Windows Analysis Report
5XpKRbh2k7.exe

Overview

General Information

Sample name:	5XpKRbh2k7.exe (renamed file extension from none to exe, renamed because original name is a hash value)
Original sample name:	d89bfa433590d35313bc40cfdd257acc84331d1f95cda24a47c22c23af78c724
Analysis ID:	1544261
MD5:	0b9820ecc88383016b7ff530a6777294
SHA1:	44c13dfa53d66e6c13b3eb06323d900cebfe7e6e
SHA256:	d89bfa433590d35313bc40cfdd257acc84331d1f95cda24a47c22c23af78c724
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

.NET source code contains potential unpacker

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Classification

Signatures

Source: 5XpKRbh2k7.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\b\w\d6337ac2abf63a4b\.repositories\DependencyInjection\src\Microsoft.Extensions.DependencyInjection.Abstractions\bin\Release\netstandard1.0\Microsoft.Extensions.DependencyInjection.Abstractions.pdb source: 5XpKRbh2k7.exe
Source:	Binary string: mscorlib.pdb source: WER2F60.tmp.dmp.3.dr
Source:	Binary string: D:\a\1\s\xpdBootstrapper\obj\Release\net472\xpdBootstrapper.pdb source: 5XpKRbh2k7.exe
Source:	Binary string: E:\A\_work\708\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Diagnostics.DiagnosticSource\net46\System.Diagnostics.DiagnosticSource.pdb source: 5XpKRbh2k7.exe
Source:	Binary string: D:\a\1\s\Microsoft.Applications.Events\obj\Server\netstandard1.3\Microsoft.Applications.Events.Server.pdbSHA256 source: 5XpKRbh2k7.exe
Source:	Binary string: mscorlib.ni.pdb source: WER2F60.tmp.dmp.3.dr
Source:	Binary string: D:\a\1\s\Microsoft.Applications.Events\obj\Server\netstandard1.3\Microsoft.Applications.Events.Server.pdb source: 5XpKRbh2k7.exe
Source:	Binary string: D:\a\1\s\OTelCS.Net461\Sources\OneCollector\obj\Release\Microsoft.Office.Telemetry.OneCollector.pdb source: 5XpKRbh2k7.exe
Source:	Binary string: D:\a\1\s\EventFlags.Net45\Sources\obj\Release\Microsoft.Office.Telemetry.EventFlags.pdb source: 5XpKRbh2k7.exe
Source:	Binary string: D:\a\1\s\EventFlags.Net45\Sources\obj\Release\Microsoft.Office.Telemetry.EventFlags.pdb\|A source: 5XpKRbh2k7.exe
Source:	Binary string: D:\a\1\s\OTelCS.Net461\Sources\TelemetryService\obj\Release\OTelCS.pdb source: 5XpKRbh2k7.exe
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER2F60.tmp.dmp.3.dr
Source:	Binary string: C:\b\w\d6337ac2abf63a4b\.repositories\Logging\src\Microsoft.Extensions.Logging.Abstractions\bin\Release\netstandard1.1\Microsoft.Extensions.Logging.Abstractions.pdb source: 5XpKRbh2k7.exe
Source:	Binary string: C:\b\w\d6337ac2abf63a4b\.repositories\Microsoft.Data.Sqlite\src\Microsoft.Data.Sqlite\bin\Release\netstandard1.3\Microsoft.Data.Sqlite.pdb source: 5XpKRbh2k7.exe
Source:	Binary string: C:\b\w\d6337ac2abf63a4b\.repositories\Logging\src\Microsoft.Extensions.Logging\bin\Release\netstandard1.1\Microsoft.Extensions.Logging.pdb source: 5XpKRbh2k7.exe

Networking

Yara detected Generic Downloader

Source: Yara match

File source: 5XpKRbh2k7.exe, type: SAMPLE

Source: 5XpKRbh2k7.exe	String found in binary or memory: http://corppki/aia/MSIT%20CA%20Z1(2).crt0E
Source: 5XpKRbh2k7.exe	String found in binary or memory: http://corppki/aia/msintcrca.crt0=
Source: 5XpKRbh2k7.exe	String found in binary or memory: http://corppki/crl/MSIT%20CA%20Z1(2).crl
Source: 5XpKRbh2k7.exe	String found in binary or memory: http://corppki/crl/msintcrca.crl
Source: 5XpKRbh2k7.exe	String found in binary or memory: http://sqlite.org/rescode.html
Source: Amcache.hve.3.dr	String found in binary or memory: http://upx.sf.net
Source: 5XpKRbh2k7.exe	String found in binary or memory: http://www.asp.net/
Source: 5XpKRbh2k7.exe	String found in binary or memory: https://pipe.int.trafficmanager.net/OneCollector/1.0/
Source: 5XpKRbh2k7.exe	String found in binary or memory: https://support.office.com/oReplacing

