method names: 'PVgJNPe2bG', 'feCJGD7mvM', 'qkFJShCUK1', 'ABAJtgVAfy', 'zDtJ12dSQl', 'edTJg2ml22', 'YuiJeIIyYo', 'dlIJ9eCND4', 'NMZJ5MHPSY', 'SSpJW5xKra'
Source: 0.2.DHL AWB_NO_92847309329.exe.3c0c490.0.raw.unpack, UEkifs6ZaAsx2fSjGX.cs	High entropy of concatenated method names: 'TFAHTEm4eA', 'kgjHuT0reb', 'kGEHvRjV4r', 'qc9HCJw7Xc', 'KLoHFOtvxL', 'grjv2oyFDY', 'KEFvxRRZhG', 'HW3vQ79sSc', 'SGkvZo0MRC', 'SddvDTlTIi'
Source: 0.2.DHL AWB_NO_92847309329.exe.3c0c490.0.raw.unpack, g3jT4JugK4ciYhi4t6.cs	High entropy of concatenated method names: 'Dispose', 'oX7sDea0pY', 'KI6h1rG4lc', 'h1y11FPkaM', 'eV7sYfBJr8', 'u5Esz16gwM', 'ProcessDialogKey', 'zBZhw8VgHh', 'Ob6hstwgSk', 'c0BhhyDNbn'
Source: 0.2.DHL AWB_NO_92847309329.exe.3c0c490.0.raw.unpack, bvfL6fmZhaIH14ikJV.cs	High entropy of concatenated method names: 'YohbIN56St', 'X9rbEGpQkL', 'NhFb3uybl4', 'gGebmvjnqO', 'RAQbJTwloI', 'kLtbA16I95', 'a1ebBtCtZE', 'UTxbUUBc3C', 'axrbo6tLb3', 'FnIbfmwymo'
Source: 0.2.DHL AWB_NO_92847309329.exe.3c0c490.0.raw.unpack, wDNbn3YOSvqCWu6qit.cs	High entropy of concatenated method names: 'liBoscUDhP', 'z9roL6Npf1', 'tZqoiLOoyk', 'U0roKKokIF', 'EEvouD1Bpk', 'wdbovGRtZN', 'lLaoHsKcoJ', 'BrOUQKNNuO', 'goRUZDJX8I', 'gssUDj0PgS'
Source: 0.2.DHL AWB_NO_92847309329.exe.3c0c490.0.raw.unpack, ob7GS2WUxTdes4RfPh.cs	High entropy of concatenated method names: 'VouCKHWf0d', 'c1nCb4up35', 'hVICHHdoFS', 'xu6HYkGwEv', 'pHmHzkW5fO', 'aq8Cw5HM4p', 'b3aCsc175c', 'fXWChcJkv5', 'AvUCLnmMTO', 'njTCiIEnQf'
Source: 0.2.DHL AWB_NO_92847309329.exe.3c0c490.0.raw.unpack, owon38FMyAnPm1ZsOx.cs	High entropy of concatenated method names: 'lMVLTxymBL', 'cF8LKFILki', 'EqsLulluoy', 'NuBLbVJ3Jh', 'bcULvSqehS', 'IGYLHONutH', 'XAyLCkriTn', 'iN1LF78R5w', 'yASLj9sOcP', 'Wi3LcglEjO'
Source: 0.2.DHL AWB_NO_92847309329.exe.3c0c490.0.raw.unpack, hmyUGRXdVcpbArMirs.cs	High entropy of concatenated method names: 'cdDC8MPXlv', 'GkVCnOO9hf', 'st7CrCu1lA', 'yQHCI8Znyt', 'oK6C41OWZL', 'whFCEYS8qq', 'wdECab5IEW', 'I0eC3Lf2KM', 'vuhCmxcrYo', 'p0tCPVqGjA'
Source: 0.2.DHL AWB_NO_92847309329.exe.3c0c490.0.raw.unpack, NY2la8sw3wYuYX3jq1v.cs	High entropy of concatenated method names: 'Vu4o8n8o4e', 'iybonTlRFT', 'Me2ordfdD7', 'yjdoIQJipX', 'baeo4adyfe', 'IE0oEiEFN3', 'tphoarklj2', 'oFKo3vqZAj', 'YD9omb7Vi7', 'iI7oPZvuDk'
Source: 0.2.DHL AWB_NO_92847309329.exe.3c0c490.0.raw.unpack, NY3q5EOhSKedXn4Rvg.cs	High entropy of concatenated method names: 'US3Bc814ko', 'NoNB71WYu0', 'ToString', 'hnbBKMQqVs', 'h8HBucQitA', 'YQbBbBVW84', 'oZdBvnRir3', 'HONBHu4vjn', 'DWMBCLwyb3', 'SaeBFihk6h'
Source: 0.2.DHL AWB_NO_92847309329.exe.3c0c490.0.raw.unpack, oYOuN0ie7Bxa0Vofoe.cs	High entropy of concatenated method names: 'kyRsCjnbt2', 'CxdsFywEjt', 'sZhscaIH14', 'dkJs7VpUmC', 'ytJsJdj2Ek', 'dfssAZaAsx', 'otcPmaU6GP4VsbBuIc', 'B652xrA4eShiDlgeAD', 'tRqssYvBMD', 'PIWsLkEqL8'
Source: 0.2.DHL AWB_NO_92847309329.exe.3a7e790.2.raw.unpack, MainForm.cs	High entropy of concatenated method names: 'YgSHuitkd', 'aiP2N9Y7C', 'gHQx79i6W', 'AGv9PUWi3', 'QMsbTCblb', 'beIGikGSa', 'clTPOt4ON', 'fF0vNYCEL', 'C5TCjFvvv', 'ln3BTm5Rw'
Source: 0.2.DHL AWB_NO_92847309329.exe.3a7e790.2.raw.unpack, at4ONG9F0NYCELN5Tj.cs	High entropy of concatenated method names: 'nVoxarmF975Urj2p8sJ', 'tIta6WmWAkGE6iVCWgt', 'Y8N2DklRel', 'hpreq0m6Xcu1pidWj9b', 'KFC0XvmT5N8D2LR210h', 'a5foommXYpDAHBV6LjL', 'd3wYgimbV84NAc2fo7p', 'ItvPp5mqvV1adE08UOg', 'KA7rbWmJ0EMRNxYE2Vd', 'PPtPBAmQMyT7QpfjJpI'

