Edit tour

Windows Analysis Report
Bill_Of _Lading.exe

Overview

General Information

Sample name:	Bill_Of _Lading.exe
Analysis ID:	1544347
MD5:	31b5ced94cfe86f5b51c0c1c3650a6a3
SHA1:	eaf8c4cc98fa278b8f1398410017d9d46232d475
SHA256:	d2529b27449d53c7b0006f144c0d702db17001e014fb9145e7c7b7349db0a277
Tags:	AgentTeslaexeuser-threatcat_ch
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected UAC Bypass using CMSTP

.NET source code references suspicious native API functions

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Contains functionality to log keystrokes (.Net Source)

Disables UAC (registry)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file does not import any functions

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Outbound SMTP Connections

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Bill_Of _Lading.exe (PID: 7400 cmdline: "C:\Users\user\Desktop\Bill_Of _Lading.exe" MD5: 31B5CED94CFE86F5B51C0C1C3650A6A3)

conhost.exe (PID: 7408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7552 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Bill_Of _Lading.exe" -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

CasPol.exe (PID: 7612 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe" MD5: 914F728C04D3EDDD5FBA59420E74E56B)

CasPol.exe (PID: 7620 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe" MD5: 914F728C04D3EDDD5FBA59420E74E56B)

WerFault.exe (PID: 7716 cmdline: C:\Windows\system32\WerFault.exe -u -p 7400 -s 1048 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "25", "Host": "mail.iaa-airferight.com", "Username": "web@iaa-airferight.com", "Password": "webmaster"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.2945675273.00000000032FC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1777119131.000001922DE20000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000004.00000002.2945675273.00000000032D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2945675273.00000000032D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.2944572875.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2944572875.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1777775843.000001923DAF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1777775843.000001923DAF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Bill_Of _Lading.exe PID: 7400	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Bill_Of _Lading.exe PID: 7400	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Bill_Of _Lading.exe PID: 7400	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Bill_Of _Lading.exe PID: 7400	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: CasPol.exe PID: 7612	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: CasPol.exe PID: 7612	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.CasPol.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.CasPol.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.CasPol.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33561:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3367d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33759:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3387f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Bill_Of _Lading.exe.1923db2c4c0.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Bill_Of _Lading.exe.1923db2c4c0.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Bill_Of _Lading.exe.1923db2c4c0.5.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31761:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3187d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31959:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a7f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Bill_Of _Lading.exe.1923db66f08.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Bill_Of _Lading.exe.1923db66f08.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Bill_Of _Lading.exe.1923db66f08.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31761:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3187d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31959:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a7f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Bill_Of _Lading.exe.1923db66f08.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Bill_Of _Lading.exe.1923db66f08.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Bill_Of _Lading.exe.1923db66f08.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33561:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3367d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33759:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3387f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Bill_Of _Lading.exe.1923db2c4c0.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Bill_Of _Lading.exe.1923db2c4c0.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Bill_Of _Lading.exe.1923db2c4c0.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6df37:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33561:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6dfa9:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6e033:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3367d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e0c5:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e12f:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33759:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e1a1:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e237:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3387f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e2c7:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Bill_Of _Lading.exe" -Force, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Bill_Of _Lading.exe" -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Bill_Of _Lading.exe", ParentImage: C:\Users\user\Desktop\Bill_Of _Lading.exe, ParentProcessId: 7400, ParentProcessName: Bill_Of _Lading.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Bill_Of _Lading.exe" -Force, ProcessId: 7552, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 46.175.148.58, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe, Initiated: true, ProcessId: 7612, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49738

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Bill_Of _Lading.exe" -Force, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Bill_Of _Lading.exe" -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Bill_Of _Lading.exe", ParentImage: C:\Users\user\Desktop\Bill_Of _Lading.exe, ParentProcessId: 7400, ParentProcessName: Bill_Of _Lading.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Bill_Of _Lading.exe" -Force, ProcessId: 7552, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.Bill_Of _Lading.exe.1923db2c4c0.5.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "25", "Host": "mail.iaa-airferight.com", "Username": "web@iaa-airferight.com", "Password": "webmaster"}

Multi AV Scanner detection for submitted file

Source: Bill_Of _Lading.exe

ReversingLabs: Detection: 71%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Bill_Of _Lading.exe

Joe Sandbox ML: detected

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 00000000.00000002.1777119131.000001922DE20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Bill_Of _Lading.exe PID: 7400, type: MEMORYSTR

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49736 version: TLS 1.2

Source: Bill_Of _Lading.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Management.pdbP0# source: WER5691.tmp.dmp.7.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER5691.tmp.dmp.7.dr
Source:	Binary string: System.ni.pdbRSDS source: WER5691.tmp.dmp.7.dr
Source:	Binary string: System.Windows.Forms.pdbP source: WER5691.tmp.dmp.7.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WER5691.tmp.dmp.7.dr
Source:	Binary string: System.Drawing.ni.pdb source: WER5691.tmp.dmp.7.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER5691.tmp.dmp.7.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER5691.tmp.dmp.7.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WER5691.tmp.dmp.7.dr
Source:	Binary string: System.pdb source: WER5691.tmp.dmp.7.dr
Source:	Binary string: System.Core.ni.pdb source: WER5691.tmp.dmp.7.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER5691.tmp.dmp.7.dr
Source:	Binary string: System.Windows.Forms.pdb source: WER5691.tmp.dmp.7.dr
Source:	Binary string: mscorlib.pdb source: WER5691.tmp.dmp.7.dr
Source:	Binary string: System.Drawing.pdbq1 source: WER5691.tmp.dmp.7.dr
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WER5691.tmp.dmp.7.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WER5691.tmp.dmp.7.dr
Source:	Binary string: System.Management.pdb source: WER5691.tmp.dmp.7.dr
Source:	Binary string: System.Drawing.pdb source: WER5691.tmp.dmp.7.dr
Source:	Binary string: mscorlib.ni.pdb source: WER5691.tmp.dmp.7.dr
Source:	Binary string: System.Management.ni.pdb source: WER5691.tmp.dmp.7.dr
Source:	Binary string: System.Core.pdb source: WER5691.tmp.dmp.7.dr
Source:	Binary string: System.ni.pdb source: WER5691.tmp.dmp.7.dr
Source:	Binary string: System.pdb8 source: WER5691.tmp.dmp.7.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER5691.tmp.dmp.7.dr

Source: Joe Sandbox View	IP Address: 46.175.148.58 46.175.148.58
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

ASN Name: ASLAGIDKOM-NETUA ASLAGIDKOM-NETUA

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.4:49738 -> 46.175.148.58:25

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: mail.iaa-airferight.com

Source: CasPol.exe, 00000004.00000002.2945675273.00000000032FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.iaa-airferight.com
Source: CasPol.exe, 00000004.00000002.2945675273.0000000003281000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.7.dr	String found in binary or memory: http://upx.sf.net
Source: Bill_Of _Lading.exe, 00000000.00000002.1777775843.000001923DAF1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000004.00000002.2944572875.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: Bill_Of _Lading.exe, 00000000.00000002.1777775843.000001923DAF1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000004.00000002.2945675273.0000000003281000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000004.00000002.2944572875.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: CasPol.exe, 00000004.00000002.2945675273.0000000003281000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: CasPol.exe, 00000004.00000002.2945675273.0000000003281000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49736 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.Bill_Of _Lading.exe.1923db2c4c0.5.raw.unpack, abAX9N.cs	.Net Code: OPnJT
Source: 0.2.Bill_Of _Lading.exe.1923db66f08.4.raw.unpack, abAX9N.cs	.Net Code: OPnJT

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Bill_Of _Lading.exe.1923db2c4c0.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Bill_Of _Lading.exe.1923db66f08.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Bill_Of _Lading.exe.1923db66f08.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Bill_Of _Lading.exe.1923db2c4c0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Bill_Of _Lading.exe

Source: C:\Users\user\Desktop\Bill_Of _Lading.exe

Code function: 0_2_00007FFD9B98757B NtUnmapViewOfSection,

0_2_00007FFD9B98757B

Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Code function: 0_2_00007FFD9B98AB17	0_2_00007FFD9B98AB17
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Code function: 0_2_00007FFD9B993AB1	0_2_00007FFD9B993AB1
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Code function: 0_2_00007FFD9B98AEF1	0_2_00007FFD9B98AEF1
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Code function: 0_2_00007FFD9B98DE89	0_2_00007FFD9B98DE89
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Code function: 0_2_00007FFD9B983508	0_2_00007FFD9B983508
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Code function: 0_2_00007FFD9B988550	0_2_00007FFD9B988550
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Code function: 0_2_00007FFD9B983520	0_2_00007FFD9B983520
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Code function: 0_2_00007FFD9B993B08	0_2_00007FFD9B993B08
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Code function: 0_2_00007FFD9B993B57	0_2_00007FFD9B993B57
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Code function: 0_2_00007FFD9B983495	0_2_00007FFD9B983495
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Code function: 0_2_00007FFD9BA50002	0_2_00007FFD9BA50002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_02DBA198	4_2_02DBA198
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_02DBE6AF	4_2_02DBE6AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_02DB4A98	4_2_02DB4A98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_02DBA960	4_2_02DBA960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_02DB3E80	4_2_02DB3E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_02DB41C8	4_2_02DB41C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_06A1A25C	4_2_06A1A25C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_06A1BAD2	4_2_06A1BAD2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_06A1BAD8	4_2_06A1BAD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_06A25588	4_2_06A25588
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_06A265E0	4_2_06A265E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_06A2B20F	4_2_06A2B20F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_06A22358	4_2_06A22358
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_06A27D68	4_2_06A27D68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_06A27688	4_2_06A27688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_06A2E388	4_2_06A2E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_06A20040	4_2_06A20040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_06A20007	4_2_06A20007

Source: C:\Users\user\Desktop\Bill_Of _Lading.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7400 -s 1048

Source: Bill_Of _Lading.exe

Static PE information: No import functions for PE file found

Source: Bill_Of _Lading.exe, 00000000.00000002.1777775843.000001923DAF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamec5ea4fda-43b2-4fc0-8a8b-07958574f042.exe4 vs Bill_Of _Lading.exe
Source: Bill_Of _Lading.exe, 00000000.00000002.1777775843.000001923DAF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameEqaxaye@ vs Bill_Of _Lading.exe
Source: Bill_Of _Lading.exe, 00000000.00000002.1777775843.000001923DDEE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameEqaxaye@ vs Bill_Of _Lading.exe
Source: Bill_Of _Lading.exe, 00000000.00000000.1682434970.000001922BDB6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameNewStb.exe4 vs Bill_Of _Lading.exe
Source: Bill_Of _Lading.exe	Binary or memory string: OriginalFilenameNewStb.exe4 vs Bill_Of _Lading.exe

Source: 4.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Bill_Of _Lading.exe.1923db2c4c0.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Bill_Of _Lading.exe.1923db66f08.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Bill_Of _Lading.exe.1923db66f08.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Bill_Of _Lading.exe.1923db2c4c0.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: 0.2.Bill_Of _Lading.exe.1923db2c4c0.5.raw.unpack, RsYAkkzVoy.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Bill_Of _Lading.exe.1923db2c4c0.5.raw.unpack, Kqqzixk.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Bill_Of _Lading.exe.1923db2c4c0.5.raw.unpack, xROdzGigX.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Bill_Of _Lading.exe.1923db2c4c0.5.raw.unpack, ywes.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Bill_Of _Lading.exe.1923db2c4c0.5.raw.unpack, iPVW0zV.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.Bill_Of _Lading.exe.1923db2c4c0.5.raw.unpack, 1Pi9sgbHwoV.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Bill_Of _Lading.exe.1923db2c4c0.5.raw.unpack, YUgDfWK2g4.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Bill_Of _Lading.exe.1923db2c4c0.5.raw.unpack, YUgDfWK2g4.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.Bill_Of _Lading.exe.1923db2c4c0.5.raw.unpack, MarWtcu.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Bill_Of _Lading.exe.1923db2c4c0.5.raw.unpack, MarWtcu.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Bill_Of _Lading.exe.1923db2c4c0.5.raw.unpack, MarWtcu.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Bill_Of _Lading.exe.1923db2c4c0.5.raw.unpack, MarWtcu.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@10/10@2/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7560:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7400
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7408:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1w10vwtz.wqg.ps1