One or more processes crash

Source: C:\Users\user\Desktop\5XpKRbh2k7.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7096 -s 760

Sample file is different than original file name gathered from version info

Source: 5XpKRbh2k7.exe, 00000000.00000000.1682954949.000001EE03462000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Applications.Events.Server.dllj% vs 5XpKRbh2k7.exe
Source: 5XpKRbh2k7.exe, 00000000.00000000.1682954949.000001EE03462000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Data.Sqlite.dll> vs 5XpKRbh2k7.exe
Source: 5XpKRbh2k7.exe, 00000000.00000000.1682954949.000001EE03462000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Extensions.DependencyInjection.Abstractions.dllT vs 5XpKRbh2k7.exe
Source: 5XpKRbh2k7.exe, 00000000.00000000.1682954949.000001EE03462000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Extensions.Logging.dllT vs 5XpKRbh2k7.exe
Source: 5XpKRbh2k7.exe, 00000000.00000000.1682954949.000001EE03462000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Extensions.Logging.Abstractions.dllT vs 5XpKRbh2k7.exe
Source: 5XpKRbh2k7.exe, 00000000.00000000.1682954949.000001EE03462000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Office.Telemetry.EventFlags.dlll& vs 5XpKRbh2k7.exe
Source: 5XpKRbh2k7.exe, 00000000.00000000.1682954949.000001EE03462000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Office.Telemetry.OneCollector.dllB vs 5XpKRbh2k7.exe
Source: 5XpKRbh2k7.exe, 00000000.00000000.1682954949.000001EE03462000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameOTelCS.dll. vs 5XpKRbh2k7.exe
Source: 5XpKRbh2k7.exe, 00000000.00000000.1682954949.000001EE03462000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Diagnostics.DiagnosticSource.dllT vs 5XpKRbh2k7.exe
Source: 5XpKRbh2k7.exe, 00000000.00000000.1682954949.000001EE036E7000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamexpdBootstrapper.exeX vs 5XpKRbh2k7.exe
Source: 5XpKRbh2k7.exe	Binary or memory string: OriginalFilenameMicrosoft.Applications.Events.Server.dllj% vs 5XpKRbh2k7.exe
Source: 5XpKRbh2k7.exe	Binary or memory string: OriginalFilenameMicrosoft.Data.Sqlite.dll> vs 5XpKRbh2k7.exe
Source: 5XpKRbh2k7.exe	Binary or memory string: OriginalFilenameMicrosoft.Extensions.DependencyInjection.Abstractions.dllT vs 5XpKRbh2k7.exe
Source: 5XpKRbh2k7.exe	Binary or memory string: OriginalFilenameMicrosoft.Extensions.Logging.dllT vs 5XpKRbh2k7.exe
Source: 5XpKRbh2k7.exe	Binary or memory string: OriginalFilenameMicrosoft.Extensions.Logging.Abstractions.dllT vs 5XpKRbh2k7.exe
Source: 5XpKRbh2k7.exe	Binary or memory string: OriginalFilenameMicrosoft.Office.Telemetry.EventFlags.dlll& vs 5XpKRbh2k7.exe
Source: 5XpKRbh2k7.exe	Binary or memory string: OriginalFilenameMicrosoft.Office.Telemetry.OneCollector.dllB vs 5XpKRbh2k7.exe
Source: 5XpKRbh2k7.exe	Binary or memory string: OriginalFilenameOTelCS.dll. vs 5XpKRbh2k7.exe
Source: 5XpKRbh2k7.exe	Binary or memory string: OriginalFilenameSystem.Diagnostics.DiagnosticSource.dllT vs 5XpKRbh2k7.exe
Source: 5XpKRbh2k7.exe	Binary or memory string: OriginalFilenamexpdBootstrapper.exeX vs 5XpKRbh2k7.exe

Source: 5XpKRbh2k7.exe, IAppxBundleReader.cs	Suspicious method names: ..GetPayloadPackage
Source: 5XpKRbh2k7.exe, IAppxBundleReader.cs	Suspicious method names: ..GetPayloadPackages
Source: 5XpKRbh2k7.exe, IAppxPackageWriter.cs	Suspicious method names: ..AddPayloadFile
Source: 5XpKRbh2k7.exe, IAppxPackageReader.cs	Suspicious method names: ..GetPayloadFile
Source: 5XpKRbh2k7.exe, IAppxPackageReader.cs	Suspicious method names: ..GetPayloadFiles
Source: 5XpKRbh2k7.exe, Program.cs	Suspicious method names: .Program.GetPayload
Source: 5XpKRbh2k7.exe, Program.cs	Suspicious method names: .Program.InjectResources
Source: 5XpKRbh2k7.exe, Program.cs	Suspicious method names: .Program.PayloadFromPackage