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe

Code function: 12_2_004063C6 ShellExecuteW,URLDownloadToFileW,

12_2_004063C6

Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe

File created: C:\Users\user\AppData\Roaming\rjOyFV.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rjOyFV" /XML "C:\Users\user\AppData\Local\Temp\tmpE78A.tmp"

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe

Code function: 12_2_00418A00 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

12_2_00418A00

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe

12_2_0041A8DA

Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: DHL AWB_NO_92847309329.exe PID: 3120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rjOyFV.exe PID: 7280, type: MEMORYSTR

Delayed program exit found

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe

Code function: 12_2_0040E18D Sleep,ExitProcess,

12_2_0040E18D

Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Memory allocated: C90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Memory allocated: 2A60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Memory allocated: 1000000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Memory allocated: 9C50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Memory allocated: AC50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Memory allocated: AEA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Memory allocated: BEA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Memory allocated: 1440000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Memory allocated: 2E50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Memory allocated: 2D90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Memory allocated: 7960000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Memory allocated: 8960000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Memory allocated: 8B00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Memory allocated: 9B00000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe

Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,

12_2_004186FE

Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6703	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3015	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Window / User API: threadDelayed 2785	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Window / User API: threadDelayed 7206	Jump to behavior

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe

API coverage: 5.2 %

Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe TID: 2708	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7252	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe TID: 7268	Thread sleep count: 2785 > 30	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe TID: 7268	Thread sleep time: -8355000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe TID: 7268	Thread sleep count: 7206 > 30	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe TID: 7268	Thread sleep time: -21618000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe TID: 7300	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_0041A01B FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	12_2_0041A01B
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_0040B28E FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	12_2_0040B28E
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_0040838E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	12_2_0040838E
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_004087A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	12_2_004087A0
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_00407848 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	12_2_00407848
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_004068CD FindFirstFileW,FindNextFileW,	12_2_004068CD
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_0040AA71 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	12_2_0040AA71
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_00417AAB FindFirstFileW,FindNextFileW,FindNextFileW,	12_2_00417AAB
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_0040AC78 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	12_2_0040AC78

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe

Code function: 12_2_00406D28 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

12_2_00406D28

Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: DHL AWB_NO_92847309329.exe, 00000006.00000002.4182257195.000000000161E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWv
Source: DHL AWB_NO_92847309329.exe, 00000006.00000002.4182257195.0000000001617000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: DHL AWB_NO_92847309329.exe, 00000006.00000002.4182257195.0000000001587000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe

Code function: 12_2_004327AE IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

12_2_004327AE

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe

12_2_0041A8DA

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe

Code function: 12_2_004407B5 mov eax, dword ptr fs:[00000030h]

12_2_004407B5

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe

Code function: 12_2_00410763 SetLastError,GetNativeSystemInfo,SetLastError,GetProcessHeap,HeapAlloc,SetLastError,

12_2_00410763

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_004327AE IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_004327AE
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_004328FC SetUnhandledExceptionFilter,	12_2_004328FC
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_004398AC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_004398AC
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: 12_2_00432D5C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_00432D5C

Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe

Memory allocated: page read and write | page guard

Adds a directory exclusion to Windows Defender

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rjOyFV.exe"
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rjOyFV.exe"			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Memory written: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Memory written: C:\Users\user\AppData\Roaming\rjOyFV.exe base: 400000 value starts with: 4D5A			Jump to behavior

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe

Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe

12_2_00410B5C

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe

Code function: 12_2_004175E1 mouse_event,

12_2_004175E1

Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rjOyFV.exe"	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rjOyFV" /XML "C:\Users\user\AppData\Local\Temp\tmpE78A.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Process created: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe "C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rjOyFV" /XML "C:\Users\user\AppData\Local\Temp\tmp36E.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process created: C:\Users\user\AppData\Roaming\rjOyFV.exe "C:\Users\user\AppData\Roaming\rjOyFV.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Process created: C:\Users\user\AppData\Roaming\rjOyFV.exe "C:\Users\user\AppData\Roaming\rjOyFV.exe"	Jump to behavior

Source: DHL AWB_NO_92847309329.exe, 00000006.00000002.4182257195.00000000015E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: DHL AWB_NO_92847309329.exe, 00000006.00000002.4182257195.00000000015E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe

