Edit tour

Windows Analysis Report
KRITENESIAS.exe

Overview

General Information

Sample name:	KRITENESIAS.exe
Analysis ID:	1542884
MD5:	e6e3f0819cd71162daebb192061b78de
SHA1:	a03a28f1c6f0329ad2af6aa6cce1e6058e5df8ee
SHA256:	f58196e6f2428a361e9c3c004c3f340e5f4ea281c16ecc5222dd10bc02098dfc
Tags:	exeuser-KnownStormChaser
Infos:

Detection

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Contains functionality to access PhysicalDrive, possible boot sector overwrite

Contains functionality to infect the boot sector

Infects the VBR (Volume Boot Record) of the hard disk

Loading BitLocker PowerShell Module

Uses cmd line tools excessively to alter registry or file data

Writes directly to the primary disk partition (DR0)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to record screenshots

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Classification

Process Tree

System is w10x64

KRITENESIAS.exe (PID: 7724 cmdline: "C:\Users\user\Desktop\KRITENESIAS.exe" MD5: E6E3F0819CD71162DAEBB192061B78DE)

conhost.exe (PID: 7732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7952 cmdline: C:\Windows\system32\cmd.exe /c reg add HKCUHKEY_CURRENT_USERSoftwarePoliciesMicrosoftWindowsSystem /v DisableTaskMgr /t REG_DWORD /d 1 /f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

reg.exe (PID: 7968 cmdline: reg add HKCUHKEY_CURRENT_USERSoftwarePoliciesMicrosoftWindowsSystem /v DisableTaskMgr /t REG_DWORD /d 1 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

cmd.exe (PID: 7984 cmdline: C:\Windows\system32\cmd.exe /c reg add HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem /v DisableRegistryTools /t REG_DWORD /d 1 /f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

reg.exe (PID: 8000 cmdline: reg add HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem /v DisableRegistryTools /t REG_DWORD /d 1 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

cmd.exe (PID: 8016 cmdline: C:\Windows\system32\cmd.exe /c reg add HKCUHKEY_CURRENT_USERSoftwarePoliciesMicrosoftWindowsSystem / v DisableCMD / t REG_DWORD / d 1 / f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

reg.exe (PID: 8032 cmdline: reg add HKCUHKEY_CURRENT_USERSoftwarePoliciesMicrosoftWindowsSystem / v DisableCMD / t REG_DWORD / d 1 / f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

cmd.exe (PID: 8188 cmdline: C:\Windows\system32\cmd.exe /c powershell wininit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

powershell.exe (PID: 7176 cmdline: powershell wininit MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cleanup

Sigma Signatures

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell wininit, CommandLine: powershell wininit, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c powershell wininit, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 8188, ParentProcessName: cmd.exe, ProcessCommandLine: powershell wininit, ProcessId: 7176, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: KRITENESIAS.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: KRITENESIAS.exe

ReversingLabs: Detection: 52%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.3% probability

Source: KRITENESIAS.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: KRITENESIAS.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\idk\Downloads\SHOTHIRIUM\SHOTHIRIUM\compile\SHOTHIRIUM.pdb!! source: KRITENESIAS.exe
Source:	Binary string: C:\Users\idk\Downloads\SHOTHIRIUM\SHOTHIRIUM\compile\SHOTHIRIUM.pdb source: KRITENESIAS.exe

Source: C:\Users\user\Desktop\KRITENESIAS.exe

Code function: 0_2_00BF102D GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,_libm_sse2_sin_precise,BitBlt,Sleep,Sleep,PatBlt,_libm_sse2_sin_precise,BitBlt,Sleep,Sleep,Sleep,

0_2_00BF102D

Operating System Destruction

Contains functionality to access PhysicalDrive, possible boot sector overwrite

Source: C:\Users\user\Desktop\KRITENESIAS.exe	Code function: 0_2_00BF2D00 CreateFileW on filename \\.\PhysicalDrive0		0_2_00BF2D00
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Code function: 0_2_00BF1D30 CreateFileW on filename \\.\PhysicalDrive0		0_2_00BF1D30

Source: C:\Users\user\Desktop\KRITENESIAS.exe

Code function: 0_2_00BF3065

0_2_00BF3065

Source: KRITENESIAS.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe reg add HKCUHKEY_CURRENT_USERSoftwarePoliciesMicrosoftWindowsSystem /v DisableTaskMgr /t REG_DWORD /d 1 /f

Source: classification engine

Classification label: mal84.evad.winEXE@18/6@0/0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7732:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e4fwagcx.owr.ps1

Jump to behavior

Source: KRITENESIAS.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\KRITENESIAS.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: KRITENESIAS.exe

ReversingLabs: Detection: 52%

Source: unknown	Process created: C:\Users\user\Desktop\KRITENESIAS.exe "C:\Users\user\Desktop\KRITENESIAS.exe"
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c reg add HKCUHKEY_CURRENT_USERSoftwarePoliciesMicrosoftWindowsSystem /v DisableTaskMgr /t REG_DWORD /d 1 /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKCUHKEY_CURRENT_USERSoftwarePoliciesMicrosoftWindowsSystem /v DisableTaskMgr /t REG_DWORD /d 1 /f
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c reg add HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem /v DisableRegistryTools /t REG_DWORD /d 1 /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem /v DisableRegistryTools /t REG_DWORD /d 1 /f
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c reg add HKCUHKEY_CURRENT_USERSoftwarePoliciesMicrosoftWindowsSystem / v DisableCMD / t REG_DWORD / d 1 / f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKCUHKEY_CURRENT_USERSoftwarePoliciesMicrosoftWindowsSystem / v DisableCMD / t REG_DWORD / d 1 / f
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell wininit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell wininit
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c reg add HKCUHKEY_CURRENT_USERSoftwarePoliciesMicrosoftWindowsSystem /v DisableTaskMgr /t REG_DWORD /d 1 /f	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c reg add HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem /v DisableRegistryTools /t REG_DWORD /d 1 /f	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c reg add HKCUHKEY_CURRENT_USERSoftwarePoliciesMicrosoftWindowsSystem / v DisableCMD / t REG_DWORD / d 1 / f	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell wininit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKCUHKEY_CURRENT_USERSoftwarePoliciesMicrosoftWindowsSystem /v DisableTaskMgr /t REG_DWORD /d 1 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem /v DisableRegistryTools /t REG_DWORD /d 1 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKCUHKEY_CURRENT_USERSoftwarePoliciesMicrosoftWindowsSystem / v DisableCMD / t REG_DWORD / d 1 / f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell wininit	Jump to behavior

Source: C:\Users\user\Desktop\KRITENESIAS.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Section loaded: ksuser.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Section loaded: midimap.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\KRITENESIAS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: KRITENESIAS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: KRITENESIAS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: KRITENESIAS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: KRITENESIAS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: KRITENESIAS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: KRITENESIAS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: KRITENESIAS.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: KRITENESIAS.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\idk\Downloads\SHOTHIRIUM\SHOTHIRIUM\compile\SHOTHIRIUM.pdb!! source: KRITENESIAS.exe
Source:	Binary string: C:\Users\idk\Downloads\SHOTHIRIUM\SHOTHIRIUM\compile\SHOTHIRIUM.pdb source: KRITENESIAS.exe

Source: KRITENESIAS.exe

Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\KRITENESIAS.exe

Code function: 0_2_00BF107D push ecx; ret

0_2_00BF44B3

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\KRITENESIAS.exe	Code function: GetConsoleWindow,ShowWindow,MessageBoxW,MessageBoxW,MessageBoxW,CreateFileW,WriteFile,CloseHandle,system,system,system,system,Sleep,Sleep,CreateThread,CreateThread,Sleep,TerminateThread,TerminateThread,CreateThread,Sleep,TerminateThread,CreateThread,Sleep,TerminateThread,CreateThread,Sleep,TerminateThread,CreateThread,Sleep,TerminateThread,CreateThread,Sleep,TerminateThread,CreateThread,Sleep,TerminateThread,system, \\.\PhysicalDrive0		0_2_00BF2D00
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Code function: CreateFileW,WriteFile,CloseHandle, \\.\PhysicalDrive0		0_2_00BF1D30