Jump to behavior

Source: Bill_Of _Lading.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Bill_Of _Lading.exe

Static file information: TRID: Win64 Executable Console Net Framework (206006/5) 48.58%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Bill_Of _Lading.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Bill_Of _Lading.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Bill_Of _Lading.exe

ReversingLabs: Detection: 71%

Source: C:\Users\user\Desktop\Bill_Of _Lading.exe

File read: C:\Users\user\Desktop\Bill_Of _Lading.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Bill_Of _Lading.exe "C:\Users\user\Desktop\Bill_Of _Lading.exe"
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Bill_Of _Lading.exe" -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7400 -s 1048
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Bill_Of _Lading.exe" -Force	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\Bill_Of _Lading.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Bill_Of _Lading.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: Bill_Of _Lading.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Bill_Of _Lading.exe

Static file information: File size 1433631 > 1048576

Source: Bill_Of _Lading.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Management.pdbP0# source: WER5691.tmp.dmp.7.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER5691.tmp.dmp.7.dr
Source:	Binary string: System.ni.pdbRSDS source: WER5691.tmp.dmp.7.dr
Source:	Binary string: System.Windows.Forms.pdbP source: WER5691.tmp.dmp.7.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WER5691.tmp.dmp.7.dr
Source:	Binary string: System.Drawing.ni.pdb source: WER5691.tmp.dmp.7.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER5691.tmp.dmp.7.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER5691.tmp.dmp.7.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WER5691.tmp.dmp.7.dr
Source:	Binary string: System.pdb source: WER5691.tmp.dmp.7.dr
Source:	Binary string: System.Core.ni.pdb source: WER5691.tmp.dmp.7.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER5691.tmp.dmp.7.dr
Source:	Binary string: System.Windows.Forms.pdb source: WER5691.tmp.dmp.7.dr
Source:	Binary string: mscorlib.pdb source: WER5691.tmp.dmp.7.dr
Source:	Binary string: System.Drawing.pdbq1 source: WER5691.tmp.dmp.7.dr
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WER5691.tmp.dmp.7.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WER5691.tmp.dmp.7.dr
Source:	Binary string: System.Management.pdb source: WER5691.tmp.dmp.7.dr
Source:	Binary string: System.Drawing.pdb source: WER5691.tmp.dmp.7.dr
Source:	Binary string: mscorlib.ni.pdb source: WER5691.tmp.dmp.7.dr
Source:	Binary string: System.Management.ni.pdb source: WER5691.tmp.dmp.7.dr
Source:	Binary string: System.Core.pdb source: WER5691.tmp.dmp.7.dr
Source:	Binary string: System.ni.pdb source: WER5691.tmp.dmp.7.dr
Source:	Binary string: System.pdb8 source: WER5691.tmp.dmp.7.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER5691.tmp.dmp.7.dr

Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Code function: 0_2_00007FFD9B988167 push ebx; ret	0_2_00007FFD9B98816A
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Code function: 0_2_00007FFD9B9800BD pushad ; iretd	0_2_00007FFD9B9800C1
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Code function: 0_2_00007FFD9B9878CB push ebx; retf	0_2_00007FFD9B98796A
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Code function: 0_2_00007FFD9B987841 push ebx; retf	0_2_00007FFD9B98796A
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Code function: 0_2_00007FFD9B986830 pushad ; iretd	0_2_00007FFD9B9868C9
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Code function: 0_2_00007FFD9BA50002 push esp; retf 4810h	0_2_00007FFD9BA50312
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_02DBAA8D push edi; ret	4_2_02DBAA91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_02DBABA7 push esi; ret	4_2_02DBABB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_02DBAC92 push ebp; ret	4_2_02DBAC96
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_02DBADDB push esp; ret	4_2_02DBADDD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_06A13A40 push FC06B0DAh; retf	4_2_06A13A4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_06A2FFBF push es; ret	4_2_06A2FFC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 4_2_06A2EAE8 push cs; retn 5505h	4_2_06A2EAF6

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: Bill_Of _Lading.exe PID: 7400, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Bill_Of _Lading.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\cimv2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Bill_Of _Lading.exe, 00000000.00000002.1777119131.000001922DE20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: Bill_Of _Lading.exe, 00000000.00000002.1777119131.000001922DE20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: Bill_Of _Lading.exe, 00000000.00000002.1777119131.000001922DB01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLLP
Source: Bill_Of _Lading.exe, 00000000.00000002.1777119131.000001922DB01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAMEP

Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Memory allocated: 1922C010000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Memory allocated: 19245AE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 2DB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 3280000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 5280000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 name: Identifier	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	File opened / queried: C:\WINDOWS\system32\drivers\vmmouse.sys	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\disk\Enum name: 0	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	File opened / queried: C:\WINDOWS\system32\drivers\vmhgfs.sys	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	File opened / queried: C:\WINDOWS\system32\drivers\VBoxMouse.sys	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7059	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2632	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Window / User API: threadDelayed 2555	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Window / User API: threadDelayed 7285	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7836	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -27670116110564310s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7872	Thread sleep count: 2555 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7872	Thread sleep count: 7285 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -99765s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -99651s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -99545s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -99437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -99328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -99207s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -99079s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -98953s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -98844s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -98734s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -98625s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -98516s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -98391s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -98266s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -98023s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -97906s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -97778s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -97609s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -97453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -97344s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -97219s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -97109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -97000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -96890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -96781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -96672s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -96562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -96453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -96344s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -96234s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -96125s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -96016s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -95891s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -95766s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -95656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -95547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -95437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -95328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -95219s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -95109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -95000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -94891s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -94766s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -94641s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -94531s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -94422s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -94312s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -94203s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -94094s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -93984s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7868	Thread sleep time: -93875s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 99651	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 99545	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 99437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 99328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 99207	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 99079	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 98953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 98844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 98734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 98625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 98516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 98391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 98266	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 98023	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 97906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 97778	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 97609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 97453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 97344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 97219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 97109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 97000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 96890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 96781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 96672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 96562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 96453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 96344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 96234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 96125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 96016	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 95891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 95766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 95656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 95547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 95437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 95328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 95219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 95109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 95000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 94891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 94766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 94641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 94531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 94422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 94312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 94203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 94094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 93984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 93875	Jump to behavior

Source: Amcache.hve.7.dr	Binary or memory string: VMware
Source: Bill_Of _Lading.exe, 00000000.00000002.1777119131.000001922DB01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: QEMUP
Source: Bill_Of _Lading.exe, 00000000.00000002.1777119131.000001922DB01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: "SOFTWARE\VMware, Inc.\VMware ToolsP
Source: Bill_Of _Lading.exe, 00000000.00000002.1777119131.000001922DE20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Amcache.hve.7.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Bill_Of _Lading.exe, 00000000.00000002.1777119131.000001922DB01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: Bill_Of _Lading.exe, 00000000.00000002.1777119131.000001922DE20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: Amcache.hve.7.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.7.dr	Binary or memory string: vmci.sys
Source: Bill_Of _Lading.exe, 00000000.00000002.1777119131.000001922DE20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: Bill_Of _Lading.exe, 00000000.00000002.1777119131.000001922DE20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: Bill_Of _Lading.exe, 00000000.00000002.1777119131.000001922DE20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1
Source: Bill_Of _Lading.exe, 00000000.00000002.1777119131.000001922DB01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: &C:\WINDOWS\system32\drivers\vmhgfs.sysP
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.7.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.7.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.7.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Bill_Of _Lading.exe, 00000000.00000002.1777119131.000001922DE20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: Bill_Of _Lading.exe, 00000000.00000002.1777119131.000001922DE20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: Amcache.hve.7.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.7.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Bill_Of _Lading.exe, 00000000.00000002.1777119131.000001922DB01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWAREP
Source: Amcache.hve.7.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Bill_Of _Lading.exe, 00000000.00000002.1777119131.000001922DB01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmwareP
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.7.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1hbin@
Source: Bill_Of _Lading.exe, 00000000.00000002.1777119131.000001922DB01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: )C:\WINDOWS\system32\drivers\VBoxMouse.sysP
Source: Amcache.hve.7.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.7.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Bill_Of _Lading.exe, 00000000.00000002.1782046721.0000019246390000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Bill_Of _Lading.exe, 00000000.00000002.1777119131.000001922DB01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: %C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\P
Source: Bill_Of _Lading.exe, 00000000.00000002.1777119131.000001922DE20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: Bill_Of _Lading.exe, 00000000.00000002.1777119131.000001922DE20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: Amcache.hve.7.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Bill_Of _Lading.exe, 00000000.00000002.1777119131.000001922DB01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA IIP
Source: Bill_Of _Lading.exe, 00000000.00000002.1777119131.000001922DB01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'C:\WINDOWS\system32\drivers\vmmouse.sysP
Source: Amcache.hve.7.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.7.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Bill_Of _Lading.exe, 00000000.00000002.1777119131.000001922DE20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Amcache.hve.7.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Bill_Of _Lading.exe, 00000000.00000002.1777119131.000001922DB01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: "SOFTWARE\VMware, Inc.\VMware Tools
Source: CasPol.exe, 00000004.00000002.2949458385.00000000062F6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll\|\|

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\Bill_Of _Lading.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: Bill_Of _Lading.exe, .cs	Reference to suspicious API methods: GetProcAddress(, )
Source: Bill_Of _Lading.exe, .cs	Reference to suspicious API methods: LoadLibrary("kernel32.dll")
Source: Bill_Of _Lading.exe, .cs	Reference to suspicious API methods: GetProcAddress(, "VirtualProtect")
Source: 0.2.Bill_Of _Lading.exe.1923db2c4c0.5.raw.unpack, DWQSVyCYV.cs	Reference to suspicious API methods: uJn9vmw.OpenProcess(_9bBuo4xIRNG.DuplicateHandle, bInheritHandle: true, (uint)lKyMoD2.ProcessID)

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Bill_Of _Lading.exe" -Force
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Bill_Of _Lading.exe" -Force			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Bill_Of _Lading.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 43C000	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 43E000	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: F86008	Jump to behavior

Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Bill_Of _Lading.exe" -Force	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Bill_Of _Lading.exe	Queries volume information: C:\Users\user\Desktop\Bill_Of _Lading.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Bill_Of _Lading.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disables UAC (registry)

Source: C:\Users\user\Desktop\Bill_Of _Lading.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUA

