Windows Analysis Report
#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

Overview

General Information

Sample name:	#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe renamed because original name is a hash value
Original sample name:	Order_shizcon October order %100% S51105P-E01 jpg .exe
Analysis ID:	1539801
MD5:	aefe0d1d68f98ccc7f6e9ecef846aa27
SHA1:	466fe8a2f6bbbed06f99c3a866902f6cd7daa927
SHA256:	f1e8089463471c51696339380ea5da14b7a84fefd4194962e4860542beb8c053
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Creates processes with suspicious names

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Classification

Signatures

AV Detection

Multi AV Scanner detection for submitted file

Source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	ReversingLabs: Detection: 29%
Source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Virustotal: Detection: 34%			Perma Link

Machine Learning detection for sample

Source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

Joe Sandbox ML: detected

Uses 32bit PE files

Source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mscorlib.pdb source: WERABFA.tmp.dmp.3.dr
Source:	Binary string: mscorlib.ni.pdb source: WERABFA.tmp.dmp.3.dr
Source:	Binary string: NZnq.pdbSHA256 source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERABFA.tmp.dmp.3.dr
Source:	Binary string: mscorlib.pdb0 source: WERABFA.tmp.dmp.3.dr
Source:	Binary string: NZnq.pdb source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

Source: Amcache.hve.3.dr

String found in binary or memory: http://upx.sf.net

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

One or more processes crash

Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7500 -s 780

Sample file is different than original file name gathered from version info

Source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe, 00000000.00000000.1743110012.000000000103A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameNZnq.exeF vs #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe
Source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe, 00000000.00000002.1927430730.000000000141E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe
Source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Binary or memory string: OriginalFilenameNZnq.exeF vs #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

Uses 32bit PE files

Source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal56.winEXE@2/5@0/0

Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7500

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\a58fe055-ab4b-43d5-b0cf-a6736f5f662f

Jump to behavior

Source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	ReversingLabs: Detection: 29%
Source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Virustotal: Detection: 34%

Source: unknown	Process created: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe "C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe"
Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7500 -s 780

Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Section loaded: uxtheme.dll	Jump to behavior

Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mscorlib.pdb source: WERABFA.tmp.dmp.3.dr
Source:	Binary string: mscorlib.ni.pdb source: WERABFA.tmp.dmp.3.dr
Source:	Binary string: NZnq.pdbSHA256 source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERABFA.tmp.dmp.3.dr
Source:	Binary string: mscorlib.pdb0 source: WERABFA.tmp.dmp.3.dr
Source:	Binary string: NZnq.pdb source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

Source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

Static PE information: section name: .text entropy: 7.614054865245141

Creates processes with suspicious names

Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

File created: \#u3000order_shizcon october order %100% s51105p-e01 #uff08#u898b#u7a4d#u4f9d#u983c#uff09jpg .exe

Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Memory allocated: 3240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Memory allocated: 32D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Memory allocated: 52D0000 memory reserve \| memory write watch	Jump to behavior

Source: Amcache.hve.3.dr	Binary or memory string: VMware
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.3.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.3.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.3.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.3.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.3.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.3.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.3.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.3.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.3.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.3.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.3.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.3.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

Memory allocated: page read and write | page guard

Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

Queries volume information: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe VolumeInformation

Jump to behavior

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.3.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: MsMpEng.exe

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

AV Detection

Multi AV Scanner detection for submitted file

Source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	ReversingLabs: Detection: 29%
Source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Virustotal: Detection: 34%			Perma Link

Machine Learning detection for sample

Source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

Joe Sandbox ML: detected

Uses 32bit PE files

Source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mscorlib.pdb source: WERABFA.tmp.dmp.3.dr
Source:	Binary string: mscorlib.ni.pdb source: WERABFA.tmp.dmp.3.dr
Source:	Binary string: NZnq.pdbSHA256 source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERABFA.tmp.dmp.3.dr
Source:	Binary string: mscorlib.pdb0 source: WERABFA.tmp.dmp.3.dr
Source:	Binary string: NZnq.pdb source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

Source: Amcache.hve.3.dr

String found in binary or memory: http://upx.sf.net

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

One or more processes crash

Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7500 -s 780

Sample file is different than original file name gathered from version info

Source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe, 00000000.00000000.1743110012.000000000103A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameNZnq.exeF vs #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe
Source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe, 00000000.00000002.1927430730.000000000141E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe
Source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Binary or memory string: OriginalFilenameNZnq.exeF vs #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