Infects the VBR (Volume Boot Record) of the hard disk

Source: C:\Users\user\Desktop\KRITENESIAS.exe

File written: \Device\Harddisk0\DR0 offset: 512

Jump to behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior

Writes directly to the primary disk partition (DR0)

Source: C:\Users\user\Desktop\KRITENESIAS.exe

File written: \Device\Harddisk0\DR0 offset: 512 length: 512

Jump to behavior

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\KRITENESIAS.exe	Code function: GetConsoleWindow,ShowWindow,MessageBoxW,MessageBoxW,MessageBoxW,CreateFileW,WriteFile,CloseHandle,system,system,system,system,Sleep,Sleep,CreateThread,CreateThread,Sleep,TerminateThread,TerminateThread,CreateThread,Sleep,TerminateThread,CreateThread,Sleep,TerminateThread,CreateThread,Sleep,TerminateThread,CreateThread,Sleep,TerminateThread,CreateThread,Sleep,TerminateThread,CreateThread,Sleep,TerminateThread,system, \\.\PhysicalDrive0		0_2_00BF2D00
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Code function: CreateFileW,WriteFile,CloseHandle, \\.\PhysicalDrive0		0_2_00BF1D30

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5458			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4275			Jump to behavior

Source: C:\Users\user\Desktop\KRITENESIAS.exe TID: 7728	Thread sleep time: -35000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe TID: 7728	Thread sleep time: -35000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe TID: 7728	Thread sleep time: -35000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe TID: 7728	Thread sleep time: -35000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe TID: 7728	Thread sleep time: -35000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe TID: 7728	Thread sleep time: -35000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe TID: 7728	Thread sleep time: -35000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7460	Thread sleep count: 5458 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7344	Thread sleep count: 4275 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5428	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\KRITENESIAS.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\KRITENESIAS.exe	Thread delayed: delay time: 35000	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Thread delayed: delay time: 35000	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Thread delayed: delay time: 35000	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Thread delayed: delay time: 35000	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Thread delayed: delay time: 35000	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Thread delayed: delay time: 35000	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Thread delayed: delay time: 35000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\KRITENESIAS.exe

Code function: 0_2_00BF4152 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00BF4152

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\KRITENESIAS.exe	Code function: 0_2_00BF37BE SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00BF37BE
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Code function: 0_2_00BF4152 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00BF4152
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Code function: 0_2_00BF1203 SetUnhandledExceptionFilter,	0_2_00BF1203

Source: C:\Users\user\Desktop\KRITENESIAS.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c reg add HKCUHKEY_CURRENT_USERSoftwarePoliciesMicrosoftWindowsSystem /v DisableTaskMgr /t REG_DWORD /d 1 /f	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c reg add HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem /v DisableRegistryTools /t REG_DWORD /d 1 /f	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c reg add HKCUHKEY_CURRENT_USERSoftwarePoliciesMicrosoftWindowsSystem / v DisableCMD / t REG_DWORD / d 1 / f	Jump to behavior
Source: C:\Users\user\Desktop\KRITENESIAS.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell wininit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKCUHKEY_CURRENT_USERSoftwarePoliciesMicrosoftWindowsSystem /v DisableTaskMgr /t REG_DWORD /d 1 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem /v DisableRegistryTools /t REG_DWORD /d 1 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKCUHKEY_CURRENT_USERSoftwarePoliciesMicrosoftWindowsSystem / v DisableCMD / t REG_DWORD / d 1 / f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell wininit	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\KRITENESIAS.exe

Code function: 0_2_00BF3FE4 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00BF3FE4

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Command and Scripting Interpreter	4 Bootkit	11 Process Injection	1 Modify Registry	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	2 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	4 Bootkit	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	22 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
KRITENESIAS.exe	53%	ReversingLabs	Win32.Trojan.Nekark
KRITENESIAS.exe	100%	Avira	TR/AD.Nekark.njzzd

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542884
Start date and time:	2024-10-26 19:22:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	KRITENESIAS.exe
Detection:	MAL
Classification:	mal84.evad.winEXE@18/6@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 13 Number of non-executed functions: 10
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, audiodg.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
VT rate limit hit for: KRITENESIAS.exe

Simulations

Behavior and APIs

Time	Type	Description
13:23:19	API Interceptor	7x Sleep call for process: KRITENESIAS.exe modified
13:23:20	API Interceptor	22x Sleep call for process: powershell.exe modified

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:NlllulPki/llllZ:NllUcylll
MD5:	D8D47FD6FA3E199E4AFF68B91F1D04A8
SHA1:	788625E414B030E5174C5BE7262A4C93502C2C21
SHA-256:	2D9AF9AB25D04D1CF9B25DB196A988CD6E4124C1B8E185B96F2AB9554F4A6738
SHA-512:	5BFD83D07DC3CB53563F215BE1D4D7206340A4C0AB06988697637C402793146D13CDDE0E27DC8301E4506553D957876AC9D7A7BF3C7431BBDD5F019C17AB0A58
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e.................................^..............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0ar1l3lt.qch.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0vc5qcrh.qhc.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e4fwagcx.owr.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jwzw5bs5.20n.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

\Device\Harddisk0\DR0

Download File

Process:	C:\Users\user\Desktop\KRITENESIAS.exe
File Type:	DOS/MBR boot sector
Category:	dropped
Size (bytes):	512
Entropy (8bit):	2.4115103828740536
Encrypted:	false
SSDEEP:	3:Fpip6lr8HslbS+JthWUZlW7apQSurthosXjJPyzOTUG+KRSlD9ppFKfu4Rjmy776:1rlfJaA4apOrVzEzOAG+KcrpwpRT2
MD5:	F6BB1995D1A19449E8A2251B866CC1EB
SHA1:	599F4EDA2C999869A18CFB239C431848BB68530D
SHA-256:	9FC2133ECA4A9B62EEBAD4231C10A1236DFE9FC810CFC6FC32AF40798114DCD4
SHA-512:	7643B5A2ABEB4941DD486994106F385D0E4BD0B2B036D98FFD79BFB94C83E2119793F5EB436F720A499BAE740D0EDAE19AEE66B9E9EE7B5A8E1EEC069801A453
Malicious:	true
Preview:	..................1..........D....Ds1<.s...$.........u....<@r.$?........)..................D..............C.................}.....2...........................................................................................................................................................................................................................................................................................................................................................................U.

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	5.255161402824075
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	KRITENESIAS.exe
File size:	62'464 bytes
MD5:	e6e3f0819cd71162daebb192061b78de
SHA1:	a03a28f1c6f0329ad2af6aa6cce1e6058e5df8ee
SHA256:	f58196e6f2428a361e9c3c004c3f340e5f4ea281c16ecc5222dd10bc02098dfc
SHA512:	3012ae1c4d513c9968a56e24cb67875e0c590157d43c0efaea85cadd276f2774843f3f1234b6ededebda0d9a795534611210bae1863e06f5fd63a28c76c8618e
SSDEEP:	768:HE3sS2x+nv/bTVi9uRL/DrICdT1968HiqqLPpAF76R:HE3D2xivfcERL3ICF19xrsBA
TLSH:	0B539D61F9D0CA23DABE507858FA99B54B0F79F12B3590E726F582030A950F64D3CB1E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........;.B.Z...Z...Z..."G..Z.......Z.......Z.......Z.......Z..."...Z...Z...Z.......Z....+..Z...ZC..Z.......Z..Rich.Z.................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x401014
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FE7FD6 [Thu Oct 3 11:28:22 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	5f3f244e263ccb2f29dbe2d3ca3219ef