Jump to behavior

Source: Amcache.hve.7.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 4.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Bill_Of _Lading.exe.1923db2c4c0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Bill_Of _Lading.exe.1923db66f08.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Bill_Of _Lading.exe.1923db66f08.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Bill_Of _Lading.exe.1923db2c4c0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2945675273.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2945675273.00000000032D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2944572875.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1777775843.000001923DAF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Bill_Of _Lading.exe PID: 7400, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 7612, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 4.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Bill_Of _Lading.exe.1923db2c4c0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Bill_Of _Lading.exe.1923db66f08.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Bill_Of _Lading.exe.1923db66f08.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Bill_Of _Lading.exe.1923db2c4c0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2945675273.00000000032D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2944572875.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1777775843.000001923DAF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Bill_Of _Lading.exe PID: 7400, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 7612, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 4.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Bill_Of _Lading.exe.1923db2c4c0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Bill_Of _Lading.exe.1923db66f08.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Bill_Of _Lading.exe.1923db66f08.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Bill_Of _Lading.exe.1923db2c4c0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2945675273.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2945675273.00000000032D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2944572875.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1777775843.000001923DAF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Bill_Of _Lading.exe PID: 7400, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 7612, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	21 Disable or Modify Tools	2 OS Credential Dumping	341 Security Software Discovery	Remote Services	1 Email Collection	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	261 Virtualization/Sandbox Evasion	1 Input Capture	1 Process Discovery	Remote Desktop Protocol	1 Input Capture	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	211 Process Injection	1 Credentials in Registry	261 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	11 Archive Collected Data	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	2 Data from Local System	23 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	24 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Bill_Of _Lading.exe	71%	ReversingLabs	Win64.Spyware.Negasteal
Bill_Of _Lading.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://api.ipify.org/	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
https://api.ipify.org/t	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.iaa-airferight.com	46.175.148.58	true	true		unknown
api.ipify.org	172.67.74.152	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org	Bill_Of _Lading.exe, 00000000.00000002.1777775843.000001923DAF1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000004.00000002.2945675273.0000000003281000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000004.00000002.2944572875.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://upx.sf.net	Amcache.hve.7.dr	false	URL Reputation: safe	unknown
https://account.dyn.com/	Bill_Of _Lading.exe, 00000000.00000002.1777775843.000001923DAF1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000004.00000002.2944572875.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org/t	CasPol.exe, 00000004.00000002.2945675273.0000000003281000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	CasPol.exe, 00000004.00000002.2945675273.0000000003281000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mail.iaa-airferight.com	CasPol.exe, 00000004.00000002.2945675273.00000000032FC000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
46.175.148.58	mail.iaa-airferight.com	Ukraine		56394	ASLAGIDKOM-NETUA	true
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544347
Start date and time:	2024-10-29 10:06:45 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Bill_Of _Lading.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@10/10@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 88% Number of executed functions: 79 Number of non-executed functions: 6
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.42.65.92, 52.182.143.212
Excluded domains from analysis (whitelisted): onedsblobprdeus17.eastus.cloudapp.azure.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: Bill_Of _Lading.exe

Simulations

Behavior and APIs

Time	Type	Description
05:07:42	API Interceptor	19x Sleep call for process: powershell.exe modified
05:07:44	API Interceptor	183x Sleep call for process: CasPol.exe modified
05:07:45	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
46.175.148.58	techno POORD035338.exe	Get hash	malicious	AgentTesla	Browse
	New Cmr JV2410180005.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse
	PO F1298-24 Fabric Order.exe	Get hash	malicious	AgentTesla	Browse
	PO F1298-24 Fabric Order.zip	Get hash	malicious	AgentTesla	Browse
	PO 316347 24MIA00660067.exe	Get hash	malicious	AgentTesla	Browse
	Purchase Order For Linear Actuator.exe	Get hash	malicious	AgentTesla	Browse
	PO FOR CONNECTOR WITH TERMINAL.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse
	New PO-Auras Demand.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.BackDoor.AgentTeslaNET.37.28277.26776.exe	Get hash	malicious	AgentTesla	Browse
	New Purchase Order 568330.exe	Get hash	malicious	AgentTesla	Browse
172.67.74.152	67065b4c84713_Javiles.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	4F08j2Rmd9.bin	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	y8tCHz7CwC.bin	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	api.ipify.org/
	2zYP8qOYmJ.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.iaa-airferight.com	techno POORD035338.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	New Cmr JV2410180005.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	46.175.148.58
	PO F1298-24 Fabric Order.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	PO F1298-24 Fabric Order.zip	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	PO 316347 24MIA00660067.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Purchase Order For Linear Actuator.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	PO FOR CONNECTOR WITH TERMINAL.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	46.175.148.58
	New PO-Auras Demand.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	SecuriteInfo.com.BackDoor.AgentTeslaNET.37.28277.26776.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	New Purchase Order 568330.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
api.ipify.org	Shipping documents 00029399400059.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	z20SWIFT_MT103_Payment_552016_pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	Remittance Receipt.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	SecuriteInfo.com.Win64.Malware-gen.4046.15809.exe	Get hash	malicious	EICAR	Browse	104.26.13.205
	SecuriteInfo.com.Win64.Malware-gen.4046.15809.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	SUNNY HONG VSL PARTICULARS.xlsx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	SecuriteInfo.com.Trojan.Inject5.10837.16335.2292.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Rampage.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASLAGIDKOM-NETUA	techno POORD035338.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	New Cmr JV2410180005.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	46.175.148.58
	PO F1298-24 Fabric Order.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	PO F1298-24 Fabric Order.zip	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	PO 316347 24MIA00660067.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Purchase Order For Linear Actuator.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	PO FOR CONNECTOR WITH TERMINAL.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	46.175.148.58
	New PO-Auras Demand.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	SecuriteInfo.com.BackDoor.AgentTeslaNET.37.28277.26776.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	New Purchase Order 568330.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
CLOUDFLARENETUS	Proforma-Invoice#018879TT0100..doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	swift-copy31072024PDF.html	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	ST007 SWIFT CONFIRMATION.xls	Get hash	malicious	Unknown	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	ST007 SWIFT CONFIRMATION.xls	Get hash	malicious	Unknown	Browse	188.114.96.3
	Transferencia.doc	Get hash	malicious	Quasar	Browse	188.114.96.3
	https://clairecarpenter.com/wp-includes/css/pbcmc.php?7112797967704b536932307466507a4373757943784b5463314a54533470796b784f7a456e567130725553383750315338317430677031416341#Email#	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://inspireelectricale.za.com/u78dq	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://banginggamestore.xyz/?encoded_value=223GDT1&sub1=239ba09cf2754b24813bab1ed4e19d57&sub2=&sub3=&sub4=&sub5=21539&source_id=20131&ip=94.107.182.21&domain=www.followthislinknow.com	Get hash	malicious	Unknown	Browse	172.67.179.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	IGNM2810202400017701_270620240801_546001.vbs	Get hash	malicious	GuLoader	Browse	172.67.74.152
	https://clairecarpenter.com/wp-includes/css/pbcmc.php?7112797967704b536932307466507a4373757943784b5463314a54533470796b784f7a456e567130725553383750315338317430677031416341#Email#	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.67.74.152
	https://filerit.com/pi-240924.ps1	Get hash	malicious	Unknown	Browse	172.67.74.152
	JVLkkfzSKW.exe	Get hash	malicious	Stealc, Vidar	Browse	172.67.74.152
	Shipping documents 00029399400059.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Quasar, Stealc	Browse	172.67.74.152
	z20SWIFT_MT103_Payment_552016_pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	https://mail.kb4.io/XT0VNMzRJS3djRnBKZnFha1JaVThBUHFHRmpuS2FmSUY4aUszUlY3Sm0rWmpyUWR3ekQzL2xjN0xhVVJlTzhvZzgyMGtTUkxmSWtGdWlUY2I0NStmRWlLS2xHcGZsNTZUN3VyanNiKzVaNjhaeTRSTXFXVGdwc0J4amUxRFFPMU5DTTd5ejl5aXZxUlBwL1NDaDBRSk9DWVJkc09KRUZodTl0SFh5bFVVWEdYZTMzcm5ZTCtCSGpmZWRIMEprQjhiZExvOE9wSGkwUS9KTjQwSVdjQT0tLVBNYWNLTzcyT0xCdDkzb3ItLURlVmNvdGI3d3BGenM5UWJzc1EreXc9PQ==?cid=2260646675	Get hash	malicious	Unknown	Browse	172.67.74.152
	setup.exe	Get hash	malicious	Unknown	Browse	172.67.74.152

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Bill_Of _Lading._d5a6bc31333ed2731238387cca9c2baed124745_111ed6a7_b97e09e4-30ca-4144-a8f1-17b94789fc12\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2279597446700177
Encrypted:	false
SSDEEP:	192:kq4S1P6Bz50UnUFaWBHhQ83mudzuiF6Z24lO833:r4SgBOUnUFamHhYqzuiF6Y4lO833
MD5:	6ABEDAFE7C2A130D74E2CA8248E247E8
SHA1:	5D30A4CEFFD323B00C8BEEA5FD53B4F1072AF943
SHA-256:	09A7D44124F52C523F40E3177311CF2A612B2CECB212BACC0739CE38D80B892A
SHA-512:	9B534EA56EADDBDDF3FE254DCBB8816575D18C167BFCD69FB67C06CE63970A51D38233B700A990B6A171ADF544511AB81252BC6B6E01659EB64922274F84DA2C
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.6.6.6.4.6.1.6.7.1.7.5.1.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.6.6.6.4.6.2.3.7.4.8.7.8.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.9.7.e.0.9.e.4.-.3.0.c.a.-.4.1.4.4.-.a.8.f.1.-.1.7.b.9.4.7.8.9.f.c.1.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.d.1.4.5.f.3.3.-.0.8.6.6.-.4.5.3.8.-.8.a.6.f.-.6.3.0.9.e.5.0.e.0.1.f.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.B.i.l.l._.O.f. ._.L.a.d.i.n.g...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.N.e.w.S.t.b...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.e.8.-.0.0.0.1.-.0.0.1.4.-.b.7.6.c.-.2.2.f.f.e.1.2.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.0.e.5.0.8.a.9.0.6.9.a.1.b.4.f.0.5.b.e.4.4.4.1.e.a.6.1.0.9.6.f.0.0.0.0.0.0.0.0.!.0.0.0.0.e.a.f.8.c.4.c.c.9.8.f.a.2.7.8.b.8.f.1.3.9.8.4.1.0.0.1.7.d.9.d.4.6.2.3.2.d.4.7.5.!.B.i.l.l._.O.f.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5691.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Tue Oct 29 09:07:42 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	482528
Entropy (8bit):	3.269457065642725
Encrypted:	false
SSDEEP:	6144:oKI+3kndFabT6e44fLKCsea7uLMH/zbq13QMg:oKnHieaaKqZQMg
MD5:	F2E5D00B66E8CBAA7943834DEB6BC073
SHA1:	334D2CCA5754AECBB1D43CD10F9289E5A24D98DD
SHA-256:	240F17DFE078E42B2CD9E5386E26FDB3276C303562584320CC402665DB281869
SHA-512:	EF79F68A5E78ACF2B47B0EF3C24ADA6F3CFC4EB03858033AAD50505B20968B8A1FE517F0A780A78F7EFCB4CB74C43C735CB3A4FFF3EBDD8EF6786333B26DCEAF
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........ g............t...........<...........$....(......0 ...(.......O..............l.......8...........T...........`<... ..........$I...........K..............................................................................eJ.......K......Lw......................T............ g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5886.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8626
Entropy (8bit):	3.709597188813778
Encrypted:	false
SSDEEP:	192:R6l7wVeJ500QO6Y9Xxhqgmfa6JAprs89b6PwOf5kfm:R6lXJ60QO6Y9xhqgmfaic6PhfWe
MD5:	886D39524A24AADE3E4B89D378B47AC5
SHA1:	1BAF08359553B5D2EFFA85894C11FA78CCBE714F
SHA-256:	FD0A64F740C7F8B4C49404391C05261D3CD27749399BC7A314178C836BD639BB
SHA-512:	8E5878E47BF64C8C9392BAE050B50129D340A045EEC03867DB553AB87C7D8AD7FD8525D07AB08642157BEB1ADD1EB2988EC382296D987DAFB24C130750DA5404
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.4.0.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER58D5.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4784
Entropy (8bit):	4.515998876231688
Encrypted:	false
SSDEEP:	48:cvIwWl8zs8Jg771I99iWpW8VY6Ym8M4JrtAFNyq85G+dRerv8pd:uIjf6I7mj7V+JrOXG0rv8pd
MD5:	F035CA573E8F7CB4BFE8165B30DB96CD
SHA1:	F34187E173E5A4F96FB58E1B525160F126D19051
SHA-256:	73A31CA0D2DC24EB0D093C853108E2AC1DA989B0961865DC0CC8231FAA168584
SHA-512:	4923A27241076F51DB6164683A88673EE45AF21C193BD11471B7AF8013B7FB743103E8A332F290256B1FBDE4257D4A9649EF4E66955D816268E86E510F617014
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="564490" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1w10vwtz.wqg.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3kjuxhrd.arq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dvfrzyx5.k1x.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sux4zclx.ilm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465628472598911
Encrypted:	false
SSDEEP:	6144:8IXfpi67eLPU9skLmb0b4/WSPKaJG8nAgejZMMhA2gX4WABl0uNadwBCswSbF:BXD94/WlLZMM6YFHk+F
MD5:	C98D6BAB55554E735BDA60E5BEDBC092
SHA1:	534B8A375EE6123490C2C8EACAD76B7B232BA412
SHA-256:	3AC71D71E858157ECD4BF3F5BE8B600AA8C49EBDD55C1CC64C42C9BF773BBC2B
SHA-512:	2A1797754719592692CFF9590EBF69BA1D3D2DC23CD67B579F07DA6916C76417FE57D422122F49A556747971123253667E35F654F644BF49952E631E59280CEF
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.l4..)................................................................................................................................................................................................................................................................................................................................................#6........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.334744855511504
TrID:	Win64 Executable Console Net Framework (206006/5) 48.58% Win64 Executable Console (202006/5) 47.64% Win64 Executable (generic) (12005/4) 2.83% Generic Win/DOS Executable (2004/3) 0.47% DOS Executable Generic (2002/1) 0.47%
File name:	Bill_Of _Lading.exe
File size:	1'433'631 bytes
MD5:	31b5ced94cfe86f5b51c0c1c3650a6a3
SHA1:	eaf8c4cc98fa278b8f1398410017d9d46232d475
SHA256:	d2529b27449d53c7b0006f144c0d702db17001e014fb9145e7c7b7349db0a277
SHA512:	4a54bb1ec2ae99ef1fe12874094a9cb0df46861d6164dd89c6377139ad72930847061591f3eca0af62d45e19c400b4fed7f326e50653af23d31c24cd24923d2c
SSDEEP:	12288:9zytFacJklRgyjP5HXfb1qS7JC3TyC5xkcPrfUC4PFSRIdxuvW6A:UFaKkMyL5Hj1w3OcjIyg
TLSH:	B2652502792B8DA3FE249239C0C538F591FC1C5B31F9A11FCFA8AD39956943D191E93A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....u.g.........."...0.J'............... ....@...... ....................... ....../.....`................................