Source: classification engine

Classification label: mal48.troj.evad.winEXE@2/5@0/0

Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7096

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\9c090737-4f8e-4ed4-81c7-d95a0bb408c4

Jump to behavior

Source: 5XpKRbh2k7.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 5XpKRbh2k7.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\5XpKRbh2k7.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 5XpKRbh2k7.exe	String found in binary or memory: --help
Source: 5XpKRbh2k7.exe	String found in binary or memory: --help
Source: 5XpKRbh2k7.exe	String found in binary or memory: !/silent /installQRunning WebView2 Evergreen bootstrapper.[WebView2 Evergreen bootstrapper has been run.aError running WebView2 Evergreen bootstrapper: '
Source: 5XpKRbh2k7.exe	String found in binary or memory: Try `= --help' for more information.
Source: 5XpKRbh2k7.exe	String found in binary or memory: Try `= --help' for more information.
Source: 5XpKRbh2k7.exe	String found in binary or memory: install/Installs a packaged app?Installs a packaged application!p:\|pkg:\|package:
Source: 5XpKRbh2k7.exe	String found in binary or memory: launch/Launches an application/pfn:\|packageFamilyName:kPackage family name of the application to be launchedeCommand line to pass into the launched applicationlistYLists all versions of the app on this device
Source: 5XpKRbh2k7.exe	String found in binary or memory: Input does not match expected format: [x-y]. Run xpdAgent.exe configure-buckets --help to see formatting instructions
Source: 5XpKRbh2k7.exe	String found in binary or memory: Input does not match expected format: [x-y]. Run xpdAgent.exe configure-buckets --help to see formatting instructions
Source: 5XpKRbh2k7.exe	String found in binary or memory: Unable to parse range. Run xpdAgent.exe configure-buckets --help to see formatting instructions
Source: 5XpKRbh2k7.exe	String found in binary or memory: Unable to parse range. Run xpdAgent.exe configure-buckets --help to see formatting instructions
Source: 5XpKRbh2k7.exe	String found in binary or memory: IChecking installation prerequisites.yAt least one installation prerequisite was not met, exiting.KCompleted installation prerequisites./Installation succeeded.EInstallation failed with exception
Source: 5XpKRbh2k7.exe	String found in binary or memory: qFailed to add persistent data fields to an unusable sink/AddPersistentDataFields!Dropping event: %SendTelemetryEvent9Event name was null or empty
Source: 5XpKRbh2k7.exe	String found in binary or memory: {"indirect":"false","quiet":"false","errorBaseUrl":"https://go.microsoft.com/fwlink/","errorParameters":"linkid=2238672","packageFamilyName":"Microsoft.OutlookForWindows_8wekyb3d8bbwe","applicationId":"Microsoft.OutlookforWindows","arm64":"https://res.cdn.office.net/nativehost/5mttl/installer/v2/1.2024.1018.100/Microsoft.OutlookForWindows_arm64.msix","x86":"https://res.cdn.office.net/nativehost/5mttl/installer/v2/1.2024.1018.100/Microsoft.OutlookForWindows_x86.msix","x64":"https://res.cdn.office.net/nativehost/5mttl/installer/v2/1.2024.1018.100/Microsoft.OutlookForWindows_x64.msix","CompanyName":"Microsoft Corporation","FileDescription":"Microsoft Outlook Installer","FileVersion":"1.2024.1018.100","LegalCopyright":"Copyright (C) Microsoft Corporation. All rights reserved.","ProductName":"Microsoft Outlook Installer","ProductVersion":"1.2024.1018.100","packageManifest":"C:\\a\\_work\\1\\b\\2\\_work\\1\\s\\build\\win-x64-release\\xpdPackLogs\\AppXManifest.xml","errorBackgroundColor":"#ffffff","errorTextColor":"#737474","enableStubMode":"true"}PA

Source: unknown	Process created: C:\Users\user\Desktop\5XpKRbh2k7.exe "C:\Users\user\Desktop\5XpKRbh2k7.exe"
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7096 -s 760

Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: C:\Users\user\Desktop\5XpKRbh2k7.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 5XpKRbh2k7.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 5XpKRbh2k7.exe