Entrypoint Preview

Instruction
jmp 00007FD258F1CA5Eh
jmp 00007FD258F1CA97h
jmp 00007FD258F1D3EEh
jmp 00007FD258F1D3A1h
jmp 00007FD258F1CBC1h
jmp 00007FD258F1AA83h
jmp 00007FD258F1D3D4h
jmp 00007FD258F1DA0Ah
jmp 00007FD258F1D5D6h
jmp 00007FD258F1CFD8h
jmp 00007FD258F1DB55h
jmp 00007FD258F1D7DAh
jmp 00007FD258F1B710h
jmp 00007FD258F1C29Bh
jmp 00007FD258F1D31Dh
jmp 00007FD258F1D96Ah
jmp 00007FD258F1D75Eh
jmp 00007FD258F1DB2Ch
jmp 00007FD258F1C9D4h
jmp 00007FD258F1CEF3h
jmp 00007FD258F1D4F4h
jmp 00007FD258F1D6E3h
jmp 00007FD258F1D67Eh
jmp 00007FD258F1D2E4h
jmp 00007FD258F1A884h
jmp 00007FD258F1CF1Ch
jmp 00007FD258F1D2CBh
jmp 00007FD258F1AD85h
jmp 00007FD258F1CF4Eh
jmp 00007FD258F1DAEDh
jmp 00007FD258F1D7C2h
jmp 00007FD258F1D2B9h
jmp 00007FD258F1D064h
jmp 00007FD258F1DADCh
jmp 00007FD258F1C952h
jmp 00007FD258F1CFADh
jmp 00007FD258F1CE69h
jmp 00007FD258F1D2A4h
jmp 00007FD258F1C201h
jmp 00007FD258F1D2FCh

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x10370	0x104	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x13000	0x446	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x14000	0x40c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xd518	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xd430	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x10000	0x370	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4b67	0x4c00	e4e7e70029fe0dbbdfd63558889acbd9	False	0.29230057565789475	data	4.715046865917844	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x6000	0x812d	0x8200	142a81423f305578335613a76d4600ef	False	0.5147836538461539	data	5.16686909462714	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xf000	0x604	0x200	660d8b2c37170823ce59350554670244	False	0.08203125	data	0.41483924795914456	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x10000	0x1045	0x1200	d2ce4d08be34c60ca359c41e810bed9c	False	0.2732204861111111	data	3.590673332741307	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.00cfg	0x12000	0x10e	0x200	10fbdb9bf5c6b522e91f378441bbf238	False	0.03515625	data	0.11055713125913882	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x13000	0x446	0x600	37e512946488cd0e5357990014534ab4	False	0.18424479166666666	data	2.1806754812875706	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x14000	0x58d	0x600	960ebaf8d2b3a9f3a4bb737d2c5c2fd2	False	0.6263020833333334	data	5.16732875469798	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x13170	0x188	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5892857142857143

Imports

DLL	Import
KERNEL32.dll	GetSystemTimeAsFileTime, GetCurrentThreadId, InitializeSListHead, QueryPerformanceCounter, TerminateProcess, IsDebuggerPresent, GetStartupInfoW, GetConsoleWindow, TerminateThread, CreateThread, Sleep, CloseHandle, WriteFile, GetCurrentProcessId, CreateFileW, GetCurrentProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, IsProcessorFeaturePresent, GetModuleHandleW
USER32.dll	GetWindowRect, MessageBoxW, GetDesktopWindow, GetDC, ShowWindow, GetSystemMetrics
GDI32.dll	StretchBlt, SelectObject, PatBlt, PlgBlt, DeleteObject, CreateSolidBrush, CreateCompatibleDC, CreateCompatibleBitmap, BitBlt
WINMM.dll	waveOutPrepareHeader, waveOutWrite, waveOutOpen, waveOutUnprepareHeader, waveOutClose
VCRUNTIME140.dll	__current_exception_context, __std_type_info_destroy_list, _except_handler4_common, __current_exception, memset
api-ms-win-crt-utility-l1-1-0.dll	rand
api-ms-win-crt-runtime-l1-1-0.dll	_initterm_e, _cexit, _configure_narrow_argv, _seh_filter_dll, _initialize_onexit_table, __p___argv, _execute_onexit_table, _crt_atexit, _crt_at_quick_exit, _controlfp_s, terminate, _initterm, _get_initial_narrow_environment, _initialize_narrow_environment, _register_thread_local_exe_atexit_callback, __p___argc, exit, _register_onexit_function, _set_app_type, _seh_filter_exe, _exit, system, _c_exit
api-ms-win-crt-time-l1-1-0.dll	_time64
api-ms-win-crt-math-l1-1-0.dll	_libm_sse2_sin_precise, __setusermatherr
api-ms-win-crt-stdio-l1-1-0.dll	_set_fmode, __p__commode
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale
api-ms-win-crt-heap-l1-1-0.dll	_set_new_mode

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	13:23:09
Start date:	26/10/2024
Path:	C:\Users\user\Desktop\KRITENESIAS.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\KRITENESIAS.exe"
Imagebase:	0xbf0000
File size:	62'464 bytes
MD5 hash:	E6E3F0819CD71162DAEBB192061B78DE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:23:09
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:23:17
Start date:	26/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c reg add HKCUHKEY_CURRENT_USERSoftwarePoliciesMicrosoftWindowsSystem /v DisableTaskMgr /t REG_DWORD /d 1 /f
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:23:17
Start date:	26/10/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add HKCUHKEY_CURRENT_USERSoftwarePoliciesMicrosoftWindowsSystem /v DisableTaskMgr /t REG_DWORD /d 1 /f
Imagebase:	0x4e0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:23:17
Start date:	26/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c reg add HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem /v DisableRegistryTools /t REG_DWORD /d 1 /f
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:23:17
Start date:	26/10/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem /v DisableRegistryTools /t REG_DWORD /d 1 /f
Imagebase:	0x4e0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:23:17
Start date:	26/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c reg add HKCUHKEY_CURRENT_USERSoftwarePoliciesMicrosoftWindowsSystem / v DisableCMD / t REG_DWORD / d 1 / f
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:23:17
Start date:	26/10/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add HKCUHKEY_CURRENT_USERSoftwarePoliciesMicrosoftWindowsSystem / v DisableCMD / t REG_DWORD / d 1 / f
Imagebase:	0x4e0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	13:23:20
Start date:	26/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c powershell wininit
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:23:20
Start date:	26/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell wininit
Imagebase:	0x5b0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	31.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	18.4%
Total number of Nodes:	207
Total number of Limit Nodes:	9

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00BF2D00 Relevance: 73.7, APIs: 33, Strings: 9, Instructions: 169
threadsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNELBASE(00000000), ref: 00BF2D07
ShowWindow.USER32(00000000), ref: 00BF2D0E
MessageBoxW.USER32(00000000,The program you have just executed is a malware that can harm your deviceAnd make it unbootableBy continuing you agreeThat thi,WARNING,00000034), ref: 00BF2D28
MessageBoxW.USER32(00000000,IF YOU MADE IT TO THYIS POINT AND YOU STILL DONT KNOW WHAT IS GOING ONTHIS IS MALWARE THAT WILLDESTROY YOUR COMPUTERTHE AUTHOR,LAST WARNING,00000034), ref: 00BF2D41
CreateFileW.KERNELBASE(\\.\PhysicalDrive0,10000000,00000003,00000000,00000003,00000000,00000000), ref: 00BF2D62
WriteFile.KERNELBASE(00000000,00BF6B30,00000200,?,00000000), ref: 00BF2D7B
CloseHandle.KERNEL32(00000000), ref: 00BF2D82
system.API-MS-WIN-CRT-RUNTIME-L1-1-0(reg add HKCUHKEY_CURRENT_USERSoftwarePoliciesMicrosoftWindowsSystem /v DisableTaskMgr /t REG_DWORD /d 1 /f), ref: 00BF2D93
system.API-MS-WIN-CRT-RUNTIME-L1-1-0(reg add HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem /v DisableRegistryTools /t REG_DWORD /d 1 /f), ref: 00BF2D9A
system.API-MS-WIN-CRT-RUNTIME-L1-1-0(reg add HKCUHKEY_CURRENT_USERSoftwarePoliciesMicrosoftWindowsSystem / v DisableCMD / t REG_DWORD / d 1 / f), ref: 00BF2DA1
Sleep.KERNELBASE(000005DC), ref: 00BF2DB1
CreateThread.KERNELBASE(00000000,00000000,Function_000011DB,00000000,00000000,00000000), ref: 00BF2DC8
Sleep.KERNELBASE(000088B8), ref: 00BF2DD6
TerminateThread.KERNELBASE(00000000,00000000), ref: 00BF2DE1
CreateThread.KERNELBASE(00000000,00000000,Function_00001244,00000000,00000000,00000000), ref: 00BF2DF2
Sleep.KERNELBASE(000088B8), ref: 00BF2E00
TerminateThread.KERNELBASE(00000000,00000000), ref: 00BF2E09
CreateThread.KERNELBASE(00000000,00000000,Function_00001212,00000000,00000000,00000000), ref: 00BF2E1A
Sleep.KERNELBASE(000088B8), ref: 00BF2E28
TerminateThread.KERNELBASE(00000000,00000000), ref: 00BF2E31
CreateThread.KERNELBASE(00000000,00000000,Function_0000102D,00000000,00000000,00000000), ref: 00BF2E42
Sleep.KERNELBASE(000088B8), ref: 00BF2E50
TerminateThread.KERNELBASE(00000000,00000000), ref: 00BF2E59
CreateThread.KERNELBASE(00000000,00000000,Function_00001212,00000000,00000000,00000000), ref: 00BF2E6A
Sleep.KERNELBASE(000088B8), ref: 00BF2E78
TerminateThread.KERNELBASE(00000000,00000000), ref: 00BF2E81
CreateThread.KERNELBASE(00000000,00000000,Function_000011D6,00000000,00000000,00000000), ref: 00BF2E92
Sleep.KERNELBASE(000088B8), ref: 00BF2EA0
TerminateThread.KERNELBASE(00000000,00000000), ref: 00BF2EA9
CreateThread.KERNELBASE(00000000,00000000,Function_0000109B,00000000,00000000,00000000), ref: 00BF2EBA
Sleep.KERNELBASE(000088B8), ref: 00BF2EC8
TerminateThread.KERNELBASE(00000000,00000000), ref: 00BF2ED1
system.API-MS-WIN-CRT-RUNTIME-L1-1-0(powershell wininit), ref: 00BF2ED8