File Icon


Icon Hash:	2946e68e96b3ca4d

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x671A75BC [Thu Oct 24 16:28:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x2b68a	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x274a	0x2800	ab32d8a2affd810b484333fdf8ba0c4f	False	0.5806640625	data	5.714609463115511	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x6000	0x2b68a	0x2b800	2a5e1c12685c88f4462f7ff08bc1c5ed	False	0.20933234554597702	data	5.118493192143437	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x62c4	0x3751	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9929383518113127
RT_ICON	0x9a18	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	0.0891251626641429
RT_ICON	0x1a240	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	0.13335610678999368
RT_ICON	0x236e8	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	0.16816081330868762
RT_ICON	0x28b70	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	0.15594000944733113
RT_ICON	0x2cd98	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	0.23392116182572614
RT_ICON	0x2f340	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	0.274624765478424
RT_ICON	0x303e8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	0.41885245901639345
RT_ICON	0x30d70	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.5
RT_GROUP_ICON	0x311d8	0x84	data	0.7272727272727273
RT_VERSION	0x3125c	0x244	data	0.46379310344827585
RT_MANIFEST	0x314a0	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 10:07:43.403328896 CET	49736	443	192.168.2.4	172.67.74.152
Oct 29, 2024 10:07:43.403382063 CET	443	49736	172.67.74.152	192.168.2.4
Oct 29, 2024 10:07:43.403446913 CET	49736	443	192.168.2.4	172.67.74.152
Oct 29, 2024 10:07:43.414823055 CET	49736	443	192.168.2.4	172.67.74.152
Oct 29, 2024 10:07:43.414841890 CET	443	49736	172.67.74.152	192.168.2.4
Oct 29, 2024 10:07:44.028803110 CET	443	49736	172.67.74.152	192.168.2.4
Oct 29, 2024 10:07:44.028928041 CET	49736	443	192.168.2.4	172.67.74.152
Oct 29, 2024 10:07:44.032131910 CET	49736	443	192.168.2.4	172.67.74.152
Oct 29, 2024 10:07:44.032139063 CET	443	49736	172.67.74.152	192.168.2.4
Oct 29, 2024 10:07:44.032413006 CET	443	49736	172.67.74.152	192.168.2.4
Oct 29, 2024 10:07:44.079000950 CET	49736	443	192.168.2.4	172.67.74.152
Oct 29, 2024 10:07:44.096499920 CET	49736	443	192.168.2.4	172.67.74.152
Oct 29, 2024 10:07:44.143349886 CET	443	49736	172.67.74.152	192.168.2.4
Oct 29, 2024 10:07:44.276715994 CET	443	49736	172.67.74.152	192.168.2.4
Oct 29, 2024 10:07:44.276806116 CET	443	49736	172.67.74.152	192.168.2.4
Oct 29, 2024 10:07:44.276895046 CET	49736	443	192.168.2.4	172.67.74.152
Oct 29, 2024 10:07:44.328475952 CET	49736	443	192.168.2.4	172.67.74.152
Oct 29, 2024 10:07:45.564232111 CET	49738	25	192.168.2.4	46.175.148.58
Oct 29, 2024 10:07:46.578927994 CET	49738	25	192.168.2.4	46.175.148.58
Oct 29, 2024 10:07:48.594563007 CET	49738	25	192.168.2.4	46.175.148.58
Oct 29, 2024 10:07:52.594645977 CET	49738	25	192.168.2.4	46.175.148.58
Oct 29, 2024 10:08:00.594679117 CET	49738	25	192.168.2.4	46.175.148.58

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 10:07:43.328752995 CET	53904	53	192.168.2.4	1.1.1.1
Oct 29, 2024 10:07:43.337305069 CET	53	53904	1.1.1.1	192.168.2.4
Oct 29, 2024 10:07:45.549212933 CET	60993	53	192.168.2.4	1.1.1.1
Oct 29, 2024 10:07:45.563581944 CET	53	60993	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 29, 2024 10:07:43.328752995 CET	192.168.2.4	1.1.1.1	0x2e92	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Oct 29, 2024 10:07:45.549212933 CET	192.168.2.4	1.1.1.1	0x7d7e	Standard query (0)	mail.iaa-airferight.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 29, 2024 10:07:43.337305069 CET	1.1.1.1	192.168.2.4	0x2e92	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Oct 29, 2024 10:07:43.337305069 CET	1.1.1.1	192.168.2.4	0x2e92	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Oct 29, 2024 10:07:43.337305069 CET	1.1.1.1	192.168.2.4	0x2e92	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Oct 29, 2024 10:07:45.563581944 CET	1.1.1.1	192.168.2.4	0x7d7e	No error (0)	mail.iaa-airferight.com	46.175.148.58	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	172.67.74.152	443	7612	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 09:07:44 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-10-29 09:07:44 UTC	211	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 09:07:44 GMT Content-Type: text/plain Content-Length: 14 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8da204590ed3e546-DFW
2024-10-29 09:07:44 UTC	14	IN	Data Raw: 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 Data Ascii: 173.254.250.72

Target ID:	0
Start time:	05:07:36
Start date:	29/10/2024
Path:	C:\Users\user\Desktop\Bill_Of _Lading.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Bill_Of _Lading.exe"
Imagebase:	0x1922bdb0000
File size:	1'433'631 bytes
MD5 hash:	31B5CED94CFE86F5B51C0C1C3650A6A3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.1777119131.000001922DE20000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1777775843.000001923DAF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1777775843.000001923DAF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:07:36
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:07:40
Start date:	29/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Bill_Of _Lading.exe" -Force
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:07:40
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:07:40
Start date:	29/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Imagebase:	0xc90000
File size:	108'664 bytes
MD5 hash:	914F728C04D3EDDD5FBA59420E74E56B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.2945675273.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2945675273.00000000032D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.2945675273.00000000032D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2944572875.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.2944572875.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	05:07:40
Start date:	29/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Imagebase:	0x8e0000
File size:	108'664 bytes
MD5 hash:	914F728C04D3EDDD5FBA59420E74E56B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	05:07:40
Start date:	29/10/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7400 -s 1048
Imagebase:	0x7ff6a8610000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	33.3%
Total number of Nodes:	9
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9BA50002 Relevance: 2.3, Instructions: 2265
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1787115752.00007FFD9BA50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba50000_Bill_Of _Lading.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66e350b51f7e6ad34e9c33bf1585d8d2a2cb4a1b69646b3b376eeb6de52e8a92
Instruction ID: cc8bd6096bdf3d3a23c1cd9cba54d47db3c9091ea442edc0557ac443c4da15a2
Opcode Fuzzy Hash: 66e350b51f7e6ad34e9c33bf1585d8d2a2cb4a1b69646b3b376eeb6de52e8a92
Instruction Fuzzy Hash: E3E24171A0E7CA4FD775DBA888755A87BE0FF56700F0501FED089CB0A3DAA86A46C741

Function 00007FFD9B988550 Relevance: 2.2, Strings: 1, Instructions: 922
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

aN_H, xrefs: 00007FFD9B98C4C4

Memory Dump Source

Source File: 00000000.00000002.1786757293.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b980000_Bill_Of _Lading.jbxd

Similarity

API ID:
String ID: aN_H
API String ID: 0-2650695561
Opcode ID: 818e7f12e476deb5bedb288c19893c5513c71a1ccf2557624c553d57be88a5a1
Instruction ID: 1508d888480f9cc72b2ef11529fe56abfb4a189d214617a6a400601fc803c700
Opcode Fuzzy Hash: 818e7f12e476deb5bedb288c19893c5513c71a1ccf2557624c553d57be88a5a1
Instruction Fuzzy Hash: C952E430B19A0D5FDB68EB68D465A7977E1EF59300F1501BEE04EC72A2DE34ED428781

Function 00007FFD9B983508 Relevance: 1.8, Strings: 1, Instructions: 566
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fish, xrefs: 00007FFD9B983640

Memory Dump Source

Source File: 00000000.00000002.1786757293.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b980000_Bill_Of _Lading.jbxd

Similarity

API ID:
String ID: fish
API String ID: 0-1064584243
Opcode ID: 297b8346678f4a1091855d9b29825bb33fa6f8efba8ffec3f805628c241b4f3b
Instruction ID: cd51d4813d9495c9ac1c29a66e9f35c8e0a1caefabaca99df06a9cde1e661776
Opcode Fuzzy Hash: 297b8346678f4a1091855d9b29825bb33fa6f8efba8ffec3f805628c241b4f3b
Instruction Fuzzy Hash: 89F1BD3171DE8A1FE76CAB7898755B577E1EF96310B0541BEE08BC71E3DD28A9028381