Static file information: File size 2725888 > 1048576

Source: 5XpKRbh2k7.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x1b9600

Source: 5XpKRbh2k7.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: 5XpKRbh2k7.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\b\w\d6337ac2abf63a4b\.repositories\DependencyInjection\src\Microsoft.Extensions.DependencyInjection.Abstractions\bin\Release\netstandard1.0\Microsoft.Extensions.DependencyInjection.Abstractions.pdb source: 5XpKRbh2k7.exe
Source:	Binary string: mscorlib.pdb source: WER2F60.tmp.dmp.3.dr
Source:	Binary string: D:\a\1\s\xpdBootstrapper\obj\Release\net472\xpdBootstrapper.pdb source: 5XpKRbh2k7.exe
Source:	Binary string: E:\A\_work\708\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Diagnostics.DiagnosticSource\net46\System.Diagnostics.DiagnosticSource.pdb source: 5XpKRbh2k7.exe
Source:	Binary string: D:\a\1\s\Microsoft.Applications.Events\obj\Server\netstandard1.3\Microsoft.Applications.Events.Server.pdbSHA256 source: 5XpKRbh2k7.exe
Source:	Binary string: mscorlib.ni.pdb source: WER2F60.tmp.dmp.3.dr
Source:	Binary string: D:\a\1\s\Microsoft.Applications.Events\obj\Server\netstandard1.3\Microsoft.Applications.Events.Server.pdb source: 5XpKRbh2k7.exe
Source:	Binary string: D:\a\1\s\OTelCS.Net461\Sources\OneCollector\obj\Release\Microsoft.Office.Telemetry.OneCollector.pdb source: 5XpKRbh2k7.exe
Source:	Binary string: D:\a\1\s\EventFlags.Net45\Sources\obj\Release\Microsoft.Office.Telemetry.EventFlags.pdb source: 5XpKRbh2k7.exe
Source:	Binary string: D:\a\1\s\EventFlags.Net45\Sources\obj\Release\Microsoft.Office.Telemetry.EventFlags.pdb\|A source: 5XpKRbh2k7.exe
Source:	Binary string: D:\a\1\s\OTelCS.Net461\Sources\TelemetryService\obj\Release\OTelCS.pdb source: 5XpKRbh2k7.exe
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER2F60.tmp.dmp.3.dr
Source:	Binary string: C:\b\w\d6337ac2abf63a4b\.repositories\Logging\src\Microsoft.Extensions.Logging.Abstractions\bin\Release\netstandard1.1\Microsoft.Extensions.Logging.Abstractions.pdb source: 5XpKRbh2k7.exe
Source:	Binary string: C:\b\w\d6337ac2abf63a4b\.repositories\Microsoft.Data.Sqlite\src\Microsoft.Data.Sqlite\bin\Release\netstandard1.3\Microsoft.Data.Sqlite.pdb source: 5XpKRbh2k7.exe
Source:	Binary string: C:\b\w\d6337ac2abf63a4b\.repositories\Logging\src\Microsoft.Extensions.Logging\bin\Release\netstandard1.1\Microsoft.Extensions.Logging.pdb source: 5XpKRbh2k7.exe

Data Obfuscation

.NET source code contains potential unpacker

Source: 5XpKRbh2k7.exe, JSONParser.cs	.Net Code: ParseValue
Source: 5XpKRbh2k7.exe, Program.cs	.Net Code: Main System.Reflection.Assembly.Load(byte[])
Source: 5XpKRbh2k7.exe, Program.cs	.Net Code: Main System.Reflection.Assembly.Load(byte[])

Binary contains a suspicious time stamp

Source: 5XpKRbh2k7.exe

Static PE information: 0x8B7D1A90 [Sun Feb 28 00:23:44 2044 UTC]

Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Memory allocated: 1EE03A20000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Memory allocated: 1EE1D5B0000 memory reserve \| memory write watch			Jump to behavior

Source: Amcache.hve.3.dr	Binary or memory string: VMware
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.3.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.3.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.3.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.3.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.3.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.3.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.3.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.3.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.3.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.3.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.3.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.3.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\5XpKRbh2k7.exe

Memory allocated: page read and write | page guard

Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\5XpKRbh2k7.exe

Queries volume information: C:\Users\user\Desktop\5XpKRbh2k7.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\5XpKRbh2k7.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.3.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: MsMpEng.exe

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_5XpKRbh2k7.exe_7c951b3511dd73c28dc917ef5d2d801ea4772771_6d508433_2edd89ab-d19c-4cd5-9845-e9eb5b195e2d\Report.wer	Unicode text, UTF-16, little-endian text, with CRLF line terminators	21B606C91473EE3DBAF54402A5B117C9	ECDD372AC03D5BDEC46855544D06EAFA7292262C	0AB908246ED182010343BE8EF51995DEAAB835154985614C18F4CD7F392BFD30
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2F60.tmp.dmp	Mini DuMP crash report, 16 streams, Tue Oct 29 05:43:09 2024, 0x1205a4 type	CA0E1F9AA889658772CA14EB243B2C8E	D5DD1E42BEC9AB525A58AB47D0439351CCED816C	E15C46E97996C019F476AF11BAB3ED8993B889680D44A11C7F747017B758E094
C:\ProgramData\Microsoft\Windows\WER\Temp\WER301C.tmp.WERInternalMetadata.xml	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators	D0196478AC23E5ACF54C9C7F34D1FB7E	57F065C0ED2A55D1985BB3EEEBE1FC8542F7BC46	10C186512F6858F790387EBF662CB7FA929030D2BFD61A6C8194B56CDF4795A5
C:\ProgramData\Microsoft\Windows\WER\Temp\WER304C.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	31A6A84A87E2C04FD0EBA41B90340583	F92C38F3AD945B42AB227FF0973BEE570C8C19D1	69DE1DCC8B607CF61E6BBE9EE95A87FF31E7F2B2F2809A860E3CA7CCCF003EEF
C:\Windows\appcompat\Programs\Amcache.hve	MS Windows registry file, NT/2000 or above	E78C727C383395A183B122E6D50A0F39	CC9756934D3312E9E28377171045AE1A8A4C3D1A	9E61A71ECC1BCED7B29C9723DD470504AE1C3D1FA97E3D6A920B04F22DEE776A