Strings

reg add HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem /v DisableRegistryTools /t REG_DWORD /d 1 /f, xrefs: 00BF2D95
\\.\PhysicalDrive0, xrefs: 00BF2D5D
reg add HKCUHKEY_CURRENT_USERSoftwarePoliciesMicrosoftWindowsSystem / v DisableCMD / t REG_DWORD / d 1 / f, xrefs: 00BF2D9C
The program you have just executed is a malware that can harm your deviceAnd make it unbootableBy continuing you agreeThat thi, xrefs: 00BF2D21
IF YOU MADE IT TO THYIS POINT AND YOU STILL DONT KNOW WHAT IS GOING ONTHIS IS MALWARE THAT WILLDESTROY YOUR COMPUTERTHE AUTHOR, xrefs: 00BF2D3A
reg add HKCUHKEY_CURRENT_USERSoftwarePoliciesMicrosoftWindowsSystem /v DisableTaskMgr /t REG_DWORD /d 1 /f, xrefs: 00BF2D8E
powershell wininit, xrefs: 00BF2ED3
WARNING, xrefs: 00BF2D1C
LAST WARNING, xrefs: 00BF2D35

Memory Dump Source

Source File: 00000000.00000002.1449597703.0000000000BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BF0000, based on PE: true

Associated: 00000000.00000002.1446414744.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450073239.0000000000BF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_KRITENESIAS.jbxd

Similarity

API ID: Thread$CreateSleep$Terminate$system$FileMessageWindow$CloseConsoleHandleShowWrite
String ID: IF YOU MADE IT TO THYIS POINT AND YOU STILL DONT KNOW WHAT IS GOING ONTHIS IS MALWARE THAT WILLDESTROY YOUR COMPUTERTHE AUTHOR$LAST WARNING$The program you have just executed is a malware that can harm your deviceAnd make it unbootableBy continuing you agreeThat thi$WARNING$\\.\PhysicalDrive0$powershell wininit$reg add HKCUHKEY_CURRENT_USERSoftwarePoliciesMicrosoftWindowsSystem / v DisableCMD / t REG_DWORD / d 1 / f$reg add HKCUHKEY_CURRENT_USERSoftwarePoliciesMicrosoftWindowsSystem /v DisableTaskMgr /t REG_DWORD /d 1 /f$reg add HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem /v DisableRegistryTools /t REG_DWORD /d 1 /f
API String ID: 1486687036-177777972
Opcode ID: fd52004fef1496db8c0183c385de27daa3dc9fb4037a97ba94ba14d516f1acbe
Instruction ID: 208e9e6546b416265ceacb021c7589f9c58711f2a18ce6b8ba01de5c06bba3a8
Opcode Fuzzy Hash: fd52004fef1496db8c0183c385de27daa3dc9fb4037a97ba94ba14d516f1acbe
Instruction Fuzzy Hash: E3413031BC0718B6F13077B96C0BF6D6A94AB49F46F324890F708BF1D18DE46904866E

Function 00BF102D Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 124
windowsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32(00000000), ref: 00BF1801
GetSystemMetrics.USER32(00000001), ref: 00BF1808
GetSystemMetrics.USER32(00000000), ref: 00BF180F
GetSystemMetrics.USER32(00000001), ref: 00BF1815
GetDC.USER32(00000000), ref: 00BF1824
CreateCompatibleDC.GDI32(00000000), ref: 00BF182D
CreateCompatibleBitmap.GDI32(00000000,00000000,?), ref: 00BF183D
SelectObject.GDI32(00000000,00000000), ref: 00BF1845
BitBlt.GDI32(00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00CC0020), ref: 00BF185F
_libm_sse2_sin_precise.API-MS-WIN-CRT-MATH-L1-1-0(00000000,00CC0020), ref: 00BF1886
BitBlt.GDI32(00000000,00000000,00000000,00000000,00000001,?,00000000,00000000,00CC0020), ref: 00BF18A2
Sleep.KERNELBASE(0000000A), ref: 00BF18CB
PatBlt.GDI32(00000000,00000000,?,?,?,005A0049), ref: 00BF18F0
_libm_sse2_sin_precise.API-MS-WIN-CRT-MATH-L1-1-0(00CC0020), ref: 00BF1900
BitBlt.GDI32(00000000,00000000,00000000,00000001,?,?,00000000,00000000,00CC0020), ref: 00BF191F
Sleep.KERNEL32(0000000A), ref: 00BF1943
Sleep.KERNEL32(0000000A), ref: 00BF1966

Strings

@L(t, xrefs: 00BF182D
@M(t, xrefs: 00BF185F, 00BF18A2, 00BF191F

Memory Dump Source

Source File: 00000000.00000002.1449597703.0000000000BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BF0000, based on PE: true

Associated: 00000000.00000002.1446414744.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450073239.0000000000BF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_KRITENESIAS.jbxd

Similarity

API ID: MetricsSystem$Sleep$CompatibleCreate_libm_sse2_sin_precise$BitmapObjectSelect
String ID: @L(t$@M(t
API String ID: 2592621613-4150930626
Opcode ID: e72d0976a61ce07f3adc350325d049bdb8d293e31e2d3262a54700b91c87e4f7
Instruction ID: 5bde315562436f43ca99ae2f178594d500e6c8a7378a73be75d121810437c8cf
Opcode Fuzzy Hash: e72d0976a61ce07f3adc350325d049bdb8d293e31e2d3262a54700b91c87e4f7
Instruction Fuzzy Hash: 93415935D4071CEADB129FA49C86FAFBB78EF0AB44F224154F605BB190DB705A81DB90

Function 00BF109B Relevance: 47.4, APIs: 25, Strings: 2, Instructions: 138
windowsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDC.USER32(00000000), ref: 00BF1B6B
GetSystemMetrics.USER32(00000000), ref: 00BF1B7E
GetSystemMetrics.USER32(00000001), ref: 00BF1B85
_time64.API-MS-WIN-CRT-TIME-L1-1-0(?), ref: 00BF1B8D
rand.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,00000000,?,00000000,00CC0020), ref: 00BF1BAE
rand.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 00BF1BBB
rand.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 00BF1BC4
rand.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?), ref: 00BF1BCA
StretchBlt.GDI32(00000000,?,?,?,?,?), ref: 00BF1BD2
Sleep.KERNELBASE(00000032,?,?,?,?,?), ref: 00BF1BDA
rand.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?), ref: 00BF1BE0
rand.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?), ref: 00BF1BED
rand.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?), ref: 00BF1C00
CreateSolidBrush.GDI32(00000000), ref: 00BF1C0E
SelectObject.GDI32(?,00000000), ref: 00BF1C1B
PatBlt.GDI32(?,00000000,00000001,?,00000000,005A0049), ref: 00BF1C2F
DeleteObject.GDI32(00000000), ref: 00BF1C36
PatBlt.GDI32(?,00000000,00000001,?,00000000,005A0049), ref: 00BF1C4B
BitBlt.GDI32(?,00000000,00000000,?,00000000,?,00000000,FFFFFC7C,00330008), ref: 00BF1C65
BitBlt.GDI32(?,00000000,00000000,?,00000000,?,00000000,-00000384,00330008), ref: 00BF1C81
rand.API-MS-WIN-CRT-UTILITY-L1-1-0(001100A6,?,?,?,?,?), ref: 00BF1C92
rand.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?), ref: 00BF1C9D
rand.API-MS-WIN-CRT-UTILITY-L1-1-0(?,00000000,?,?,?,?,?,?,?,?), ref: 00BF1CAD
rand.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?), ref: 00BF1CB8
BitBlt.GDI32(?,?,?,?,?,?,?), ref: 00BF1CC4