Code function: 12_2_004329DA cpuid

12_2_004329DA

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: EnumSystemLocalesW,	12_2_0044F17B
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: EnumSystemLocalesW,	12_2_0044F130
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: EnumSystemLocalesW,	12_2_0044F216
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	12_2_0044F2A3
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: GetLocaleInfoA,	12_2_0040E2BB
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: GetLocaleInfoW,	12_2_0044F4F3
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	12_2_0044F61C
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: GetLocaleInfoW,	12_2_0044F723
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	12_2_0044F7F0
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: EnumSystemLocalesW,	12_2_00445914
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: GetLocaleInfoW,	12_2_00445E1C
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	12_2_0044EEB8

Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Queries volume information: C:\Users\user\AppData\Roaming\rjOyFV.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe

Code function: 12_2_0040A0B0 GetLocalTime,wsprintfW,

12_2_0040A0B0

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe

Code function: 12_2_004195F8 GetUserNameW,

12_2_004195F8

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe

Code function: 12_2_004468DC _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

12_2_004468DC

Source: C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Yara detected PureLog Stealer

Stealing of Sensitive Information

Source: Yara match	File source: 0.2.DHL AWB_NO_92847309329.exe.3a7e790.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL AWB_NO_92847309329.exe.7000000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL AWB_NO_92847309329.exe.7000000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL AWB_NO_92847309329.exe.3a7e790.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1811153341.0000000007000000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1806575207.0000000003A69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Contains functionality to steal Chrome passwords or cookies

Source: Yara match	File source: 12.2.rjOyFV.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL AWB_NO_92847309329.exe.45864a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL AWB_NO_92847309329.exe.3b55670.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rjOyFV.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL AWB_NO_92847309329.exe.45864a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL AWB_NO_92847309329.exe.3b55670.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL AWB_NO_92847309329.exe.3a7e790.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.1865601373.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4182257195.0000000001587000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1865064204.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1806575207.0000000004586000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1806575207.0000000003A69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL AWB_NO_92847309329.exe PID: 3120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL AWB_NO_92847309329.exe PID: 7244, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rjOyFV.exe PID: 7524, type: MEMORYSTR

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe

Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data

12_2_0040A953

Contains functionality to steal Firefox passwords or cookies

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\		12_2_0040AA71
Source: C:\Users\user\AppData\Roaming\rjOyFV.exe	Code function: \key3.db		12_2_0040AA71

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.DHL AWB_NO_92847309329.exe.3a7e790.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL AWB_NO_92847309329.exe.7000000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL AWB_NO_92847309329.exe.7000000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL AWB_NO_92847309329.exe.3a7e790.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1811153341.0000000007000000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1806575207.0000000003A69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: Yara match	File source: 12.2.rjOyFV.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL AWB_NO_92847309329.exe.45864a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL AWB_NO_92847309329.exe.3b55670.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rjOyFV.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL AWB_NO_92847309329.exe.45864a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL AWB_NO_92847309329.exe.3b55670.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL AWB_NO_92847309329.exe.3a7e790.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.1865601373.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4182257195.0000000001587000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1865064204.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1806575207.0000000004586000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1806575207.0000000003A69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL AWB_NO_92847309329.exe PID: 3120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL AWB_NO_92847309329.exe PID: 7244, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rjOyFV.exe PID: 7524, type: MEMORYSTR

Source: C:\Users\user\AppData\Roaming\rjOyFV.exe

Code function: cmd.exe

12_2_0040567A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	12 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 Windows Service	1 Access Token Manipulation	11 Deobfuscate/Decode Files or Information	111 Input Capture	1 Account Discovery	Remote Desktop Protocol	111 Input Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Windows Service	3 Obfuscated Files or Information	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Service Execution	Login Hook	122 Process Injection	22 Software Packing	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	1 Timestomp	LSA Secrets	33 System Information Discovery	SSH	Keylogging	22 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	121 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	31 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	31 Virtualization/Sandbox Evasion	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	122 Process Injection	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
DHL AWB_NO_92847309329.exe	39%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
DHL AWB_NO_92847309329.exe	100%	Avira	TR/AD.Remcos.jplgn
DHL AWB_NO_92847309329.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\rjOyFV.exe	100%	Avira	TR/AD.Remcos.jplgn
C:\Users\user\AppData\Roaming\rjOyFV.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\rjOyFV.exe	39%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Source	Detection	Scanner	Label
http://www.fontbureau.com	0%	URL Reputation	safe
http://www.fontbureau.com/designersG	0%	URL Reputation	safe
http://www.fontbureau.com/designers/?	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.fontbureau.com/designers?	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.fontbureau.com/designers	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://geoplugin.net/json.gp	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.fontbureau.com/designers/cabarga.htmlN	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.com/designers/frere-user.html	0%	URL Reputation	safe
http://geoplugin.net/json.gp/C	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.fontbureau.com/designers8	0%	URL Reputation	safe
http://www.fonts.com	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
geoplugin.net	178.237.33.50	true	false		unknown
windowsocttehe.duckdns.org	96.9.210.71	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
windowsocttehe.duckdns.org	true		unknown
http://geoplugin.net/json.gp	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.fontbureau.com	DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designersG	DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://geoplugin.net/json.gp&	DHL AWB_NO_92847309329.exe, 00000006.00000002.4182257195.0000000001587000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.founder.com.cn/cn/bThe	DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://geoplugin.net/json.gpl	DHL AWB_NO_92847309329.exe, 00000006.00000002.4182257195.0000000001587000.00000004.00000020.00020000.00000000.sdmp, DHL AWB_NO_92847309329.exe, 00000006.00000002.4182257195.00000000015CF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.fontbureau.com/designers?	DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://geoplugin.net/json.gpm	DHL AWB_NO_92847309329.exe, 00000006.00000002.4182257195.0000000001587000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.tiro.com	DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://geoplugin.net/json.gpSystem32	DHL AWB_NO_92847309329.exe, 00000006.00000002.4182257195.0000000001587000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.carterandcone.coml	DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://geoplugin.net/json.gp/C	DHL AWB_NO_92847309329.exe, 00000000.00000002.1806575207.0000000003A69000.00000004.00000800.00020000.00000000.sdmp, DHL AWB_NO_92847309329.exe, 00000000.00000002.1806575207.0000000004586000.00000004.00000800.00020000.00000000.sdmp, rjOyFV.exe, 0000000C.00000002.1865064204.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.kr	DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/DatabaseWalletDataSet.xsd	DHL AWB_NO_92847309329.exe, rjOyFV.exe.0.dr	false		unknown
http://www.zhongyicts.com.cn	DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	DHL AWB_NO_92847309329.exe, 00000000.00000002.1805270956.0000000002AA8000.00000004.00000800.00020000.00000000.sdmp, rjOyFV.exe, 00000007.00000002.1866548298.0000000002E98000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	DHL AWB_NO_92847309329.exe, 00000000.00000002.1810225359.0000000006B22000.00000004.00000800.00020000.00000000.sdmp, DHL AWB_NO_92847309329.exe, 00000000.00000002.1810117079.0000000005A50000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
178.237.33.50	geoplugin.net	Netherlands		8455	ATOM86-ASATOM86NL	false
96.9.210.71	windowsocttehe.duckdns.org	United States		38001	NEWMEDIAEXPRESS-AS-APNewMediaExpressPteLtdSG	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538705
Start date and time:	2024-10-21 17:16:19 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	DHL AWB_NO_92847309329.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winEXE@18/12@8/2
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 99% Number of executed functions: 76 Number of non-executed functions: 196
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): d.8.0.a.e.e.f.b.0.0.0.0.0.0.0.0.5.0.0.0.0.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: DHL AWB_NO_92847309329.exe