Function 00007FFD9B983495 Relevance: 1.8, Strings: 1, Instructions: 506
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fish, xrefs: 00007FFD9B983640

Memory Dump Source

Source File: 00000000.00000002.1786757293.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b980000_Bill_Of _Lading.jbxd

Similarity

API ID:
String ID: fish
API String ID: 0-1064584243
Opcode ID: 393bf600c4e9fdc3331d7b1ae152a78a0de0968571c0004fcde47710bc59cf0e
Instruction ID: 8de89894d71a3ea93449fcc78aad6ce4daec32ded2e9d8841ef8e9c74fc2194c
Opcode Fuzzy Hash: 393bf600c4e9fdc3331d7b1ae152a78a0de0968571c0004fcde47710bc59cf0e
Instruction Fuzzy Hash: 4EE19A21B1EE5E2FE7A8EA6C94646B537D0FF95314B0500BFE08EC71A7DD28A9418380

Function 00007FFD9B98757B Relevance: 1.7, APIs: 1, Instructions: 204
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1786757293.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b980000_Bill_Of _Lading.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a2657cc5d814b5ce0b581005316095a70039218ab97167c4e5b6000784d00d5
Instruction ID: 76f7db66387933a2d97fad517252ae73aca4b706bcd7747c62e798a748e74ac2
Opcode Fuzzy Hash: 8a2657cc5d814b5ce0b581005316095a70039218ab97167c4e5b6000784d00d5
Instruction Fuzzy Hash: 63514B31B0D6188FE758FAACA866BF97BD0DF95320F0441BBD05EC7293DD1568498391

Function 00007FFD9B98AEF1 Relevance: 1.5, Instructions: 1536COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1786757293.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b980000_Bill_Of _Lading.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 024d7c0e839b16cb9d7d6fc0bddc59870c4310fda9f1bed87251b611f489b3e2
Instruction ID: 83a0fe31a5cacb61a4727ed6f191fcd95de7b65c832fd87e68d6ab5eb02ba462
Opcode Fuzzy Hash: 024d7c0e839b16cb9d7d6fc0bddc59870c4310fda9f1bed87251b611f489b3e2
Instruction Fuzzy Hash: 53B26A3061EB8A4FD729DF38C4A04B5B7E1FF96300B1945BED08AC72B6DA35A946C741

Function 00007FFD9B98DE89 Relevance: 1.5, Instructions: 1473COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1786757293.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b980000_Bill_Of _Lading.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2ee78618cd6bcfb30578ab83ff0299ef78cbe9833e7e59c61603cad7e3f12bc
Instruction ID: 138a2f502ebc3dd06f464e149dedf014df20caa0b6235419f1b5a6f449a1a648
Opcode Fuzzy Hash: e2ee78618cd6bcfb30578ab83ff0299ef78cbe9833e7e59c61603cad7e3f12bc
Instruction Fuzzy Hash: 05A2573062DF494FD329DB28C4A04B5B7E2FF85301B1546BEE48AC72A6DE35E946C781

Function 00007FFD9B983520 Relevance: 1.0, Instructions: 1011COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1786757293.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b980000_Bill_Of _Lading.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b661417f3e43ba641923e1f662038913a74882844217e12fab4175ea1975c35a
Instruction ID: 14838bb4a64b5a39e69fbc78b89620d69298f4463bc94f0453d0468d05f3c6fd
Opcode Fuzzy Hash: b661417f3e43ba641923e1f662038913a74882844217e12fab4175ea1975c35a
Instruction Fuzzy Hash: 5A727831A2EA4A5FE7B88B1484613B4B7D1EF52310F1641BDD48ECB5E3DE28B946C780

Function 00007FFD9B98AB17 Relevance: .4, Instructions: 390COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1786757293.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b980000_Bill_Of _Lading.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dfc467cb06b2f2161dfe4fb67e9c920ed746de6cb3574e22740c9084d1c1002
Instruction ID: 12061a9101a8f6b950e51c80bd5b942b1a00afc1e553aa55ad4bdd2176dab48f
Opcode Fuzzy Hash: 1dfc467cb06b2f2161dfe4fb67e9c920ed746de6cb3574e22740c9084d1c1002
Instruction Fuzzy Hash: 59C19B3062DF8E4FD32DCB6884A11B1BBE2FF95301B15467ED4C6C72A6DA38A546C781

Function 00007FFD9B993AB1 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1786757293.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b980000_Bill_Of _Lading.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12e3897e425e4763eedf9d83af72ec36d92fd0bea914bf072cbd0fc120b9fab4
Instruction ID: 4d8b0510a98946e2d221a8c106829e6f279b5c1c9a1d5ca4316ad4a936177288
Opcode Fuzzy Hash: 12e3897e425e4763eedf9d83af72ec36d92fd0bea914bf072cbd0fc120b9fab4
Instruction Fuzzy Hash: 5E51593170D74D1FD71E9A7888361B57BA5EB87220B0682BFD087CB1F7DC28A8068381

Function 00007FFD9B993B08 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1786757293.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b980000_Bill_Of _Lading.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74595c1ac676f630e4929a9ead80235da36172d53e42426cd85f151efe0d9a1b
Instruction ID: 2f730833c6618317cd8a96068a8f2206840a4461491968273cbfff729250af0a
Opcode Fuzzy Hash: 74595c1ac676f630e4929a9ead80235da36172d53e42426cd85f151efe0d9a1b
Instruction Fuzzy Hash: 2441493170D78A1FD71E9A7888751B53BA5EB83210B0682BFD087CB1E7DD28A9068391

Function 00007FFD9B993B57 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1786757293.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b980000_Bill_Of _Lading.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96e8b0db2543be5691dd903efa0fc9f572f2ade6eb637efc48462d40716840d9
Instruction ID: 5cf884cb9bbe163402aaddc3bc774e809e304b0ff6f8097ce8e07e8586d0eb0f
Opcode Fuzzy Hash: 96e8b0db2543be5691dd903efa0fc9f572f2ade6eb637efc48462d40716840d9
Instruction Fuzzy Hash: 9C31C56160E7891FD72F8AB48C755767FA5DB83220B0682BFD086CB5A3DD585C068392

Function 00007FFD9B981FEA Relevance: 1.6, APIs: 1, Instructions: 141
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FFD9B9820CA

Memory Dump Source

Source File: 00000000.00000002.1786757293.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b980000_Bill_Of _Lading.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 37f965fc89620ad926168b4a0f398eaa3f28bc014d6066eb0d503d1743832f35
Instruction ID: 737743b3e45172c8bf12d2d007020c4c1641e94d9cef4d6fa295cb4676dc7515
Opcode Fuzzy Hash: 37f965fc89620ad926168b4a0f398eaa3f28bc014d6066eb0d503d1743832f35
Instruction Fuzzy Hash: D041493190D7888FD7199BA898166E97BF0EF56321F0443AFD099C31A3CE786846C792

Function 00007FFD9B9808B9 Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 00007FFD9B98093F

Memory Dump Source

Source File: 00000000.00000002.1786757293.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b980000_Bill_Of _Lading.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: 6b5826a1bdc31bbd46f53f58aadfeea5d26068a6fd8066de06fca533b8915c83
Instruction ID: b548988638aa329bfa54dfee8bf216a5856d518cf267b9231749aed86920d023
Opcode Fuzzy Hash: 6b5826a1bdc31bbd46f53f58aadfeea5d26068a6fd8066de06fca533b8915c83
Instruction Fuzzy Hash: 3121827090CB5C8FDB29DF59D845AF97BF0EB56310F04426FD089C31A2D6646849CB51

Function 00007FFD9B980493 Relevance: 1.6, APIs: 1, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 00007FFD9B98093F

Memory Dump Source

Source File: 00000000.00000002.1786757293.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b980000_Bill_Of _Lading.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: 698bcf01f83067fa22ae44817e8ec89a20d88f226cf67d12db21a7e1c9775dd9
Instruction ID: 7a5781b2dc136327767feebd8f5b15adbb95eb9ec2c1eb184751a30d5e0086e8
Opcode Fuzzy Hash: 698bcf01f83067fa22ae44817e8ec89a20d88f226cf67d12db21a7e1c9775dd9
Instruction Fuzzy Hash: 6021B370A0CA1C8FDB28DF99D849BFA77F0EB55321F00822ED05AD3652DB74A446CB91

Function 00007FFD9BA510C9 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1787115752.00007FFD9BA50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba50000_Bill_Of _Lading.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4a70f570a43a2233e9bce96d5f0463121526afd0f29531c41ce5c248a669cd4
Instruction ID: 9a48b96142395c4f91e5e58bb7e43eae36a56605f8fd92bdc0680c9c9938aebc
Opcode Fuzzy Hash: f4a70f570a43a2233e9bce96d5f0463121526afd0f29531c41ce5c248a669cd4
Instruction Fuzzy Hash: CE711D31A0DB8D4FDB66DBA488755B97BE0FF65300B0601FBD04AC71A3DA68AE41C741

Analysis Process: CasPol.exePID: 7612, Parent PID: 7400COMMON

Execution Graph

Execution Coverage:	11.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	111
Total number of Limit Nodes:	11

Executed Functions

Function 06A22358 Relevance: 9.0, Strings: 6, Instructions: 1485COMMON

Download Yara Rule

Strings

$dq, xrefs: 06A23722
$dq, xrefs: 06A23763
$dq, xrefs: 06A23716
$dq, xrefs: 06A2374B
$dq, xrefs: 06A2373F
$dq, xrefs: 06A2376F

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq$$dq$$dq$$dq
API String ID: 0-2331353128
Opcode ID: ecfba5fc171bc62528f7cccb267d58c9f5a671f1a0b38674c05e6258e694acb0
Instruction ID: ae7f53fd46b265a765e34734fe9b701457df65b46205a09263ff75a557a62e19
Opcode Fuzzy Hash: ecfba5fc171bc62528f7cccb267d58c9f5a671f1a0b38674c05e6258e694acb0
Instruction Fuzzy Hash: F9D24834E10216CFDB64EB68C584B9DB7B2FF89310F5485A9D409AF265EB34ED81CB80

Function 06A27D68 Relevance: 3.0, Strings: 2, Instructions: 473
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$dq, xrefs: 06A28303
$dq, xrefs: 06A2830F

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID: $dq$$dq
API String ID: 0-2340669324
Opcode ID: 99890ba4f2e11f0bd3e76642271129b90e78f8c2406c1a902def2fc37d12e24f
Instruction ID: 74e7b36eb84e4517a31cd9a8959341d0d9258355a3322ad8e1144a1f7177c192
Opcode Fuzzy Hash: 99890ba4f2e11f0bd3e76642271129b90e78f8c2406c1a902def2fc37d12e24f
Instruction Fuzzy Hash: 9F02D030B002269FDB54EB69D5906AEB7F2FF84310F248568E805DB394DB39ED46CB90

Function 06A265E0 Relevance: .8, Instructions: 802COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4422ca0a084cdf166e96576d68dc9820a08be03f839bd5820f8d2389eda4aa24
Instruction ID: d444a9292cd0d39bcf2622feb89bb0c6548c1a6fa188c1952d4b368e0f40809f
Opcode Fuzzy Hash: 4422ca0a084cdf166e96576d68dc9820a08be03f839bd5820f8d2389eda4aa24
Instruction Fuzzy Hash: BB629F34B112269FDB54EB68D594BADB7F2EF88310F149469E40ADB394DB35EC41CB80