Uses 32bit PE files

Source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal56.winEXE@2/5@0/0

Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7500

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\a58fe055-ab4b-43d5-b0cf-a6736f5f662f

Jump to behavior

Source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	ReversingLabs: Detection: 29%
Source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Virustotal: Detection: 34%

Source: unknown	Process created: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe "C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe"
Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7500 -s 780

Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Section loaded: uxtheme.dll	Jump to behavior

Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mscorlib.pdb source: WERABFA.tmp.dmp.3.dr
Source:	Binary string: mscorlib.ni.pdb source: WERABFA.tmp.dmp.3.dr
Source:	Binary string: NZnq.pdbSHA256 source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERABFA.tmp.dmp.3.dr
Source:	Binary string: mscorlib.pdb0 source: WERABFA.tmp.dmp.3.dr
Source:	Binary string: NZnq.pdb source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

Source: #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

Static PE information: section name: .text entropy: 7.614054865245141

Creates processes with suspicious names

Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

File created: \#u3000order_shizcon october order %100% s51105p-e01 #uff08#u898b#u7a4d#u4f9d#u983c#uff09jpg .exe

Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Memory allocated: 3240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Memory allocated: 32D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Memory allocated: 52D0000 memory reserve \| memory write watch	Jump to behavior

Source: Amcache.hve.3.dr	Binary or memory string: VMware
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.3.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.3.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.3.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.3.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.3.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.3.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.3.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.3.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.3.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.3.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.3.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.3.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

Memory allocated: page read and write | page guard

Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

Queries volume information: C:\Users\user\Desktop\#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe VolumeInformation

Jump to behavior

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.3.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: MsMpEng.exe

ID:	1539801
Product:	CloudBasic
Start time:	06:38:37
Start date:	23.10.2024
Sample:	#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	aefe0d1d68f98ccc7f6e9ecef846aa27
SHA1:	466fe8a2f6bbbed06f99c3a866902f6cd7daa927
SHA256:	f1e8089463471c51696339380ea5da14b7a84fefd4194962e4860542beb8c053
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_#U3000Order_shiz_97ff7d3039296a4f3d3ed724df995b8825aedf7_2ada7f0d_9c96b19e-2e44-44c2-a252-b1b9dbfb37d8\Report.wer	Unicode text, UTF-16, little-endian text, with CRLF line terminators	00A15B0B47A87329C9B2206BECCC3A23	BA60E7EBBB2F49E5BA210CD0F9B62EB9B4CC38D8	C2A2851748A8D962C01BE470B5154515101144544ACE4EF2D26C6FF161A70B17
C:\ProgramData\Microsoft\Windows\WER\Temp\WERABFA.tmp.dmp	Mini DuMP crash report, 15 streams, Wed Oct 23 04:39:36 2024, 0x1205a4 type	93375D51276A02DFC54B4E09A9A45B83	B5952FA7B71C7D2F1418ED648FD886F713B2C56A	41B4301C10DA5484E145585B577351714929BE36AD5A1050B1387541CBDA23E5
C:\ProgramData\Microsoft\Windows\WER\Temp\WERACE5.tmp.WERInternalMetadata.xml	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators	16D9C19BBC5EBFC0E5E450A16543B3BB	C51311154419532C96664C819C688D56D6F51A5C	DC48481B29331068C31DBBF9C187ACBC9C9740F1460BFCE81D31228E5BB2FE6A
C:\ProgramData\Microsoft\Windows\WER\Temp\WERAD15.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	0DEAE0D418F6E996C79B60C5EA2E0BC7	0FCBE5147888CDA1E60C9F86F9EE4AA729A69CE8	4B464D97185B04A35C3656D7DDA7EA063332EEDB06BC4A8D7D6D3108A295E6B5
C:\Windows\appcompat\Programs\Amcache.hve	MS Windows registry file, NT/2000 or above	4800EF4EE8FDAA1D347282649ABF04E4	1DAF64A45397435BB55F83FCBBFC03DB5CD01F26	4DB4AC2C58EA09E790A780D95545994E6D938DDED57C94A417465AB7FF1A20C5

Windows Analysis Report
#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Screenshots

Behavior Graph

Network Map

Windows Analysis Report #U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Screenshots

Behavior Graph

Network Map

Windows Analysis Report
#U3000Order_shizcon October order %100% S51105P-E01 #Uff08#U898b#U7a4d#U4f9d#U983c#Uff09jpg .exe