Source: 5XpKRbh2k7.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\b\w\d6337ac2abf63a4b\.repositories\DependencyInjection\src\Microsoft.Extensions.DependencyInjection.Abstractions\bin\Release\netstandard1.0\Microsoft.Extensions.DependencyInjection.Abstractions.pdb source: 5XpKRbh2k7.exe
Source:	Binary string: mscorlib.pdb source: WER2F60.tmp.dmp.3.dr
Source:	Binary string: D:\a\1\s\xpdBootstrapper\obj\Release\net472\xpdBootstrapper.pdb source: 5XpKRbh2k7.exe
Source:	Binary string: E:\A\_work\708\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Diagnostics.DiagnosticSource\net46\System.Diagnostics.DiagnosticSource.pdb source: 5XpKRbh2k7.exe
Source:	Binary string: D:\a\1\s\Microsoft.Applications.Events\obj\Server\netstandard1.3\Microsoft.Applications.Events.Server.pdbSHA256 source: 5XpKRbh2k7.exe
Source:	Binary string: mscorlib.ni.pdb source: WER2F60.tmp.dmp.3.dr
Source:	Binary string: D:\a\1\s\Microsoft.Applications.Events\obj\Server\netstandard1.3\Microsoft.Applications.Events.Server.pdb source: 5XpKRbh2k7.exe
Source:	Binary string: D:\a\1\s\OTelCS.Net461\Sources\OneCollector\obj\Release\Microsoft.Office.Telemetry.OneCollector.pdb source: 5XpKRbh2k7.exe
Source:	Binary string: D:\a\1\s\EventFlags.Net45\Sources\obj\Release\Microsoft.Office.Telemetry.EventFlags.pdb source: 5XpKRbh2k7.exe
Source:	Binary string: D:\a\1\s\EventFlags.Net45\Sources\obj\Release\Microsoft.Office.Telemetry.EventFlags.pdb\|A source: 5XpKRbh2k7.exe
Source:	Binary string: D:\a\1\s\OTelCS.Net461\Sources\TelemetryService\obj\Release\OTelCS.pdb source: 5XpKRbh2k7.exe
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER2F60.tmp.dmp.3.dr
Source:	Binary string: C:\b\w\d6337ac2abf63a4b\.repositories\Logging\src\Microsoft.Extensions.Logging.Abstractions\bin\Release\netstandard1.1\Microsoft.Extensions.Logging.Abstractions.pdb source: 5XpKRbh2k7.exe
Source:	Binary string: C:\b\w\d6337ac2abf63a4b\.repositories\Microsoft.Data.Sqlite\src\Microsoft.Data.Sqlite\bin\Release\netstandard1.3\Microsoft.Data.Sqlite.pdb source: 5XpKRbh2k7.exe
Source:	Binary string: C:\b\w\d6337ac2abf63a4b\.repositories\Logging\src\Microsoft.Extensions.Logging\bin\Release\netstandard1.1\Microsoft.Extensions.Logging.pdb source: 5XpKRbh2k7.exe

Networking

Yara detected Generic Downloader

Source: Yara match

File source: 5XpKRbh2k7.exe, type: SAMPLE

Source: 5XpKRbh2k7.exe	String found in binary or memory: http://corppki/aia/MSIT%20CA%20Z1(2).crt0E
Source: 5XpKRbh2k7.exe	String found in binary or memory: http://corppki/aia/msintcrca.crt0=
Source: 5XpKRbh2k7.exe	String found in binary or memory: http://corppki/crl/MSIT%20CA%20Z1(2).crl
Source: 5XpKRbh2k7.exe	String found in binary or memory: http://corppki/crl/msintcrca.crl
Source: 5XpKRbh2k7.exe	String found in binary or memory: http://sqlite.org/rescode.html
Source: Amcache.hve.3.dr	String found in binary or memory: http://upx.sf.net
Source: 5XpKRbh2k7.exe	String found in binary or memory: http://www.asp.net/
Source: 5XpKRbh2k7.exe	String found in binary or memory: https://pipe.int.trafficmanager.net/OneCollector/1.0/
Source: 5XpKRbh2k7.exe	String found in binary or memory: https://support.office.com/oReplacing