Simulations

Behavior and APIs

Time	Type	Description
11:17:21	API Interceptor	4608548x Sleep call for process: DHL AWB_NO_92847309329.exe modified
11:17:22	API Interceptor	32x Sleep call for process: powershell.exe modified
11:17:28	API Interceptor	1x Sleep call for process: rjOyFV.exe modified
16:17:23	Task Scheduler	Run new task: rjOyFV path: C:\Users\user\AppData\Roaming\rjOyFV.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
178.237.33.50	Order_MG2027176.vbs	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	Salary Revision_pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	Scanned_22C-6e24090516030.pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	Order.vbs	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	rIMG465244247443GULFORDEROpmagasinering.cmd	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	1729445225fa0e5768d1d682409147d63519fc74f7a5fbd0985a9e3ffe794cd2fed7b2306d148.dat-decoded.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	duEsmKBlGr.exe	Get hash	malicious	Unknown	Browse	www.geoplugin.net/xml.gp?ip=SEU_IP
	lA0Z0vjXfA.exe	Get hash	malicious	Unknown	Browse	www.geoplugin.net/xml.gp?ip=SEU_IP
	172926254156daf582728190320bacb622ccd105a50446fe4e74bbec68be10e3a78d1b71e6763.dat-decoded.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	SKM_0001810-01-2024-GL-3762.bat	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
geoplugin.net	Order_MG2027176.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	Salary Revision_pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	Scanned_22C-6e24090516030.pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	Order.vbs	Get hash	malicious	Remcos	Browse	178.237.33.50
	rIMG465244247443GULFORDEROpmagasinering.cmd	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	1729445225fa0e5768d1d682409147d63519fc74f7a5fbd0985a9e3ffe794cd2fed7b2306d148.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	172926254156daf582728190320bacb622ccd105a50446fe4e74bbec68be10e3a78d1b71e6763.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	SKM_0001810-01-2024-GL-3762.bat	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NEWMEDIAEXPRESS-AS-APNewMediaExpressPteLtdSG	yakuza.ppc.elf	Get hash	malicious	Unknown	Browse	104.250.106.179
	na.elf	Get hash	malicious	Mirai	Browse	104.250.106.170
	bexq6dM6iT.exe	Get hash	malicious	Unknown	Browse	103.214.8.186
	Ares.x86.elf	Get hash	malicious	Unknown	Browse	104.250.106.159
	7HddY6rYkf.elf	Get hash	malicious	Mirai	Browse	104.250.106.171
	v2z756r9LQ.elf	Get hash	malicious	Unknown	Browse	104.250.106.161
	M2Vf6ASl3g.elf	Get hash	malicious	Unknown	Browse	104.250.106.169
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	104.250.106.159
	VKkfiTAZXP.elf	Get hash	malicious	Gafgyt, Mirai	Browse	43.245.61.2
	sh.elf	Get hash	malicious	Gafgyt	Browse	43.245.61.3
ATOM86-ASATOM86NL	Order_MG2027176.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	Salary Revision_pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	Scanned_22C-6e24090516030.pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	Order.vbs	Get hash	malicious	Remcos	Browse	178.237.33.50
	rIMG465244247443GULFORDEROpmagasinering.cmd	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	1729445225fa0e5768d1d682409147d63519fc74f7a5fbd0985a9e3ffe794cd2fed7b2306d148.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	duEsmKBlGr.exe	Get hash	malicious	Unknown	Browse	178.237.33.50
	lA0Z0vjXfA.exe	Get hash	malicious	Unknown	Browse	178.237.33.50
	172926254156daf582728190320bacb622ccd105a50446fe4e74bbec68be10e3a78d1b71e6763.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	SKM_0001810-01-2024-GL-3762.bat	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50