Function 06A25588 Relevance: .6, Instructions: 593COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25634610bead0d2d339336d1f2c0173be494d87848c9c0eafd848531ea25b627
Instruction ID: ce11074d114919aee9abe9fc8dcba55a5e7cac0bb2b61404c787b501634124c8
Opcode Fuzzy Hash: 25634610bead0d2d339336d1f2c0173be494d87848c9c0eafd848531ea25b627
Instruction Fuzzy Hash: A822B571F502268FDF64DBA8C5806AEBBB2FF89310F248469D815AF395DA35DC41CB90

Function 06A2B20F Relevance: .6, Instructions: 577COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96733cf67efb545286046160928724ead84d56830b3309982cad478fba9ebb22
Instruction ID: b95a760da7de692ce2b6c9d3c2927c5b08ed57e63a94eda1167097eeb952ad51
Opcode Fuzzy Hash: 96733cf67efb545286046160928724ead84d56830b3309982cad478fba9ebb22
Instruction Fuzzy Hash: 41225F70F5022A8BDF64EB5DD4947AEB7B2EB49318F648426E409DF391CB34DC818B61

Function 06A2ACB8 Relevance: 10.4, Strings: 8, Instructions: 394
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$dq, xrefs: 06A2AE38
$dq, xrefs: 06A2ADE5
$dq, xrefs: 06A2AE67
$dq, xrefs: 06A2AE2C
$dq, xrefs: 06A2AE5B
$dq, xrefs: 06A2ADD9
$dq, xrefs: 06A2AE84
$dq, xrefs: 06A2AE90

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq
API String ID: 0-634254105
Opcode ID: b4a2c66b31ea8d086c086de382654e299781a25beae5b622c94bbf5e3d4b424c
Instruction ID: 9fc3a360c48d51ae45fd5a91f9b28c1ff821e8d43a60ec4ef8af8cacf9d9e929
Opcode Fuzzy Hash: b4a2c66b31ea8d086c086de382654e299781a25beae5b622c94bbf5e3d4b424c
Instruction Fuzzy Hash: 1AE19130F102269FDB55EF69D9806AEB7F2FF85301F208929D9099B354DB34AC46CB90

Function 06A2B630 Relevance: 8.0, Strings: 6, Instructions: 470
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$dq, xrefs: 06A2BBD7
$dq, xrefs: 06A2BB97
$dq, xrefs: 06A2BBCB
$dq, xrefs: 06A2BB63
$dq, xrefs: 06A2BBA3
$dq, xrefs: 06A2BB6F

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq$$dq$$dq$$dq
API String ID: 0-2331353128
Opcode ID: 83e10655e81c131c9013f5adf8504dba15777374cdca3bbf12ca17fb918f493a
Instruction ID: 9fcb83083e59d103445625dc50f8d1328059d2927337ebc06329fec411adc68b
Opcode Fuzzy Hash: 83e10655e81c131c9013f5adf8504dba15777374cdca3bbf12ca17fb918f493a
Instruction Fuzzy Hash: 95027F30E5022A8FDB64EF6CD5846ADB7B2EB45318F20856AD409DF255DB34EC41CBA1

Function 06A12C88 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 06A12D06
GetCurrentThread.KERNEL32 ref: 06A12D43
GetCurrentProcess.KERNEL32 ref: 06A12D80
GetCurrentThreadId.KERNEL32 ref: 06A12DD9

Memory Dump Source

Source File: 00000004.00000002.2950036397.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a10000_CasPol.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: d356b8f4ff6e1de35e89ad126e5a98c9fdcc87b7f3cacef4ced1845223af8773
Instruction ID: 086a8843f4f38487d1e7d910fedc8bf155c90e58262a7e771c69d7678ad6392e
Opcode Fuzzy Hash: d356b8f4ff6e1de35e89ad126e5a98c9fdcc87b7f3cacef4ced1845223af8773
Instruction Fuzzy Hash: 35515AB09003098FDB54EFA9D948BDEBBF1FF48314F248059E019A7391DB74A985CB65

Function 06A12C87 Relevance: 6.1, APIs: 4, Instructions: 126
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 06A12D06
GetCurrentThread.KERNEL32 ref: 06A12D43
GetCurrentProcess.KERNEL32 ref: 06A12D80
GetCurrentThreadId.KERNEL32 ref: 06A12DD9

Memory Dump Source

Source File: 00000004.00000002.2950036397.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a10000_CasPol.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 5bb6cb7b6a44eed8142efeeccf2c5767919480e55da44e7e2ca2b527303e0708
Instruction ID: f5131b3733259093a96e62550712dc258e07de37155973966e3f32a44c30accb
Opcode Fuzzy Hash: 5bb6cb7b6a44eed8142efeeccf2c5767919480e55da44e7e2ca2b527303e0708
Instruction Fuzzy Hash: D05158B09003098FDB44EFA9D948BDEBBF1FF48314F248459E019AB291DB34A985CB65

Function 06A29138 Relevance: 5.2, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$dq, xrefs: 06A291C6
$dq, xrefs: 06A2918B
$dq, xrefs: 06A2917F
$dq, xrefs: 06A291BA

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq$$dq
API String ID: 0-185584874
Opcode ID: 07dcb4657fd0143706229d7024d10332d7b291c0efda2f2091ac6b9b3ef819b5
Instruction ID: 76f369e8b7b708b7840342317cc04ad46c6cdc5fe577fef333b5dff97a84672f
Opcode Fuzzy Hash: 07dcb4657fd0143706229d7024d10332d7b291c0efda2f2091ac6b9b3ef819b5
Instruction Fuzzy Hash: 93913170B1021A9FDB54DF6AD9507AFB7F6EF84600F108569D80DEB344EA34AD428B91

Function 06A2CF28 Relevance: 4.6, Strings: 3, Instructions: 800
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$dq, xrefs: 06A2D327
$dq, xrefs: 06A2D333
$dq, xrefs: 06A2D31F

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq
API String ID: 0-2861643491
Opcode ID: cb9e6932cd10620ad67f414e306a9edc35b2d68694f2da2c08639e2e1970484d
Instruction ID: d9f3114bae5b1ebb76f49af240998e17b8b96661f485d4e1c023daccc4cb3b0e
Opcode Fuzzy Hash: cb9e6932cd10620ad67f414e306a9edc35b2d68694f2da2c08639e2e1970484d
Instruction Fuzzy Hash: DE626070B002268FCB55EB6CE590A5EB7F2FF84315B208968D4099F359DB75ED86CB80

Function 06A24B50 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPiq, xrefs: 06A24C7D
\Oiq, xrefs: 06A24D07
fiq, xrefs: 06A2525D

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID: fiq$XPiq$\Oiq
API String ID: 0-1639307521
Opcode ID: 16d831ef7034042289509366f651823662fd970a95f679c44554266b4fa72573
Instruction ID: 5427231da4a22fe339d8b7ebefbe4fa18f33ead8d52780efff36d3a4d2bcd5df
Opcode Fuzzy Hash: 16d831ef7034042289509366f651823662fd970a95f679c44554266b4fa72573
Instruction Fuzzy Hash: A3618170F102199FEB54AFA9C4547AEBAF6FF88700F208429E509AB394DF759C05CB90

Function 06A29127 Relevance: 2.7, Strings: 2, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$dq, xrefs: 06A2917F
$dq, xrefs: 06A291BA

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID: $dq$$dq
API String ID: 0-2340669324
Opcode ID: f7787b5bb7d5fd631db1af551d7ee3498758ead5c65a13f8b615062f57afc339
Instruction ID: 5754824408d6fe3c4834032d75bf594b726c20f3537656b372d7621f0ad68688
Opcode Fuzzy Hash: f7787b5bb7d5fd631db1af551d7ee3498758ead5c65a13f8b615062f57afc339
Instruction Fuzzy Hash: 95517670B101169FDB94DB79E9507AF77FAEF88600F148469C909DB394DA34EC42CB91

Function 06A1B198 Relevance: 1.7, APIs: 1, Instructions: 200COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 06A1B3FE

Memory Dump Source

Source File: 00000004.00000002.2950036397.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a10000_CasPol.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 5e04ff88533ba2583b17d7ab3c6975675218c03e648b78ab752e22514cac09a3
Instruction ID: a69fcc9d633ace45621f5de35cb5dd8f5f8bc9e4ca0190051abe026b2aee5388
Opcode Fuzzy Hash: 5e04ff88533ba2583b17d7ab3c6975675218c03e648b78ab752e22514cac09a3
Instruction Fuzzy Hash: 27815970A00B058FD764EF29D54579ABBF1FF48304F008A6DD49ADBA50DB75E849CBA0

Function 06A1D330 Relevance: 1.7, APIs: 1, Instructions: 151COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06A1D4A2

Memory Dump Source

Source File: 00000004.00000002.2950036397.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a10000_CasPol.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: cd2476db6fc6a964e84662bbe62e554e469f0805c9b2a28a8245471e0e2e731e
Instruction ID: 225c5c335eaa4d3e643a1521f20a8362aafdfd2060cf2414633ff88d90b3f6a3
Opcode Fuzzy Hash: cd2476db6fc6a964e84662bbe62e554e469f0805c9b2a28a8245471e0e2e731e
Instruction Fuzzy Hash: EF5113B1C00249AFDF55DFA9C984ADDBFB5FF48310F24816AE918AB221D7719845CF90

Function 06A1D390 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06A1D4A2

Memory Dump Source

Source File: 00000004.00000002.2950036397.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a10000_CasPol.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: eb3ee1f9e506f5e0d785eebb6d76c31f55e211da8f3b276476c643b5e5200bcd
Instruction ID: c01c9bf9d4cf4a3ba5fbc14727f3fea62ac6eefaf056b2afdf1c8a6f843c47fb
Opcode Fuzzy Hash: eb3ee1f9e506f5e0d785eebb6d76c31f55e211da8f3b276476c643b5e5200bcd
Instruction Fuzzy Hash: 0341B0B1D10309DFDB14DF99C984ADEBBB5FF88314F24812AE819AB250D775A845CF90

Function 06A1A61C Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 06A1FB91

Memory Dump Source

Source File: 00000004.00000002.2950036397.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a10000_CasPol.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 53dede3a8822a219ace31af661ff442565241285e8a1ff03ba7c8456fa0b347d
Instruction ID: 958547ca402d0517d5dc6712944ef043b7ba0170276431761ae160c9c915a823
Opcode Fuzzy Hash: 53dede3a8822a219ace31af661ff442565241285e8a1ff03ba7c8456fa0b347d
Instruction Fuzzy Hash: 99415AB49003498FDB54DF59C888AAABBF5FF88314F24C459D519AB321C774A845CFA0

Function 06A12EC8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06A12F57

Memory Dump Source

Source File: 00000004.00000002.2950036397.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a10000_CasPol.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 30b50d7203d46fe1a17c161982509c737060efb331105b38b8d0a2d61a61f3ec
Instruction ID: 8276a17098c2401c6ecefa364d2749a1d489a955c5222fb7c42ac0871f0a42df
Opcode Fuzzy Hash: 30b50d7203d46fe1a17c161982509c737060efb331105b38b8d0a2d61a61f3ec
Instruction Fuzzy Hash: F521DFB59002489FDB10CFAAD984ADEBFF5EB48310F14801AE968A7250D374AA54DFA5

Function 06A12ED0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06A12F57

Memory Dump Source

Source File: 00000004.00000002.2950036397.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a10000_CasPol.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0bc1d60d4d6c8a31ec408d44babcaf4959543f3f4947c2238565dafb737d6c5c
Instruction ID: f7cddf696da0426579be1078f7fb031fdf5e0ac923e89e1e59b17ab4a1013a9b
Opcode Fuzzy Hash: 0bc1d60d4d6c8a31ec408d44babcaf4959543f3f4947c2238565dafb737d6c5c
Instruction Fuzzy Hash: 4121E4B59002089FDB10CF9AD984ADEBBF4FB48310F14801AE918A7350D374A954CFA0