Strings

@M(t, xrefs: 00BF1C65, 00BF1C81, 00BF1CC4
`GTw, xrefs: 00BF1B8D

Memory Dump Source

Source File: 00000000.00000002.1449597703.0000000000BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BF0000, based on PE: true

Associated: 00000000.00000002.1446414744.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450073239.0000000000BF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_KRITENESIAS.jbxd

Similarity

API ID: rand$MetricsObjectSystem$BrushCreateDeleteSelectSleepSolidStretch_time64
String ID: @M(t$`GTw
API String ID: 1692169890-2363908596
Opcode ID: c7cce151e983b6d865dbfb312c5096265e3c4d384d4e0ae2a4dd29af88c50054
Instruction ID: fb33ce2f0d00595f1f99d7e83f28cc6073a156d6c2c46d3c6b2b240c7842afa0
Opcode Fuzzy Hash: c7cce151e983b6d865dbfb312c5096265e3c4d384d4e0ae2a4dd29af88c50054
Instruction Fuzzy Hash: A5418FB5A40218BBE71157A18C8AF7F3E7DEB88B44F224459F605A71D0CAB86D01DAB1

Function 00BF11DB Relevance: 24.1, APIs: 16, Instructions: 80
windowsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDC.USER32(00000000), ref: 00BF14BB
GetSystemMetrics.USER32(00000000), ref: 00BF14CE
GetSystemMetrics.USER32(00000001), ref: 00BF14D5
rand.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,00000000,?,00000000,00CC0020), ref: 00BF14EF
rand.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001,?), ref: 00BF14FD
rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00BF1505
rand.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 00BF150C
StretchBlt.GDI32(00000000,?,?,?), ref: 00BF1513
Sleep.KERNELBASE(00000032,?,?,?), ref: 00BF151B
rand.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?), ref: 00BF1521
rand.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?), ref: 00BF152E
rand.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?), ref: 00BF153D
CreateSolidBrush.GDI32(00000000), ref: 00BF1547
SelectObject.GDI32(?,00000000), ref: 00BF1554
PatBlt.GDI32(?,00000000,00000001,?,?,005A0049), ref: 00BF156B
DeleteObject.GDI32(00000000), ref: 00BF1572

Memory Dump Source

Source File: 00000000.00000002.1449597703.0000000000BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BF0000, based on PE: true

Associated: 00000000.00000002.1446414744.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450073239.0000000000BF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_KRITENESIAS.jbxd

Similarity

API ID: rand$MetricsObjectSystem$BrushCreateDeleteSelectSleepSolidStretch
String ID:
API String ID: 1641008235-0
Opcode ID: 1c262c06cf3951d7d5be976d1eff35496e9ecb796b6ea9b26803e72e218ad88d
Instruction ID: 390e9c995b51455f81703e8e07fe597d658db78a6107d2362a4511b638ec02a2
Opcode Fuzzy Hash: 1c262c06cf3951d7d5be976d1eff35496e9ecb796b6ea9b26803e72e218ad88d
Instruction Fuzzy Hash: D5217576D41214BBE71097B58C89FBE7EB9EB88B54F264054FA05A3280CA78AD00DB65

Function 00BF3552 Relevance: 15.2, APIs: 10, Instructions: 215
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BF1230: ___get_entropy.LIBCMT ref: 00BF405E

_initterm_e.API-MS-WIN-CRT-RUNTIME-L1-1-0(00BF630C,00BF6618,00BFDFE8,00000014), ref: 00BF35AF
_initterm.API-MS-WIN-CRT-RUNTIME-L1-1-0(00BF6000,00BF6208,00BFDFE8,00000014), ref: 00BF35D5
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00BFDFE8,00000014), ref: 00BF3636
_get_initial_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0(00BFDFE8,00000014), ref: 00BF363C
__p___argv.API-MS-WIN-CRT-RUNTIME-L1-1-0(00BFDFE8,00000014), ref: 00BF3643
__p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0(00BFDFE8,00000014), ref: 00BF364A
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00BF366A
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000007,00BFDFE8,00000014), ref: 00BF36D2
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000007,00BFDFE8,00000014), ref: 00BF36DA
_configure_narrow_argv.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 00BF3746

Memory Dump Source

Source File: 00000000.00000002.1449597703.0000000000BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BF0000, based on PE: true

Associated: 00000000.00000002.1446414744.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450073239.0000000000BF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_KRITENESIAS.jbxd

Similarity

API ID: ___get_entropy__p___argc__p___argv_cexit_configure_narrow_argv_exit_get_initial_narrow_environment_initterm_initterm_e_register_thread_local_exe_atexit_callbackexit
String ID:
API String ID: 1580609069-0
Opcode ID: 74a45d0ec4e2a54cb647d76727238615a3d36483f62b37f7cae34d3376ed937a
Instruction ID: 3ea5f4f01158f62bddb15522918f0ab6e6a300ea02a6f72963e4296044874e70
Opcode Fuzzy Hash: 74a45d0ec4e2a54cb647d76727238615a3d36483f62b37f7cae34d3376ed937a
Instruction Fuzzy Hash: 7931043164428DBADA20BB7C98026BE37D1DF52B60F2408E9F741BB3D2CF214A4CCA55

Function 00BF2690 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 227
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

waveOutOpen.WINMM(?,000000FF,?,00000000,00000000,00000000), ref: 00BF270A
memset.VCRUNTIME140(?,00000000,0003A980), ref: 00BF271E
waveOutPrepareHeader.WINMM(?,?,00000020), ref: 00BF28ED
waveOutWrite.WINMM(?,?,00000020), ref: 00BF2902
waveOutUnprepareHeader.WINMM(?,?,00000020), ref: 00BF2917
waveOutClose.WINMM(?), ref: 00BF2923

Strings

++++++++++++++++, xrefs: 00BF2735

Memory Dump Source

Source File: 00000000.00000002.1449597703.0000000000BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BF0000, based on PE: true

Associated: 00000000.00000002.1446414744.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450073239.0000000000BF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_KRITENESIAS.jbxd

Similarity

API ID: wave$Header$CloseOpenPrepareUnprepareWritememset
String ID: ++++++++++++++++
API String ID: 1523669167-1908005435
Opcode ID: f0e7731ec98a31d9a13f0be16ce6b9521a9919fdf516e76c18934bd5a4e0509d
Instruction ID: b03445ed5f1c5b603c36fcceac9b6785cfc45ac0273a93c518f2afab4e43d97c
Opcode Fuzzy Hash: f0e7731ec98a31d9a13f0be16ce6b9521a9919fdf516e76c18934bd5a4e0509d
Instruction Fuzzy Hash: 2A910272A066588EDB12CB34CC057B5B7ECEF13384F0282DADA44B7051E7306A8ACB52

Function 00BF29F0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

waveOutOpen.WINMM(?,000000FF,?,00000000,00000000,00000000), ref: 00BF2A55
memset.VCRUNTIME140(?,00000000,0003A980), ref: 00BF2A69
waveOutPrepareHeader.WINMM(?,?,00000020), ref: 00BF2C14
waveOutWrite.WINMM(?,?,00000020), ref: 00BF2C29
waveOutUnprepareHeader.WINMM(?,?,00000020), ref: 00BF2C3E
waveOutClose.WINMM(?), ref: 00BF2C4A