One or more processes crash

Source: C:\Users\user\Desktop\5XpKRbh2k7.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7096 -s 760

Sample file is different than original file name gathered from version info

Source: 5XpKRbh2k7.exe, 00000000.00000000.1682954949.000001EE03462000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Applications.Events.Server.dllj% vs 5XpKRbh2k7.exe
Source: 5XpKRbh2k7.exe, 00000000.00000000.1682954949.000001EE03462000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Data.Sqlite.dll> vs 5XpKRbh2k7.exe
Source: 5XpKRbh2k7.exe, 00000000.00000000.1682954949.000001EE03462000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Extensions.DependencyInjection.Abstractions.dllT vs 5XpKRbh2k7.exe
Source: 5XpKRbh2k7.exe, 00000000.00000000.1682954949.000001EE03462000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Extensions.Logging.dllT vs 5XpKRbh2k7.exe
Source: 5XpKRbh2k7.exe, 00000000.00000000.1682954949.000001EE03462000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Extensions.Logging.Abstractions.dllT vs 5XpKRbh2k7.exe
Source: 5XpKRbh2k7.exe, 00000000.00000000.1682954949.000001EE03462000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Office.Telemetry.EventFlags.dlll& vs 5XpKRbh2k7.exe
Source: 5XpKRbh2k7.exe, 00000000.00000000.1682954949.000001EE03462000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Office.Telemetry.OneCollector.dllB vs 5XpKRbh2k7.exe
Source: 5XpKRbh2k7.exe, 00000000.00000000.1682954949.000001EE03462000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameOTelCS.dll. vs 5XpKRbh2k7.exe
Source: 5XpKRbh2k7.exe, 00000000.00000000.1682954949.000001EE03462000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Diagnostics.DiagnosticSource.dllT vs 5XpKRbh2k7.exe
Source: 5XpKRbh2k7.exe, 00000000.00000000.1682954949.000001EE036E7000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamexpdBootstrapper.exeX vs 5XpKRbh2k7.exe
Source: 5XpKRbh2k7.exe	Binary or memory string: OriginalFilenameMicrosoft.Applications.Events.Server.dllj% vs 5XpKRbh2k7.exe
Source: 5XpKRbh2k7.exe	Binary or memory string: OriginalFilenameMicrosoft.Data.Sqlite.dll> vs 5XpKRbh2k7.exe
Source: 5XpKRbh2k7.exe	Binary or memory string: OriginalFilenameMicrosoft.Extensions.DependencyInjection.Abstractions.dllT vs 5XpKRbh2k7.exe
Source: 5XpKRbh2k7.exe	Binary or memory string: OriginalFilenameMicrosoft.Extensions.Logging.dllT vs 5XpKRbh2k7.exe
Source: 5XpKRbh2k7.exe	Binary or memory string: OriginalFilenameMicrosoft.Extensions.Logging.Abstractions.dllT vs 5XpKRbh2k7.exe
Source: 5XpKRbh2k7.exe	Binary or memory string: OriginalFilenameMicrosoft.Office.Telemetry.EventFlags.dlll& vs 5XpKRbh2k7.exe
Source: 5XpKRbh2k7.exe	Binary or memory string: OriginalFilenameMicrosoft.Office.Telemetry.OneCollector.dllB vs 5XpKRbh2k7.exe
Source: 5XpKRbh2k7.exe	Binary or memory string: OriginalFilenameOTelCS.dll. vs 5XpKRbh2k7.exe
Source: 5XpKRbh2k7.exe	Binary or memory string: OriginalFilenameSystem.Diagnostics.DiagnosticSource.dllT vs 5XpKRbh2k7.exe
Source: 5XpKRbh2k7.exe	Binary or memory string: OriginalFilenamexpdBootstrapper.exeX vs 5XpKRbh2k7.exe

Source: 5XpKRbh2k7.exe, IAppxBundleReader.cs	Suspicious method names: ..GetPayloadPackage
Source: 5XpKRbh2k7.exe, IAppxBundleReader.cs	Suspicious method names: ..GetPayloadPackages
Source: 5XpKRbh2k7.exe, IAppxPackageWriter.cs	Suspicious method names: ..AddPayloadFile
Source: 5XpKRbh2k7.exe, IAppxPackageReader.cs	Suspicious method names: ..GetPayloadFile
Source: 5XpKRbh2k7.exe, IAppxPackageReader.cs	Suspicious method names: ..GetPayloadFiles
Source: 5XpKRbh2k7.exe, Program.cs	Suspicious method names: .Program.GetPayload
Source: 5XpKRbh2k7.exe, Program.cs	Suspicious method names: .Program.InjectResources
Source: 5XpKRbh2k7.exe, Program.cs	Suspicious method names: .Program.PayloadFromPackage