Process:	C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rjOyFV.exe.log

Process:	C:\Users\user\AppData\Roaming\rjOyFV.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\json[1].json

Process:	C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	960
Entropy (8bit):	5.007342357625525
Encrypted:	false
SSDEEP:	12:tkhEVBnd6UGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkwc:qhEV1dVauKyGX85jvXhNlT3/73clHWro
MD5:	2384C8ED5D39845A7043C8E4AF84F3F2
SHA1:	1A4A72CFF979CDD293034EFDFB35F0C6FA3ABD75
SHA-256:	AFB89F4CFEB681642FBADDAFE06E6BFAA298850FDA6771E80BA97B8A79527465
SHA-512:	387793D3C3700EFA89D4197DFB11FC667C63C6416068DCC2751953FE6C6EEAA4F2534D32F2F8E9EBB2F5119229BDADB173985E6EF106EFFF71180441197F7291
Malicious:	false
Preview:	{. "geoplugin_request":"216.52.183.150",. "geoplugin_status":200,. "geoplugin_delay":"2ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7157",. "geoplugin_longitude":"-74",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.3797706053345555
Encrypted:	false
SSDEEP:	48:fWSU4xympgv4RIoUP7gZ9tK8NPZHUx7u1iMuge//ZmUyus:fLHxv2IfLZ2KRH6Ouggs
MD5:	A84FF30A01D8A35BCDF6976220CB7312
SHA1:	B52FED4434308742EBEAA5BD20A65733B0B638CB
SHA-256:	5B927BEFBE59EAFB9AEAAB84192FCA416546FCC0F2555123C9ECE73454EE798A
SHA-512:	246E86346B9EEF24D703A205F74B3AA5351B6861444C66657E23249A3CA1EDFC82FCB1CA60D9F9365BFD3C2F9B32AA9A41551655A58D6364AF67A4AFD34BA249
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a0f21muy.tc2.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_etv3k0mc.fpf.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r235kwox.5ca.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uzkkmrym.dk2.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp36E.tmp

Process:	C:\Users\user\AppData\Roaming\rjOyFV.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1572
Entropy (8bit):	5.11096846018534
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNta9xvn:cge1wYrFdOFzOzN33ODOiDdKrsuTqv
MD5:	79C915156007E998C133F61E17D1FBA1
SHA1:	D0FB5442B68EA7B3B77CEA70C81CF6287D424910
SHA-256:	9DA5B7C9F0518036E5EBD0B5821BF41532B1C3A4AD8CDD84534F07CDBE1CA023
SHA-512:	081669557C8DD331BF757758E3B264BAD23B704D25BC96DC5C557D1D41AF0F75F28843C55379E99821FDCDCFFB1BE93B8A0012AFC5153790E446DBC04370DB84
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmpE78A.tmp

Process:	C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1572
Entropy (8bit):	5.11096846018534
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNta9xvn:cge1wYrFdOFzOzN33ODOiDdKrsuTqv
MD5:	79C915156007E998C133F61E17D1FBA1
SHA1:	D0FB5442B68EA7B3B77CEA70C81CF6287D424910
SHA-256:	9DA5B7C9F0518036E5EBD0B5821BF41532B1C3A4AD8CDD84534F07CDBE1CA023
SHA-512:	081669557C8DD331BF757758E3B264BAD23B704D25BC96DC5C557D1D41AF0F75F28843C55379E99821FDCDCFFB1BE93B8A0012AFC5153790E446DBC04370DB84
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Roaming\rjOyFV.exe

Process:	C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	955904
Entropy (8bit):	7.95607384096614
Encrypted:	false
SSDEEP:	24576:nUkh5oDiJ31erRs6PXmm7V9R7SoAZA0C8/UYn2xlcX6:nn5oDiZgOCV9RWrtCAU3xi
MD5:	710651FB293DF9922080F5B7A4D10916
SHA1:	A38B66874D59A9E026B2C15E49501E8F4E1FD6B5
SHA-256:	173FA94E725ABC88ACF0D848BDEE94D216A3C74B4492E006405C357824FAB818
SHA-512:	BDC25B6F70BAB4352E7C03AE7FBCD6A9718FE98804D9B24F27DC33B0BBA114F0BAB2D37AF1DE53D4DBE0E2794F3E706DBD3EF3765DE2820BBD48F4B347F132D9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...../...............0.................. ........@.. ....................................@....................................O.......<...............................p............................................ ............... ..H............text...4.... ...................... ..`.rsrc...<...........................@..@.reloc..............................@..B........................H...........XY......y....................................................0............}......}......}......}......}......}.....r...p}.....r...p}.....(....}.....( ...}............}............}......}.....(!......(+......0..)........{.........("...t......\|......(...+...3.....0..)........{.........($...t......\|......(...+...3.....0..)........{.........("...t......\|......(...+...3.....0..)........{.........($...t......\|......(...+...3.&...}......0............{.....+..*.0..