Function 02DBEC18 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 02DBEC87

Memory Dump Source

Source File: 00000004.00000002.2945549381.0000000002DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2db0000_CasPol.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: cd02f87be0b2b2401274d7165ac9d97ebfaf0b98ae0fb9d486e861abeb91dd4c
Instruction ID: de0c391ee97f6aab5694a1b8818aa2f60a03b7c81cf4a64e91d5bc8b3fa7501c
Opcode Fuzzy Hash: cd02f87be0b2b2401274d7165ac9d97ebfaf0b98ae0fb9d486e861abeb91dd4c
Instruction Fuzzy Hash: 211103B1C0025A9BCB10DF9AC544ADEFBF4BF48324F15816AE818A7341D378A944CFA1

Function 02DBEC20 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 02DBEC87

Memory Dump Source

Source File: 00000004.00000002.2945549381.0000000002DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2db0000_CasPol.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: cef0879f3e75326abf535dfc5205ee8c8b83eada44917a79654e3012651e2a5c
Instruction ID: 5a2400a0ded17c794f36e912ef950772230047cb9e65d872af8a44dc7b8267d1
Opcode Fuzzy Hash: cef0879f3e75326abf535dfc5205ee8c8b83eada44917a79654e3012651e2a5c
Instruction Fuzzy Hash: E7111FB1C002599BCB10DF9AC544ADEFBF4BF48320F11816AE818A7381D378A944CFA1

Function 06A1B398 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 06A1B3FE

Memory Dump Source

Source File: 00000004.00000002.2950036397.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a10000_CasPol.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 506010b3161c2f6c37e1c46e95f897d7d00ee6f67418743e694c534d7954cafb
Instruction ID: 8053a6bbf8fbcf52bb2a18db299c3ac0cbe189e8c9cfe32f760b56dfdb3eb6ca
Opcode Fuzzy Hash: 506010b3161c2f6c37e1c46e95f897d7d00ee6f67418743e694c534d7954cafb
Instruction Fuzzy Hash: 2D11E0B6C003498FCB10DF9AC844ADEFBF4EB88324F10842AD419AB651D375A545CFA1

Function 06A24B40 Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

XPiq, xrefs: 06A24C7D

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID: XPiq
API String ID: 0-3497805733
Opcode ID: 2476baa2e2745450e891d7e855b1de4db7fdd9daacef55fd66bf9a6bbff52778
Instruction ID: 7751fb3f8fec0769b1d2f084f2719672be65d56f31ad97f2b9d1835204b535dd
Opcode Fuzzy Hash: 2476baa2e2745450e891d7e855b1de4db7fdd9daacef55fd66bf9a6bbff52778
Instruction Fuzzy Hash: 1D415E74F102199FDB559FA9C854BAEBAF6FF8C700F20852AE105AB394DB749C058B90

Function 06A2DAB0 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

PHdq, xrefs: 06A2DBF9

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID: PHdq
API String ID: 0-2991842255
Opcode ID: b4919814c095fa8f644c64c33e2d3aabfc5a16cbd99946007d815fc8a7cc98c8
Instruction ID: 0c16b16f789c8d3a89c14c44219df9b3ff7d69a019b6149573e19a8e630c4ad3
Opcode Fuzzy Hash: b4919814c095fa8f644c64c33e2d3aabfc5a16cbd99946007d815fc8a7cc98c8
Instruction Fuzzy Hash: 0F418270E5071A9FDB64FF69D49469EBBB2FF85301F204529E805EB241EB70E842CB81

Function 06A2DA9D Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

PHdq, xrefs: 06A2DBF9

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID: PHdq
API String ID: 0-2991842255
Opcode ID: 87db2bfdee0369121d20cbe15ecf8f9c4a96cd1d5e9ab8071669b9acce362bd5
Instruction ID: 96477edfca8426946c654ef41dedf59a1ab27a65caeb7b32b408f6259f2b8e86
Opcode Fuzzy Hash: 87db2bfdee0369121d20cbe15ecf8f9c4a96cd1d5e9ab8071669b9acce362bd5
Instruction Fuzzy Hash: DB41A270E003169FDB65EF69D59469EBBB2FF85201F104529E805EB246DB70E842CB40

Function 06A221BD Relevance: 1.4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

PHdq, xrefs: 06A2230B

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID: PHdq
API String ID: 0-2991842255
Opcode ID: cff8852a72319f799fcb27102aa84923954228cb1cc10ca8312c27d777ac00ba
Instruction ID: 6aeb07600d6db8d650e8f686c70bfa55f5d7a7cc118198dba65f4998e21da321
Opcode Fuzzy Hash: cff8852a72319f799fcb27102aa84923954228cb1cc10ca8312c27d777ac00ba
Instruction Fuzzy Hash: B0316230B102169FDB58AB78D95876E3BA3EF89200F144568D406EF394DF35EE02CBA4

Function 06A221D0 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PHdq, xrefs: 06A2230B

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID: PHdq
API String ID: 0-2991842255
Opcode ID: dffb6c48084d6188294aa1ed3511c644f747af6aef09a1ce80503842297d12e4
Instruction ID: 0f68323cd2952d37beaaff6f8668ad16c15e53d0026ce83e29734e3f1e1486ce
Opcode Fuzzy Hash: dffb6c48084d6188294aa1ed3511c644f747af6aef09a1ce80503842297d12e4
Instruction Fuzzy Hash: C0311E70B102169FDB58AB78D55876E7BE3AF89200F204468D406DF394DF35DE42CB90

Function 06A282DE Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

$dq, xrefs: 06A28303

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID: $dq
API String ID: 0-847773763
Opcode ID: 212212b53ab865f21787fca3e40c2d5ce1442a7208c7ba10b2f3276fed6e3319
Instruction ID: 5b58e5b7f2d2ad8c3e79a226553fe2225a06a9483f7a8fd691db58715225fcb5
Opcode Fuzzy Hash: 212212b53ab865f21787fca3e40c2d5ce1442a7208c7ba10b2f3276fed6e3319
Instruction Fuzzy Hash: E4F0A035F84227CBDF64AA5EF9801A8F3A1FB00251B144066ED00CB150D23DEA09CA91

Function 06A2C170 Relevance: .6, Instructions: 634COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b190477375804b6eec8e7a3a045985a8be07149e18976c992a23807586caae7
Instruction ID: 55223c7eac6ee01fe65e47f21c3971a80308cd92bae286e5c2d0d3fdb7b53d40
Opcode Fuzzy Hash: 3b190477375804b6eec8e7a3a045985a8be07149e18976c992a23807586caae7
Instruction Fuzzy Hash: F6329474B502169FDF94DB6DE984BADB7B2FB88320F108529D40ADB355DB34EC418B90

Function 06A261E0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36bfe1d14bc326b600d405d2f59004a3b30467e60fdf7b4780c2430a9d9f8a0a
Instruction ID: 293db2c0c2e07aa9cd38ce8a63bc480cf6b36adf619f3e43ace3a53d8be6ee71
Opcode Fuzzy Hash: 36bfe1d14bc326b600d405d2f59004a3b30467e60fdf7b4780c2430a9d9f8a0a
Instruction Fuzzy Hash: 8161C0B1F401224FDF54AB6EC88066FBADBAFD4210B254479E80EDB364DE65EC4287D1

Function 06A24280 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3669b03efd3304bc65872f0361853ee1f7565c163d384302a5f9917218baa0ba
Instruction ID: 0d3bcfdeb02e4d97afc09bc2678d3c0d36bde0a12d54f6ff99cfb0b7451e41ff
Opcode Fuzzy Hash: 3669b03efd3304bc65872f0361853ee1f7565c163d384302a5f9917218baa0ba
Instruction Fuzzy Hash: 69814E30B1021A9BDB54DFA9D5547AEBBF6EF89300F108529D40ADB394EB34EC428B91

Function 06A245A0 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9dfd24e1c62a15d1661bf5031133173841b838f7a6334964b4430b2153f46c7
Instruction ID: dc8be3b84c8ef136ca13bea3d30a24d269c8ac4889277efc272ef3019fe2e3c7
Opcode Fuzzy Hash: a9dfd24e1c62a15d1661bf5031133173841b838f7a6334964b4430b2153f46c7
Instruction Fuzzy Hash: D5914D34E1021A8FDF60DF68C890B9DB7B1FF89300F208695D459AB295DB70AA85CB90

Function 06A24290 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33529a1fbb1978701d546beac77d6224528ba5867a769a8c2cb1640367960e85
Instruction ID: 52bb51585575e96be7912abd9fe1310d2abb107864f6a548527cde4516797138
Opcode Fuzzy Hash: 33529a1fbb1978701d546beac77d6224528ba5867a769a8c2cb1640367960e85
Instruction Fuzzy Hash: 75812D30B1021A9BDB54DFA9D5547AEBBF6EF89300F108529D40ADB394EB74EC428B91

Function 06A245B8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9569643df4d6cd07494c878bebd9730117e822017b65269a719884b095aeade8
Instruction ID: 43dff8f396ad2d6df9e5ffb8d466bbd6585e092571922bf67715d5144d631c43
Opcode Fuzzy Hash: 9569643df4d6cd07494c878bebd9730117e822017b65269a719884b095aeade8
Instruction Fuzzy Hash: 2D913D70E1061A8BDF64DF68C890B9DB7B1FF89300F208595D559BB394DB70AA85CF90

Function 06A2EAF8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9d9b388cfe807c612a997883094e4bd0c682f4efcc60419847246d274886727
Instruction ID: fa78c9833f8afa6e6ae2407d0ac987c7fe3695e260ebc34cbe4ad2663c8c0af9
Opcode Fuzzy Hash: f9d9b388cfe807c612a997883094e4bd0c682f4efcc60419847246d274886727
Instruction Fuzzy Hash: 23710B70A002199FDB54EFA9D990A9DBBF6FF88304F248469D4199B355DB30EC86CB50

Function 06A2EAE8 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f50a059855e06df773a6092f8870a273da187d6c5ca8763c51a5866d388a032
Instruction ID: f7e843110d722c800249b8274bcf36ee660631dcbd5f2b1ab724556b6cb23357
Opcode Fuzzy Hash: 4f50a059855e06df773a6092f8870a273da187d6c5ca8763c51a5866d388a032
Instruction Fuzzy Hash: 70713C70A0021A9FDB54EFA9D990A9DBBF6FF88300F248469D419DB255DB30EC86CB50

Function 06A2FA0B Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78d0b3f99d99e78922b107a13de3441340fe5eeb9f7c0bc19bf9020b86aa6161
Instruction ID: 27051471661bc39c26e81b3594472a05a7f9ba937dca5719cd7a36ce6512ca9b
Opcode Fuzzy Hash: 78d0b3f99d99e78922b107a13de3441340fe5eeb9f7c0bc19bf9020b86aa6161
Instruction Fuzzy Hash: 2B51D770B602359FEF64676CE85877F26AAD789711F20442AE50ACB395CF2DCC8153A2

Function 06A2FC67 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42210743ccb1e0c2008e1741f8492521439056ba502343f682a4e86506dac4ff
Instruction ID: 029433d2cce48515b5febe2906bde2ab2051e368f553c0f8ede3a836e126c700
Opcode Fuzzy Hash: 42210743ccb1e0c2008e1741f8492521439056ba502343f682a4e86506dac4ff
Instruction Fuzzy Hash: 4651D131F80126DFCB64BBBCE5586ADB7B2FF84315F10886AE106DB250DB319955CB80