Source: classification engine

Classification label: mal48.troj.evad.winEXE@2/5@0/0

Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7096

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\9c090737-4f8e-4ed4-81c7-d95a0bb408c4

Jump to behavior

Source: 5XpKRbh2k7.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 5XpKRbh2k7.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\5XpKRbh2k7.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 5XpKRbh2k7.exe	String found in binary or memory: --help
Source: 5XpKRbh2k7.exe	String found in binary or memory: --help
Source: 5XpKRbh2k7.exe	String found in binary or memory: !/silent /installQRunning WebView2 Evergreen bootstrapper.[WebView2 Evergreen bootstrapper has been run.aError running WebView2 Evergreen bootstrapper: '
Source: 5XpKRbh2k7.exe	String found in binary or memory: Try `= --help' for more information.
Source: 5XpKRbh2k7.exe	String found in binary or memory: Try `= --help' for more information.
Source: 5XpKRbh2k7.exe	String found in binary or memory: install/Installs a packaged app?Installs a packaged application!p:\|pkg:\|package:
Source: 5XpKRbh2k7.exe	String found in binary or memory: launch/Launches an application/pfn:\|packageFamilyName:kPackage family name of the application to be launchedeCommand line to pass into the launched applicationlistYLists all versions of the app on this device
Source: 5XpKRbh2k7.exe	String found in binary or memory: Input does not match expected format: [x-y]. Run xpdAgent.exe configure-buckets --help to see formatting instructions
Source: 5XpKRbh2k7.exe	String found in binary or memory: Input does not match expected format: [x-y]. Run xpdAgent.exe configure-buckets --help to see formatting instructions
Source: 5XpKRbh2k7.exe	String found in binary or memory: Unable to parse range. Run xpdAgent.exe configure-buckets --help to see formatting instructions
Source: 5XpKRbh2k7.exe	String found in binary or memory: Unable to parse range. Run xpdAgent.exe configure-buckets --help to see formatting instructions
Source: 5XpKRbh2k7.exe	String found in binary or memory: IChecking installation prerequisites.yAt least one installation prerequisite was not met, exiting.KCompleted installation prerequisites./Installation succeeded.EInstallation failed with exception
Source: 5XpKRbh2k7.exe	String found in binary or memory: qFailed to add persistent data fields to an unusable sink/AddPersistentDataFields!Dropping event: %SendTelemetryEvent9Event name was null or empty
Source: 5XpKRbh2k7.exe	String found in binary or memory: {"indirect":"false","quiet":"false","errorBaseUrl":"https://go.microsoft.com/fwlink/","errorParameters":"linkid=2238672","packageFamilyName":"Microsoft.OutlookForWindows_8wekyb3d8bbwe","applicationId":"Microsoft.OutlookforWindows","arm64":"https://res.cdn.office.net/nativehost/5mttl/installer/v2/1.2024.1018.100/Microsoft.OutlookForWindows_arm64.msix","x86":"https://res.cdn.office.net/nativehost/5mttl/installer/v2/1.2024.1018.100/Microsoft.OutlookForWindows_x86.msix","x64":"https://res.cdn.office.net/nativehost/5mttl/installer/v2/1.2024.1018.100/Microsoft.OutlookForWindows_x64.msix","CompanyName":"Microsoft Corporation","FileDescription":"Microsoft Outlook Installer","FileVersion":"1.2024.1018.100","LegalCopyright":"Copyright (C) Microsoft Corporation. All rights reserved.","ProductName":"Microsoft Outlook Installer","ProductVersion":"1.2024.1018.100","packageManifest":"C:\\a\\_work\\1\\b\\2\\_work\\1\\s\\build\\win-x64-release\\xpdPackLogs\\AppXManifest.xml","errorBackgroundColor":"#ffffff","errorTextColor":"#737474","enableStubMode":"true"}PA

Source: unknown	Process created: C:\Users\user\Desktop\5XpKRbh2k7.exe "C:\Users\user\Desktop\5XpKRbh2k7.exe"
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7096 -s 760

Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: C:\Users\user\Desktop\5XpKRbh2k7.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 5XpKRbh2k7.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 5XpKRbh2k7.exe