C:\Users\user\AppData\Roaming\rjOyFV.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.95607384096614
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	DHL AWB_NO_92847309329.exe
File size:	955'904 bytes
MD5:	710651fb293df9922080f5b7a4d10916
SHA1:	a38b66874d59a9e026b2c15e49501e8f4e1fd6b5
SHA256:	173fa94e725abc88acf0d848bdee94d216a3c74b4492e006405c357824fab818
SHA512:	bdc25b6f70bab4352e7c03ae7fbcd6a9718fe98804d9b24f27dc33b0bba114f0bab2d37af1de53d4dbe0e2794f3e706dbd3ef3765de2820bbd48f4b347f132d9
SSDEEP:	24576:nUkh5oDiJ31erRs6PXmm7V9R7SoAZA0C8/UYn2xlcX6:nn5oDiZgOCV9RWrtCAU3xi
TLSH:	EE15230033DC9F2BC33E9FF6A8B1816053F2621A65A6F50A6CC211EB56B17475E26F17
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...../...............0.................. ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4ea92e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x9D2FE497 [Sat Jul 26 16:53:43 2053 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xea8da	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xec000	0x63c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xee000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xe81b4	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xe8934	0xe8a00	e2e29f4671963c2e5f03f8d624afd979	False	0.9573849324959699	data	7.96145220092769	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xec000	0x63c	0x800	7f5435f561b1e0f5e9b69d526c680cf5	False	0.34228515625	data	3.5120107667934826	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xee000	0xc	0x200	623dd3204b12e1881e47463482eb493f	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xec090	0x3ac	data			0.4223404255319149
RT_MANIFEST	0xec44c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-21T17:17:33.489439+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	49736	96.9.210.71	52411	TCP
2024-10-21T17:17:35.116764+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49741	178.237.33.50	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 21, 2024 17:17:32.485284090 CEST	49736	52411	192.168.2.4	96.9.210.71
Oct 21, 2024 17:17:32.491245985 CEST	52411	49736	96.9.210.71	192.168.2.4
Oct 21, 2024 17:17:32.492176056 CEST	49736	52411	192.168.2.4	96.9.210.71
Oct 21, 2024 17:17:32.497709036 CEST	49736	52411	192.168.2.4	96.9.210.71
Oct 21, 2024 17:17:32.503623009 CEST	52411	49736	96.9.210.71	192.168.2.4
Oct 21, 2024 17:17:33.446351051 CEST	52411	49736	96.9.210.71	192.168.2.4
Oct 21, 2024 17:17:33.489439011 CEST	49736	52411	192.168.2.4	96.9.210.71
Oct 21, 2024 17:17:33.713114977 CEST	52411	49736	96.9.210.71	192.168.2.4
Oct 21, 2024 17:17:33.719414949 CEST	49736	52411	192.168.2.4	96.9.210.71
Oct 21, 2024 17:17:33.725070953 CEST	52411	49736	96.9.210.71	192.168.2.4
Oct 21, 2024 17:17:33.725132942 CEST	49736	52411	192.168.2.4	96.9.210.71
Oct 21, 2024 17:17:33.730868101 CEST	52411	49736	96.9.210.71	192.168.2.4
Oct 21, 2024 17:17:34.153009892 CEST	52411	49736	96.9.210.71	192.168.2.4
Oct 21, 2024 17:17:34.158487082 CEST	49736	52411	192.168.2.4	96.9.210.71
Oct 21, 2024 17:17:34.163947105 CEST	52411	49736	96.9.210.71	192.168.2.4
Oct 21, 2024 17:17:34.420795918 CEST	52411	49736	96.9.210.71	192.168.2.4
Oct 21, 2024 17:17:34.473735094 CEST	49736	52411	192.168.2.4	96.9.210.71
Oct 21, 2024 17:17:34.520651102 CEST	49741	80	192.168.2.4	178.237.33.50
Oct 21, 2024 17:17:34.526042938 CEST	80	49741	178.237.33.50	192.168.2.4
Oct 21, 2024 17:17:34.526103020 CEST	49741	80	192.168.2.4	178.237.33.50
Oct 21, 2024 17:17:34.526492119 CEST	49741	80	192.168.2.4	178.237.33.50
Oct 21, 2024 17:17:34.532131910 CEST	80	49741	178.237.33.50	192.168.2.4
Oct 21, 2024 17:17:35.116600990 CEST	80	49741	178.237.33.50	192.168.2.4
Oct 21, 2024 17:17:35.116764069 CEST	49741	80	192.168.2.4	178.237.33.50
Oct 21, 2024 17:17:35.148372889 CEST	49736	52411	192.168.2.4	96.9.210.71
Oct 21, 2024 17:17:35.154268026 CEST	52411	49736	96.9.210.71	192.168.2.4
Oct 21, 2024 17:17:36.382879972 CEST	80	49741	178.237.33.50	192.168.2.4
Oct 21, 2024 17:17:36.383276939 CEST	49741	80	192.168.2.4	178.237.33.50
Oct 21, 2024 17:18:04.411089897 CEST	52411	49736	96.9.210.71	192.168.2.4
Oct 21, 2024 17:18:04.412617922 CEST	49736	52411	192.168.2.4	96.9.210.71
Oct 21, 2024 17:18:04.418090105 CEST	52411	49736	96.9.210.71	192.168.2.4
Oct 21, 2024 17:18:34.749438047 CEST	52411	49736	96.9.210.71	192.168.2.4
Oct 21, 2024 17:18:34.750659943 CEST	49736	52411	192.168.2.4	96.9.210.71
Oct 21, 2024 17:18:34.756130934 CEST	52411	49736	96.9.210.71	192.168.2.4
Oct 21, 2024 17:19:05.034440994 CEST	52411	49736	96.9.210.71	192.168.2.4
Oct 21, 2024 17:19:05.035708904 CEST	49736	52411	192.168.2.4	96.9.210.71
Oct 21, 2024 17:19:05.041188002 CEST	52411	49736	96.9.210.71	192.168.2.4
Oct 21, 2024 17:19:24.514451981 CEST	49741	80	192.168.2.4	178.237.33.50
Oct 21, 2024 17:19:24.895915031 CEST	49741	80	192.168.2.4	178.237.33.50