Strings

wUD\wUD\wUD\wUD\, xrefs: 00BF2A8A

Memory Dump Source

Source File: 00000000.00000002.1449597703.0000000000BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BF0000, based on PE: true

Associated: 00000000.00000002.1446414744.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450073239.0000000000BF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_KRITENESIAS.jbxd

Similarity

API ID: wave$Header$CloseOpenPrepareUnprepareWritememset
String ID: wUD\wUD\wUD\wUD\
API String ID: 1523669167-907442124
Opcode ID: 460ed9be84eb7bf5e8c2cd4679a39c50d5509688d5b8b623be5da1c7ca697e18
Instruction ID: 6328624bdc4b3cb5d63d8a2bde27daa0e6a9feba8ad55f0d758d20da1979f9e3
Opcode Fuzzy Hash: 460ed9be84eb7bf5e8c2cd4679a39c50d5509688d5b8b623be5da1c7ca697e18
Instruction Fuzzy Hash: 6251C570A162189EE7138B30DC057EAF7BCAF6B305F5283DBEA4872561D73952858F42

Function 00BF20E0 Relevance: 9.2, APIs: 6, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

waveOutOpen.WINMM(?,000000FF,?,00000000,00000000,00000000), ref: 00BF2145
memset.VCRUNTIME140(?,00000000,0003A980), ref: 00BF2159
waveOutPrepareHeader.WINMM(?,?,00000020), ref: 00BF2391
waveOutWrite.WINMM(?,?,00000020), ref: 00BF23A6
waveOutUnprepareHeader.WINMM(?,?,00000020), ref: 00BF23BB
waveOutClose.WINMM(?), ref: 00BF23C7

Memory Dump Source

Source File: 00000000.00000002.1449597703.0000000000BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BF0000, based on PE: true

Associated: 00000000.00000002.1446414744.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450073239.0000000000BF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_KRITENESIAS.jbxd

Similarity

API ID: wave$Header$CloseOpenPrepareUnprepareWritememset
String ID:
API String ID: 1523669167-0
Opcode ID: 25bf168438cb25fbcc6a0c628fcb405700d7f2cca01a6ac34f350821c14e3c84
Instruction ID: 8f237c4693ffb56d2e3fb7d21bc672974a3296bc0171952442ca30ddfc265142
Opcode Fuzzy Hash: 25bf168438cb25fbcc6a0c628fcb405700d7f2cca01a6ac34f350821c14e3c84
Instruction Fuzzy Hash: 78910371A1A2589FEB13CB3488057A5F3ECAFA3305F5183DEDE54B3061E735528A8B51

Function 00BF1D90 Relevance: 9.2, APIs: 6, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

waveOutOpen.WINMM(?,000000FF,?,00000000,00000000,00000000), ref: 00BF1DF7
memset.VCRUNTIME140(?,00000000,0003A980), ref: 00BF1E0B
waveOutPrepareHeader.WINMM(?,?,00000020), ref: 00BF1FE9
waveOutWrite.WINMM(?,?,00000020), ref: 00BF1FFE
waveOutUnprepareHeader.WINMM(?,?,00000020), ref: 00BF2013
waveOutClose.WINMM(?), ref: 00BF201F

Memory Dump Source

Source File: 00000000.00000002.1449597703.0000000000BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BF0000, based on PE: true

Associated: 00000000.00000002.1446414744.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450073239.0000000000BF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_KRITENESIAS.jbxd

Similarity

API ID: wave$Header$CloseOpenPrepareUnprepareWritememset
String ID:
API String ID: 1523669167-0
Opcode ID: f4bb1d837a9c1824d863cd34ded9432640d4217438f8d8dc9d587c71b3014d49
Instruction ID: cfdaac2fb9a3c35eadb1e7129e274eb91b7e49e6f59144632d40c2d3ca159364
Opcode Fuzzy Hash: f4bb1d837a9c1824d863cd34ded9432640d4217438f8d8dc9d587c71b3014d49
Instruction Fuzzy Hash: 4E61E53AD1B7094BEB139A328801395F66CEF37285F51D3AFBE1436061EB3A32C14A05

Function 00BF24A0 Relevance: 9.1, APIs: 6, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

waveOutOpen.WINMM(?,000000FF,?,00000000,00000000,00000000), ref: 00BF2505
memset.VCRUNTIME140(?,00000000,0003A980), ref: 00BF2519
waveOutPrepareHeader.WINMM(?,?,00000020), ref: 00BF25E2
waveOutWrite.WINMM(?,?,00000020), ref: 00BF25F7
waveOutUnprepareHeader.WINMM(?,?,00000020), ref: 00BF260C
waveOutClose.WINMM(?), ref: 00BF2618

Memory Dump Source

Source File: 00000000.00000002.1449597703.0000000000BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BF0000, based on PE: true

Associated: 00000000.00000002.1446414744.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450073239.0000000000BF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_KRITENESIAS.jbxd

Similarity

API ID: wave$Header$CloseOpenPrepareUnprepareWritememset
String ID:
API String ID: 1523669167-0
Opcode ID: 492505f63edc3542a41e19099f529ee4f4ba53590dfc851aed6b8492b8c2bd29
Instruction ID: c35637fe7e1396e9afa17d683af74f6901bf10d053fb4acf7ad5de76642beb87
Opcode Fuzzy Hash: 492505f63edc3542a41e19099f529ee4f4ba53590dfc851aed6b8492b8c2bd29
Instruction Fuzzy Hash: C2411A70B026189FDB22CF54DC487EEB7BDAB46300F1351DBA68CB6250D77946888F52

Function 00BF2B52 Relevance: 6.1, APIs: 4, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

waveOutPrepareHeader.WINMM(?,?,00000020), ref: 00BF2C14
waveOutWrite.WINMM(?,?,00000020), ref: 00BF2C29
waveOutUnprepareHeader.WINMM(?,?,00000020), ref: 00BF2C3E
waveOutClose.WINMM(?), ref: 00BF2C4A

Memory Dump Source

Source File: 00000000.00000002.1449597703.0000000000BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BF0000, based on PE: true

Associated: 00000000.00000002.1446414744.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450073239.0000000000BF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_KRITENESIAS.jbxd

Similarity

API ID: wave$Header$ClosePrepareUnprepareWrite
String ID:
API String ID: 2996921532-0
Opcode ID: 6d1ee38bb68c2e96d6dd8911a21c508c5884fbe0483a3d309ebd89e817e7f9cf
Instruction ID: f599d12ca734960baac7dfda10909264033650de2b2acb661736eb140e89c812
Opcode Fuzzy Hash: 6d1ee38bb68c2e96d6dd8911a21c508c5884fbe0483a3d309ebd89e817e7f9cf
Instruction Fuzzy Hash: AD414730A06658DFDB128F50DC097A9B7B8EF57301F0640DBDA8AA7062C37456A8DF22

Function 00BF2AE8 Relevance: 6.1, APIs: 4, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

waveOutPrepareHeader.WINMM(?,?,00000020), ref: 00BF2C14
waveOutWrite.WINMM(?,?,00000020), ref: 00BF2C29
waveOutUnprepareHeader.WINMM(?,?,00000020), ref: 00BF2C3E
waveOutClose.WINMM(?), ref: 00BF2C4A

Memory Dump Source

Source File: 00000000.00000002.1449597703.0000000000BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BF0000, based on PE: true

Associated: 00000000.00000002.1446414744.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450073239.0000000000BF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_KRITENESIAS.jbxd

Similarity

API ID: wave$Header$ClosePrepareUnprepareWrite
String ID:
API String ID: 2996921532-0
Opcode ID: 6826206121e0e6d1ae5ab4592e0b0da42ce56b8858895d9c63fec570dde1cbd9
Instruction ID: 4971301d2ceaf4da00861c0f1a8f309e8796aa19efd649c4ff40d3cebb48df5c
Opcode Fuzzy Hash: 6826206121e0e6d1ae5ab4592e0b0da42ce56b8858895d9c63fec570dde1cbd9
Instruction Fuzzy Hash: 47316F71A166189FEB138F30DC083A9F7B8AF67301F5283DBEA4972591D73552848F52