Static file information: File size 2725888 > 1048576

Source: 5XpKRbh2k7.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x1b9600

Source: 5XpKRbh2k7.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: 5XpKRbh2k7.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\b\w\d6337ac2abf63a4b\.repositories\DependencyInjection\src\Microsoft.Extensions.DependencyInjection.Abstractions\bin\Release\netstandard1.0\Microsoft.Extensions.DependencyInjection.Abstractions.pdb source: 5XpKRbh2k7.exe
Source:	Binary string: mscorlib.pdb source: WER2F60.tmp.dmp.3.dr
Source:	Binary string: D:\a\1\s\xpdBootstrapper\obj\Release\net472\xpdBootstrapper.pdb source: 5XpKRbh2k7.exe
Source:	Binary string: E:\A\_work\708\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Diagnostics.DiagnosticSource\net46\System.Diagnostics.DiagnosticSource.pdb source: 5XpKRbh2k7.exe
Source:	Binary string: D:\a\1\s\Microsoft.Applications.Events\obj\Server\netstandard1.3\Microsoft.Applications.Events.Server.pdbSHA256 source: 5XpKRbh2k7.exe
Source:	Binary string: mscorlib.ni.pdb source: WER2F60.tmp.dmp.3.dr
Source:	Binary string: D:\a\1\s\Microsoft.Applications.Events\obj\Server\netstandard1.3\Microsoft.Applications.Events.Server.pdb source: 5XpKRbh2k7.exe
Source:	Binary string: D:\a\1\s\OTelCS.Net461\Sources\OneCollector\obj\Release\Microsoft.Office.Telemetry.OneCollector.pdb source: 5XpKRbh2k7.exe
Source:	Binary string: D:\a\1\s\EventFlags.Net45\Sources\obj\Release\Microsoft.Office.Telemetry.EventFlags.pdb source: 5XpKRbh2k7.exe
Source:	Binary string: D:\a\1\s\EventFlags.Net45\Sources\obj\Release\Microsoft.Office.Telemetry.EventFlags.pdb\|A source: 5XpKRbh2k7.exe
Source:	Binary string: D:\a\1\s\OTelCS.Net461\Sources\TelemetryService\obj\Release\OTelCS.pdb source: 5XpKRbh2k7.exe
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER2F60.tmp.dmp.3.dr
Source:	Binary string: C:\b\w\d6337ac2abf63a4b\.repositories\Logging\src\Microsoft.Extensions.Logging.Abstractions\bin\Release\netstandard1.1\Microsoft.Extensions.Logging.Abstractions.pdb source: 5XpKRbh2k7.exe
Source:	Binary string: C:\b\w\d6337ac2abf63a4b\.repositories\Microsoft.Data.Sqlite\src\Microsoft.Data.Sqlite\bin\Release\netstandard1.3\Microsoft.Data.Sqlite.pdb source: 5XpKRbh2k7.exe
Source:	Binary string: C:\b\w\d6337ac2abf63a4b\.repositories\Logging\src\Microsoft.Extensions.Logging\bin\Release\netstandard1.1\Microsoft.Extensions.Logging.pdb source: 5XpKRbh2k7.exe

Data Obfuscation

.NET source code contains potential unpacker

Source: 5XpKRbh2k7.exe, JSONParser.cs	.Net Code: ParseValue
Source: 5XpKRbh2k7.exe, Program.cs	.Net Code: Main System.Reflection.Assembly.Load(byte[])
Source: 5XpKRbh2k7.exe, Program.cs	.Net Code: Main System.Reflection.Assembly.Load(byte[])

Binary contains a suspicious time stamp

Source: 5XpKRbh2k7.exe

Static PE information: 0x8B7D1A90 [Sun Feb 28 00:23:44 2044 UTC]

Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Memory allocated: 1EE03A20000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Memory allocated: 1EE1D5B0000 memory reserve \| memory write watch			Jump to behavior

Source: Amcache.hve.3.dr	Binary or memory string: VMware
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.3.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.3.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.3.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.3.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.3.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.3.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.3.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.3.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.3.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.3.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.3.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.3.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\5XpKRbh2k7.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\5XpKRbh2k7.exe

Memory allocated: page read and write | page guard

Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\5XpKRbh2k7.exe

Queries volume information: C:\Users\user\Desktop\5XpKRbh2k7.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\5XpKRbh2k7.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.3.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: MsMpEng.exe

ID:	1544261
Product:	CloudBasic
Start time:	06:42:16
Start date:	29.10.2024
Sample:	5XpKRbh2k7
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	0b9820ecc88383016b7ff530a6777294
SHA1:	44c13dfa53d66e6c13b3eb06323d900cebfe7e6e
SHA256:	d89bfa433590d35313bc40cfdd257acc84331d1f95cda24a47c22c23af78c724
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Windows Analysis Report
5XpKRbh2k7.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Screenshots

Behavior Graph

Network Map

Windows Analysis Report 5XpKRbh2k7.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Screenshots

Behavior Graph

Network Map

Windows Analysis Report
5XpKRbh2k7.exe