Oct 21, 2024 17:19:25.599049091 CEST	49741	80	192.168.2.4	178.237.33.50
Oct 21, 2024 17:19:26.895979881 CEST	49741	80	192.168.2.4	178.237.33.50
Oct 21, 2024 17:19:29.395097971 CEST	49741	80	192.168.2.4	178.237.33.50
Oct 21, 2024 17:19:34.208409071 CEST	49741	80	192.168.2.4	178.237.33.50
Oct 21, 2024 17:19:35.350420952 CEST	52411	49736	96.9.210.71	192.168.2.4
Oct 21, 2024 17:19:35.351845980 CEST	49736	52411	192.168.2.4	96.9.210.71
Oct 21, 2024 17:19:35.357444048 CEST	52411	49736	96.9.210.71	192.168.2.4
Oct 21, 2024 17:19:43.817795038 CEST	49741	80	192.168.2.4	178.237.33.50
Oct 21, 2024 17:20:05.659041882 CEST	52411	49736	96.9.210.71	192.168.2.4
Oct 21, 2024 17:20:05.664477110 CEST	49736	52411	192.168.2.4	96.9.210.71
Oct 21, 2024 17:20:05.669790030 CEST	52411	49736	96.9.210.71	192.168.2.4
Oct 21, 2024 17:20:35.920463085 CEST	52411	49736	96.9.210.71	192.168.2.4
Oct 21, 2024 17:20:35.922667980 CEST	49736	52411	192.168.2.4	96.9.210.71
Oct 21, 2024 17:20:35.928248882 CEST	52411	49736	96.9.210.71	192.168.2.4
Oct 21, 2024 17:21:06.236222982 CEST	52411	49736	96.9.210.71	192.168.2.4
Oct 21, 2024 17:21:06.238810062 CEST	49736	52411	192.168.2.4	96.9.210.71
Oct 21, 2024 17:21:06.244215965 CEST	52411	49736	96.9.210.71	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 21, 2024 17:17:23.471100092 CEST	62191	53	192.168.2.4	1.1.1.1
Oct 21, 2024 17:17:24.473927021 CEST	62191	53	192.168.2.4	1.1.1.1
Oct 21, 2024 17:17:25.473973989 CEST	62191	53	192.168.2.4	1.1.1.1
Oct 21, 2024 17:17:27.474239111 CEST	62191	53	192.168.2.4	1.1.1.1
Oct 21, 2024 17:17:27.481520891 CEST	53	62191	1.1.1.1	192.168.2.4
Oct 21, 2024 17:17:27.481551886 CEST	53	62191	1.1.1.1	192.168.2.4
Oct 21, 2024 17:17:27.481614113 CEST	53	62191	1.1.1.1	192.168.2.4
Oct 21, 2024 17:17:27.483479023 CEST	53	62191	1.1.1.1	192.168.2.4
Oct 21, 2024 17:17:28.490473032 CEST	65059	53	192.168.2.4	1.1.1.1
Oct 21, 2024 17:17:29.505269051 CEST	65059	53	192.168.2.4	1.1.1.1
Oct 21, 2024 17:17:30.505526066 CEST	65059	53	192.168.2.4	1.1.1.1
Oct 21, 2024 17:17:32.476305962 CEST	53	65059	1.1.1.1	192.168.2.4
Oct 21, 2024 17:17:32.476738930 CEST	53	65059	1.1.1.1	192.168.2.4
Oct 21, 2024 17:17:32.476748943 CEST	53	65059	1.1.1.1	192.168.2.4
Oct 21, 2024 17:17:34.506676912 CEST	52245	53	192.168.2.4	1.1.1.1
Oct 21, 2024 17:17:34.515574932 CEST	53	52245	1.1.1.1	192.168.2.4
Oct 21, 2024 17:18:00.592078924 CEST	53	54996	162.159.36.2	192.168.2.4
Oct 21, 2024 17:18:01.084362030 CEST	53	59649	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 21, 2024 17:17:23.471100092 CEST	192.168.2.4	1.1.1.1	0xf087	Standard query (0)	windowsocttehe.duckdns.org	A (IP address)	IN (0x0001)	false
Oct 21, 2024 17:17:24.473927021 CEST	192.168.2.4	1.1.1.1	0xf087	Standard query (0)	windowsocttehe.duckdns.org	A (IP address)	IN (0x0001)	false
Oct 21, 2024 17:17:25.473973989 CEST	192.168.2.4	1.1.1.1	0xf087	Standard query (0)	windowsocttehe.duckdns.org	A (IP address)	IN (0x0001)	false
Oct 21, 2024 17:17:27.474239111 CEST	192.168.2.4	1.1.1.1	0xf087	Standard query (0)	windowsocttehe.duckdns.org	A (IP address)	IN (0x0001)	false
Oct 21, 2024 17:17:28.490473032 CEST	192.168.2.4	1.1.1.1	0xe1e2	Standard query (0)	windowsocttehe.duckdns.org	A (IP address)	IN (0x0001)	false
Oct 21, 2024 17:17:29.505269051 CEST	192.168.2.4	1.1.1.1	0xe1e2	Standard query (0)	windowsocttehe.duckdns.org	A (IP address)	IN (0x0001)	false
Oct 21, 2024 17:17:30.505526066 CEST	192.168.2.4	1.1.1.1	0xe1e2	Standard query (0)	windowsocttehe.duckdns.org	A (IP address)	IN (0x0001)	false
Oct 21, 2024 17:17:34.506676912 CEST	192.168.2.4	1.1.1.1	0x273c	Standard query (0)	geoplugin.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 21, 2024 17:17:27.481520891 CEST	1.1.1.1	192.168.2.4	0xf087	Server failure (2)	windowsocttehe.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 17:17:27.481551886 CEST	1.1.1.1	192.168.2.4	0xf087	Server failure (2)	windowsocttehe.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 17:17:27.481614113 CEST	1.1.1.1	192.168.2.4	0xf087	Server failure (2)	windowsocttehe.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 17:17:27.483479023 CEST	1.1.1.1	192.168.2.4	0xf087	Server failure (2)	windowsocttehe.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 17:17:32.476305962 CEST	1.1.1.1	192.168.2.4	0xe1e2	No error (0)	windowsocttehe.duckdns.org		96.9.210.71	A (IP address)	IN (0x0001)	false
Oct 21, 2024 17:17:32.476738930 CEST	1.1.1.1	192.168.2.4	0xe1e2	No error (0)	windowsocttehe.duckdns.org		96.9.210.71	A (IP address)	IN (0x0001)	false
Oct 21, 2024 17:17:32.476748943 CEST	1.1.1.1	192.168.2.4	0xe1e2	No error (0)	windowsocttehe.duckdns.org		96.9.210.71	A (IP address)	IN (0x0001)	false
Oct 21, 2024 17:17:34.515574932 CEST	1.1.1.1	192.168.2.4	0x273c	No error (0)	geoplugin.net		178.237.33.50	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