Function 00BF3699 Relevance: 4.6, APIs: 3, Instructions: 121
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BF11E5: GetModuleHandleW.KERNEL32(00000000), ref: 00BF42F3

_c_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00BF36AB
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000007,00BFDFE8,00000014), ref: 00BF36DA

Memory Dump Source

Source File: 00000000.00000002.1449597703.0000000000BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BF0000, based on PE: true

Associated: 00000000.00000002.1446414744.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450073239.0000000000BF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_KRITENESIAS.jbxd

Similarity

API ID: HandleModule_c_exit_exit
String ID:
API String ID: 750871209-0
Opcode ID: 411d7b29df722f923505d97835e734186ee391aaa1bdc11bd3fd05ca4a4814a1
Instruction ID: 1204f08f68a48d02f2c6e38de98ab799ac663e2baadc13d63a4db262021246b5
Opcode Fuzzy Hash: 411d7b29df722f923505d97835e734186ee391aaa1bdc11bd3fd05ca4a4814a1
Instruction Fuzzy Hash: 93E0927190425D9BCF10ABD895023FE77F1EB41324F1009D6E71173291D73519189B50

Non-executed Functions

Function 00BF4152 Relevance: 9.1, APIs: 6, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00BF415E
memset.VCRUNTIME140(?,00000000,00000003), ref: 00BF4184
memset.VCRUNTIME140(?,00000000,00000050), ref: 00BF420E
IsDebuggerPresent.KERNEL32 ref: 00BF422A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00BF4243
UnhandledExceptionFilter.KERNEL32(?), ref: 00BF424D

Memory Dump Source

Source File: 00000000.00000002.1449597703.0000000000BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BF0000, based on PE: true

Associated: 00000000.00000002.1446414744.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450073239.0000000000BF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_KRITENESIAS.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$DebuggerFeatureProcessor
String ID:
API String ID: 1045392073-0
Opcode ID: eaab7e91d329edc623dcbbe14ee6b4d6bf80a513b319f92498b354c65ebbf704
Instruction ID: c4dcbcf23414afa27b68fb57c5592816110444e1de3555142208415283096632
Opcode Fuzzy Hash: eaab7e91d329edc623dcbbe14ee6b4d6bf80a513b319f92498b354c65ebbf704
Instruction Fuzzy Hash: 8B31E475D0521C9BDB21EFA4D949BDDBBB8AF08304F1041EAE50CAB250EB709A88CF45

Function 00BF1D30 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(\\.\PhysicalDrive0,10000000,00000003,00000000,00000003,00000000,00000000), ref: 00BF1D49
WriteFile.KERNEL32(00000000,00BF6B30,00000200,?,00000000), ref: 00BF1D62
CloseHandle.KERNEL32(00000000), ref: 00BF1D69

Strings

\\.\PhysicalDrive0, xrefs: 00BF1D44

Memory Dump Source

Source File: 00000000.00000002.1449597703.0000000000BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BF0000, based on PE: true

Associated: 00000000.00000002.1446414744.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450073239.0000000000BF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_KRITENESIAS.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: \\.\PhysicalDrive0
API String ID: 1065093856-1180397377
Opcode ID: 8bd2c5b99df6f91f795a7354a97e6ca9e0649daeac8279341d0246203f53626f
Instruction ID: 1a14ce3de6502eeffcfe817aa6e67d6af4771c78ea55b405c397cc216e129f1f
Opcode Fuzzy Hash: 8bd2c5b99df6f91f795a7354a97e6ca9e0649daeac8279341d0246203f53626f
Instruction Fuzzy Hash: A3E0EC32381318BBF6215790AC1BFAA3A5CFB05B55F220181FB45EA0D19AE12A1487E9

Function 00BF1203 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(\1), ref: 00BF4348

Strings

\1, xrefs: 00BF4343

Memory Dump Source

Source File: 00000000.00000002.1449597703.0000000000BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BF0000, based on PE: true

Associated: 00000000.00000002.1446414744.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450073239.0000000000BF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_KRITENESIAS.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID: \1
API String ID: 3192549508-2749466366
Opcode ID: 94167857be4e480918d72d277ca0d086883c223e5551fd08cbd58f8b09983573
Instruction ID: e857d163464e6ff583c08b42b4690542f932fce187f67e72c327c386418c161e
Opcode Fuzzy Hash: 94167857be4e480918d72d277ca0d086883c223e5551fd08cbd58f8b09983573
Instruction Fuzzy Hash: BF9002707405099A9D005765AA49BB9359057507057220DD0634A6347496740759D515

Function 00BF3065 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00BF307B

Memory Dump Source

Source File: 00000000.00000002.1449597703.0000000000BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BF0000, based on PE: true

Associated: 00000000.00000002.1446414744.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450073239.0000000000BF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_KRITENESIAS.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 2df213afca8e8632cff4261fefb939f0d283b635fff61de9960b1a47806a36d1
Instruction ID: 84620dd3ff62b22b17fdc7868894a7b4e0e34cd01f61530dab345d63d5f9e5b2
Opcode Fuzzy Hash: 2df213afca8e8632cff4261fefb939f0d283b635fff61de9960b1a47806a36d1
Instruction Fuzzy Hash: C3A159B290060A8BDB18CF68D8D16BDBBF0FF48724F14827AD515EB3A1DB349A44CB54

Function 00BF1650 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 111
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDC.USER32(00000000), ref: 00BF1665
GetSystemMetrics.USER32(00000000), ref: 00BF1675
GetSystemMetrics.USER32(00000001), ref: 00BF167C
_time64.API-MS-WIN-CRT-TIME-L1-1-0(?), ref: 00BF168B
_time64.API-MS-WIN-CRT-TIME-L1-1-0(?), ref: 00BF16A4
GetDesktopWindow.USER32 ref: 00BF16A9
GetWindowRect.USER32(00000000,?), ref: 00BF16B4
rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00BF16EA
rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00BF16F7
rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00BF1706
CreateSolidBrush.GDI32(00000000), ref: 00BF1714
SelectObject.GDI32(00000000,00000000), ref: 00BF171E
PatBlt.GDI32(00000000,00000000,00000001,?,?,005A0049), ref: 00BF1734
DeleteObject.GDI32(00000000), ref: 00BF173B
PlgBlt.GDI32(00000000,?,00000000,?,?,?,?,00000000,00000000,00000000), ref: 00BF1761

Strings

`GTw, xrefs: 00BF167E, 00BF1771

Memory Dump Source

Source File: 00000000.00000002.1449597703.0000000000BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BF0000, based on PE: true

Associated: 00000000.00000002.1446414744.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450073239.0000000000BF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_KRITENESIAS.jbxd

Similarity

API ID: rand$MetricsObjectSystemWindow_time64$BrushCreateDeleteDesktopRectSelectSolid
String ID: `GTw
API String ID: 557176497-2130825109
Opcode ID: ad828f776d1e03ed2fcdbaaf384da837802f42990ed9cfb5e3165ca995eba305
Instruction ID: 6f55e143a6c393ea4ab1284efa413ea4d303fb3e4c87f65e8d656a95a6349d8c
Opcode Fuzzy Hash: ad828f776d1e03ed2fcdbaaf384da837802f42990ed9cfb5e3165ca995eba305
Instruction Fuzzy Hash: 37413DB2D00219AFDB00DFA4DC49BDEBBB8FF48314F264566E905F7250DA75A904CBA4

Function 00BF1212 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 71
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDC.USER32(00000000), ref: 00BF19EB
GetSystemMetrics.USER32(00000000), ref: 00BF19FC
GetSystemMetrics.USER32(00000001), ref: 00BF1A03
rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00BF1A10
rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00BF1A1D
rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00BF1A2C
CreateSolidBrush.GDI32(00000000), ref: 00BF1A36
SelectObject.GDI32(?,00000000), ref: 00BF1A43
PatBlt.GDI32(?,00000000,00000001,?,?,005A0049), ref: 00BF1A59
DeleteObject.GDI32(00000000), ref: 00BF1A60
rand.API-MS-WIN-CRT-UTILITY-L1-1-0(00CC0020), ref: 00BF1A6B
rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00BF1A76
rand.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?), ref: 00BF1A83
rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00BF1A89
BitBlt.GDI32(?), ref: 00BF1A90