geoplugin.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49741	178.237.33.50	80	7244	C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 17:17:34.526492119 CEST	71	OUT	GET /json.gp HTTP/1.1 Host: geoplugin.net Cache-Control: no-cache
Oct 21, 2024 17:17:35.116600990 CEST	1168	IN	HTTP/1.1 200 OK date: Mon, 21 Oct 2024 15:17:35 GMT server: Apache content-length: 960 content-type: application/json; charset=utf-8 cache-control: public, max-age=300 access-control-allow-origin: * Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 32 31 36 2e 35 32 2e 31 38 33 2e 31 35 30 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 32 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 [TRUNCATED] Data Ascii: { "geoplugin_request":"216.52.183.150", "geoplugin_status":200, "geoplugin_delay":"2ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7157", "geoplugin_longitude":"-74", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}

Target ID:	0
Start time:	11:17:16
Start date:	21/10/2024
Path:	C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe"
Imagebase:	0x590000
File size:	955'904 bytes
MD5 hash:	710651FB293DF9922080F5B7A4D10916
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1811153341.0000000007000000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.1806575207.0000000004586000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.1806575207.0000000004586000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.1806575207.0000000003A69000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1806575207.0000000003A69000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.1806575207.0000000003A69000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	11:17:22
Start date:	21/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rjOyFV.exe"
Imagebase:	0xa60000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	11:17:22
Start date:	21/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	11:17:22
Start date:	21/10/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rjOyFV" /XML "C:\Users\user\AppData\Local\Temp\tmpE78A.tmp"
Imagebase:	0x890000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	11:17:22
Start date:	21/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	11:17:22
Start date:	21/10/2024
Path:	C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\DHL AWB_NO_92847309329.exe"
Imagebase:	0xf80000
File size:	955'904 bytes
MD5 hash:	710651FB293DF9922080F5B7A4D10916
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000006.00000002.4182257195.0000000001587000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Target ID:	7
Start time:	11:17:23
Start date:	21/10/2024
Path:	C:\Users\user\AppData\Roaming\rjOyFV.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\rjOyFV.exe
Imagebase:	0x9f0000
File size:	955'904 bytes
MD5 hash:	710651FB293DF9922080F5B7A4D10916
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	8
Start time:	11:17:26
Start date:	21/10/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	11:17:29
Start date:	21/10/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rjOyFV" /XML "C:\Users\user\AppData\Local\Temp\tmp36E.tmp"
Imagebase:	0x890000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	11:17:29
Start date:	21/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	11:17:29
Start date:	21/10/2024
Path:	C:\Users\user\AppData\Roaming\rjOyFV.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\rjOyFV.exe"
Imagebase:	0x140000
File size:	955'904 bytes
MD5 hash:	710651FB293DF9922080F5B7A4D10916
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	12
Start time:	11:17:29
Start date:	21/10/2024
Path:	C:\Users\user\AppData\Roaming\rjOyFV.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\rjOyFV.exe"
Imagebase:	0x5f0000
File size:	955'904 bytes
MD5 hash:	710651FB293DF9922080F5B7A4D10916
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000C.00000002.1865601373.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000C.00000002.1865064204.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000C.00000002.1865064204.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000000C.00000002.1865064204.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer, Description: detects Windows exceutables potentially bypassing UAC using eventvwr.exe, Source: 0000000C.00000002.1865064204.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true