Strings

@M(t, xrefs: 00BF1A90

Memory Dump Source

Source File: 00000000.00000002.1449597703.0000000000BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BF0000, based on PE: true

Associated: 00000000.00000002.1446414744.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450073239.0000000000BF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_KRITENESIAS.jbxd

Similarity

API ID: rand$MetricsObjectSystem$BrushCreateDeleteSelectSolid
String ID: @M(t
API String ID: 2950302033-3358032445
Opcode ID: 457d4a3c42cd63f7222337db4bd93549cc6f82e1164b96fd531fefe4bceebe51
Instruction ID: 9021a20d5abd4a1e298d43f20b86b755740d96ad3228a86dc5f2f179339b7774
Opcode Fuzzy Hash: 457d4a3c42cd63f7222337db4bd93549cc6f82e1164b96fd531fefe4bceebe51
Instruction Fuzzy Hash: D111E376C11228BBD71057F18C89FAF3E79EF88B50F2B8454FA0563190CA789800DBB4

Function 00BF11D6 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00BF1AD9
GetSystemMetrics.USER32(00000000), ref: 00BF1AE9
GetSystemMetrics.USER32(00000001), ref: 00BF1AEF
rand.API-MS-WIN-CRT-UTILITY-L1-1-0(001100A6), ref: 00BF1B05
rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00BF1B10
rand.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,?,00000000), ref: 00BF1B20
rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00BF1B2B
BitBlt.GDI32(00000000), ref: 00BF1B37

Strings

@M(t, xrefs: 00BF1B37

Memory Dump Source

Source File: 00000000.00000002.1449597703.0000000000BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BF0000, based on PE: true

Associated: 00000000.00000002.1446414744.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450073239.0000000000BF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_KRITENESIAS.jbxd

Similarity

API ID: rand$MetricsSystem
String ID: @M(t
API String ID: 2696769970-3358032445
Opcode ID: a175ff0f61ac4f22c67efa521f989492f5c4e0d4bc61af0c1ee4cd58a51dee74
Instruction ID: 779727924ffe56b16b94161a3efd2f65f4b528894a76bb0ca3bc30d2fa399b1b
Opcode Fuzzy Hash: a175ff0f61ac4f22c67efa521f989492f5c4e0d4bc61af0c1ee4cd58a51dee74
Instruction Fuzzy Hash: 21F062F4A04218FBF20967A1CC9AF3F396EDBC8740F11446EB602672919DF46C409571

Function 00BF1244 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00BF15C5
GetSystemMetrics.USER32(00000000), ref: 00BF15D5
GetSystemMetrics.USER32(00000001), ref: 00BF15DB
PatBlt.GDI32(00000000,00000000,00000001,00000000,00000000,005A0049), ref: 00BF15EC
BitBlt.GDI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,FFFFFC7C,00330008), ref: 00BF1606
BitBlt.GDI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000384,00330008), ref: 00BF1622

Strings

@M(t, xrefs: 00BF1606, 00BF1622

Memory Dump Source

Source File: 00000000.00000002.1449597703.0000000000BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BF0000, based on PE: true

Associated: 00000000.00000002.1446414744.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450073239.0000000000BF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_KRITENESIAS.jbxd

Similarity

API ID: MetricsSystem
String ID: @M(t
API String ID: 4116985748-3358032445
Opcode ID: c8df093e9962aef699b44fe472d720b4cf6fb55d09aac7fa31190ebc34cd5cd5
Instruction ID: 44d31a42f8178ce13f9d6804f08ed38a2d965ec94bd16ad1eddc5937c3efe4d4
Opcode Fuzzy Hash: c8df093e9962aef699b44fe472d720b4cf6fb55d09aac7fa31190ebc34cd5cd5
Instruction Fuzzy Hash: D0F03431380324BBF27456615C8EFAB296CEB86F99F220000FB05AA1D0D6E52905C6B8

Function 00BF345D Relevance: 10.6, APIs: 7, Instructions: 98COMMON

Download Yara Rule

APIs

_set_app_type.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000001), ref: 00BF3460
_set_fmode.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001), ref: 00BF346B
__p__commode.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001), ref: 00BF3477
_configure_narrow_argv.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,Function_000010EB), ref: 00BF34A4

Part of subcall function 00BF105A: InitializeSListHead.KERNEL32(00BFF5B8), ref: 00BF40BC

__setusermatherr.API-MS-WIN-CRT-MATH-L1-1-0(Function_00001096), ref: 00BF34C2
_configthreadlocale.API-MS-WIN-CRT-LOCALE-L1-1-0(00000000), ref: 00BF34DD
_initialize_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00BF34EC

Memory Dump Source

Source File: 00000000.00000002.1449597703.0000000000BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BF0000, based on PE: true

Associated: 00000000.00000002.1446414744.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450073239.0000000000BF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_KRITENESIAS.jbxd

Similarity

API ID: HeadInitializeList__p__commode__setusermatherr_configthreadlocale_configure_narrow_argv_initialize_narrow_environment_set_app_type_set_fmode
String ID:
API String ID: 2025284546-0
Opcode ID: e0e6f5c0b087e370d2137f3ff8daa5619c01b98e145173a09a93b21e3137b82c
Instruction ID: 266577efe151acec890cfae378fa421c93b869963cfc791b90b1074f93b978ef
Opcode Fuzzy Hash: e0e6f5c0b087e370d2137f3ff8daa5619c01b98e145173a09a93b21e3137b82c
Instruction Fuzzy Hash: C6013755A4028ED5D92033FD1907ABF16C88F92BA5F050CD1BB40AB187EF668A8C81B2

Function 00BF4355 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__current_exception.VCRUNTIME140 ref: 00BF4394
__current_exception_context.VCRUNTIME140 ref: 00BF439E
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00BF43A5

Strings

csm, xrefs: 00BF435F

Memory Dump Source

Source File: 00000000.00000002.1449597703.0000000000BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BF0000, based on PE: true

Associated: 00000000.00000002.1446414744.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450073239.0000000000BF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1450465024.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf0000_KRITENESIAS.jbxd

Similarity

API ID: __current_exception__current_exception_contextterminate
String ID: csm
API String ID: 2542180945-1018135373
Opcode ID: 730beda78dd201a10c42c93084eb31d4734f5110e41a9eef711ae8d3444d3f66
Instruction ID: 0fdeb7d0c7efe72d61d723911330e36d9d7eb194bfe2efddaee5adbef6e1c808
Opcode Fuzzy Hash: 730beda78dd201a10c42c93084eb31d4734f5110e41a9eef711ae8d3444d3f66
Instruction Fuzzy Hash: 57F05E360002098BCB20AF69944417FF7EDFF21321B9A04A6E6448B611C770AD99C7D9

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report KRITENESIAS.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Key, Mouse, Clipboard, Microphone and Screen Capturing

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0ar1l3lt.qch.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0vc5qcrh.qhc.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e4fwagcx.owr.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jwzw5bs5.20n.psm1

\Device\Harddisk0\DR0

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

Windows Analysis Report
KRITENESIAS.exe

Function 00BF2D00 Relevance: 73.7, APIs: 33, Strings: 9, Instructions: 169
threadsleepprocessCOMMON

Function 00BF102D Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 124
windowsleepCOMMON

Function 00BF109B Relevance: 47.4, APIs: 25, Strings: 2, Instructions: 138
windowsleepCOMMON

Function 00BF11DB Relevance: 24.1, APIs: 16, Instructions: 80
windowsleepCOMMON

Function 00BF3552 Relevance: 15.2, APIs: 10, Instructions: 215
COMMON

Function 00BF2690 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 227
COMMON

Function 00BF29F0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123
COMMON

Function 00BF20E0 Relevance: 9.2, APIs: 6, Instructions: 236
COMMON

Function 00BF1D90 Relevance: 9.2, APIs: 6, Instructions: 157
COMMON

Function 00BF24A0 Relevance: 9.1, APIs: 6, Instructions: 91
COMMON

Function 00BF2B52 Relevance: 6.1, APIs: 4, Instructions: 90
COMMON

Function 00BF2AE8 Relevance: 6.1, APIs: 4, Instructions: 70
COMMON

Function 00BF3699 Relevance: 4.6, APIs: 3, Instructions: 121
COMMON