Function 06A2FA18 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd0f7cc68b22a1ae28dbb301d7b5c8c5fe9f843501faad3257fd3d11344e580f
Instruction ID: e04f4e81de432e0d6bb71e8790013ec8f98720ecfc00c30becfc79a78852cba0
Opcode Fuzzy Hash: bd0f7cc68b22a1ae28dbb301d7b5c8c5fe9f843501faad3257fd3d11344e580f
Instruction Fuzzy Hash: 6851B5B0BA02355FEF6467ACE85873F26AAD78D711F20442AE50ACB395CF2DCC815391

Function 06A25408 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0768a3ca04691b70a3fb73381907190ce667846881232e3aed9e76694a542b3
Instruction ID: 844cd99d262a772deaf07cdab669b482cf279d6d6b366fd8bf5cd69cbe7d6be6
Opcode Fuzzy Hash: b0768a3ca04691b70a3fb73381907190ce667846881232e3aed9e76694a542b3
Instruction Fuzzy Hash: E3412971E4061A9BDB60DFADD880AAFFBB2FB84310F10492AE11AD6650D731E9558B90

Function 06A2D950 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aca5ea89d08816cb7c4cbc5ce229e536848af5069b0bd411ea11f186ceb52da
Instruction ID: 52b203cb3bd64a64d4a0207d6fc7a31e93f83f0cf1d3cad78de92a65410167bf
Opcode Fuzzy Hash: 1aca5ea89d08816cb7c4cbc5ce229e536848af5069b0bd411ea11f186ceb52da
Instruction Fuzzy Hash: 1231C670E113269FCB14EF6CD9906DEBBB2FF85300F108929E405EB645DB71A846CB90

Function 06A22081 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecc3171a051b54221b165ff0c39662ea4996c74b1d15967f0139246f8ed4f8c2
Instruction ID: 0e9483ef7b3c2913e771fc154f4f6d94ff89c29e633279d648e5bee2f4d32018
Opcode Fuzzy Hash: ecc3171a051b54221b165ff0c39662ea4996c74b1d15967f0139246f8ed4f8c2
Instruction Fuzzy Hash: 7F31B434E102169BCB58DFA8D894B9EB7B2FF88300F508519E905EB350DB71AD81CB90

Function 06A22090 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98b25e1f08f4186a454d37996eea78593bae33ae2bbfa3a0a1eabe8144ecd53b
Instruction ID: a58d34aec5bef149f4d9c0267e29f5b3660768c5cd62d1b5e0792cb14c8a4898
Opcode Fuzzy Hash: 98b25e1f08f4186a454d37996eea78593bae33ae2bbfa3a0a1eabe8144ecd53b
Instruction Fuzzy Hash: 2531A434E102169BCB18DFA8D894B9EB7B2FF88300F508529E815EB354DB71AD81CB50

Function 06A23A80 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 006f47f8161d9bd7423d29d02b1c84bb93c6b12bd98b94b5fba3597e3b1ea9f4
Instruction ID: 0c7489f49f009aad8e3b5689ab20f7a56ee3a064dbe9506573be2f61115be59c
Opcode Fuzzy Hash: 006f47f8161d9bd7423d29d02b1c84bb93c6b12bd98b94b5fba3597e3b1ea9f4
Instruction Fuzzy Hash: C4219A36F402169FDF40CF69E980AEEBBF5EB49210F108025E905EB361D738DC418B90

Function 06A23A90 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4d20a22994bb0daf56b9470ba39d27cbbcb0f5c04a9ebac1b99d7ac8892b919
Instruction ID: fea8b602dec2211e904e177a2553757692a88e6b5ab3915ad9a0a916fdf2febf
Opcode Fuzzy Hash: f4d20a22994bb0daf56b9470ba39d27cbbcb0f5c04a9ebac1b99d7ac8892b919
Instruction Fuzzy Hash: 52218B35F012169FDF40DF6DE980AAEBBF1EB48610F108069E905EB354E739EC408B90

Function 012CD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2945307417.00000000012CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12cd000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2453ee90048592d19ed40c0ccd60242903d608088a433585a957bfd9f5afc0bc
Instruction ID: e86ac200cd5d773d4c730a74f565a5caf54fdc6b26d9f67b74f2c7a79579448f
Opcode Fuzzy Hash: 2453ee90048592d19ed40c0ccd60242903d608088a433585a957bfd9f5afc0bc
Instruction Fuzzy Hash: 06212571614208EFCB11DF58D9C0B26BBA5FB84714F24C67DDA0A0B242C377D407CAA1

Function 06A26D00 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bc8cf21f301d23d533373af794ee8dca474cae4a6f70121fe316c5beb3ddb77
Instruction ID: 4549382ed7d88942278cd3179e4ff000b040e054249a1f8f35354d758ef34cc0
Opcode Fuzzy Hash: 8bc8cf21f301d23d533373af794ee8dca474cae4a6f70121fe316c5beb3ddb77
Instruction Fuzzy Hash: E521B130F1112A9FDF84EB6DE8546AEBBF6EB84350F648469E405DB340DB35ED418B90

Function 06A253FA Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8e42b7412f4831030ca6ce99c3105a75b705291d581eb2affd9799175b8f972
Instruction ID: eebe4f15209366c0ed6ce531208ce637f760c2272e1cc51949fa95e1d4f7d6da
Opcode Fuzzy Hash: f8e42b7412f4831030ca6ce99c3105a75b705291d581eb2affd9799175b8f972
Instruction Fuzzy Hash: A7218E71E007169FCB24DFA9DDC5AAFFBB2FF88300F108929E11697654D730A8558B90

Function 06A23BA0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 327a1920e91d84a5bb66e2b62fa411f18c0f2d1bf91b17aee13cab8c7c2e5646
Instruction ID: ce34a0be87d1e667f1ad09f09d8f06923acc747ccf35f0c28bf7877f574ea7a8
Opcode Fuzzy Hash: 327a1920e91d84a5bb66e2b62fa411f18c0f2d1bf91b17aee13cab8c7c2e5646
Instruction Fuzzy Hash: FC11A531B141395FDF54AA7CD8146AE77AAEBC9611F00443AD40AEB344DE38DC024BD1

Function 06A23040 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33498d0eeab1b6d4d9e4b58bdb296d62ae6558f82f68af147c184f6dc9aaec0b
Instruction ID: 3638d03e35db6761451354b52666611e87a8928a29f1726ce6ef9af828c0c843
Opcode Fuzzy Hash: 33498d0eeab1b6d4d9e4b58bdb296d62ae6558f82f68af147c184f6dc9aaec0b
Instruction Fuzzy Hash: 4901A171E002299ACF58EB79D9405DEF7F6EF89310F108569D506EB304DA35DA40CBE0

Function 012CD02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2945307417.00000000012CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_12cd000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction ID: c0e05babe134a8606cdb42831829d5b9d8a847c9a924130fb7831167f92d9238
Opcode Fuzzy Hash: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction Fuzzy Hash: 7E11EE75504284CFCB12CF58C5C4B15BB71FB84314F24C6AEDA494B652C33BD40ACBA1

Function 06A23860 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c418dd1e5255bdfa77475522c3bc73fe5217a5ddd6b0f9bd3baab510ea8534d
Instruction ID: 287c76a86484d5a1ae4c63fe300dbf2bb467f4008d5577f9f540c3c7f5dddb0b
Opcode Fuzzy Hash: 6c418dd1e5255bdfa77475522c3bc73fe5217a5ddd6b0f9bd3baab510ea8534d
Instruction Fuzzy Hash: 9111AFB5D01259AFCB00DF9AD884ADEFBF8FB49310F10812AE918A7241D375A954CBA5

Function 06A2ED69 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b78f58907f7135247e067ca77fb7a05bdff9a4fd85aeaa80b41c3e0787050bde
Instruction ID: 55fe36d3b1089fe081aa9c3b1aa740f009e74d09533f8ad0ba8dcb53ee0d0809
Opcode Fuzzy Hash: b78f58907f7135247e067ca77fb7a05bdff9a4fd85aeaa80b41c3e0787050bde
Instruction Fuzzy Hash: 1C01F235B641215FDB64EB6C98A476E27D6EBC9220F14883AF40ECB345DE28DC424391

Function 06A23859 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 066bce198709ce6528de7d99bcbbbca52ab7855d52b83fae55f77f4b7f4f6b47
Instruction ID: 70b318b74f7cead8d5af73371f45f371e1f4301c3c58d96c5fe7285b26c16110
Opcode Fuzzy Hash: 066bce198709ce6528de7d99bcbbbca52ab7855d52b83fae55f77f4b7f4f6b47
Instruction Fuzzy Hash: CE21CEB5D01219AFCB00DF9AD985ADEFBB4FB48310F10822AE518A7241C374A554CFA4

Function 06A241E2 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13c3eee778d3fe2a246a6575dca0ac2340969358bb9bd46aad35a67c43c48012
Instruction ID: 03a41d7d4f8919113213f456f783d2e65879caff56fa5b9719dc561bd7d41470
Opcode Fuzzy Hash: 13c3eee778d3fe2a246a6575dca0ac2340969358bb9bd46aad35a67c43c48012
Instruction Fuzzy Hash: 4B01F2B1B101221FEBA0E6BDE85872FA3D6DBCC721F20846AE00ACB354ED25DC424390

Function 06A241F0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f61f62aa0adaa467cce052d53c667fc8d62b56c1580d71e26934da77bc2c0e48
Instruction ID: d013368c6e8e89e8e6f2c9da8485bf877288f6bfdac7c9197e5c2038d7a3d8dc
Opcode Fuzzy Hash: f61f62aa0adaa467cce052d53c667fc8d62b56c1580d71e26934da77bc2c0e48
Instruction Fuzzy Hash: DE018171B201221FDBA4A6AEE45476FB3DADBC9720F20843AF10ECB754DE65DC424791

Function 06A2A2F0 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52b55c81d32ebce0027a672880735778663dd88218a3d044285f6ee7ffc70aad
Instruction ID: 0f3308ea887b2a5141365b523e772c7ef3025e2b71b225b2c5d138925148ecd7
Opcode Fuzzy Hash: 52b55c81d32ebce0027a672880735778663dd88218a3d044285f6ee7ffc70aad
Instruction Fuzzy Hash: 99018F74B144219FDB64E76CA9A476EA7E5EB89710F10882AE20ECB390EE25DC418781

Function 06A2ED78 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9524011a8307416fd4ced44f7bb0861dc490456b25549ebf2c820a0a36ae4d49
Instruction ID: 2418ed20bf460078c807c42fa7bfda8852274013400293ab6ed46fc4791b5b02
Opcode Fuzzy Hash: 9524011a8307416fd4ced44f7bb0861dc490456b25549ebf2c820a0a36ae4d49
Instruction Fuzzy Hash: FA01AF35B241225FDBA8E66CA86476F67D6EBC9620F108839F10ECB344DE65DC4243D1

Function 06A23B8F Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 511e8357fd941ae3e81c3ffc610a8eff2a0c9c5c145f6d327fabd685c4887fbb
Instruction ID: 820531b7594a985e53bcd1f382a45c0dbdb73bb1eb9565cfe0b2ac7d46238f22
Opcode Fuzzy Hash: 511e8357fd941ae3e81c3ffc610a8eff2a0c9c5c145f6d327fabd685c4887fbb
Instruction Fuzzy Hash: 2301F732B1412A4BDF95AA7C98152AE77ABDBC8611F04403AC50AE7280EE289D0747D1

Function 06A2A300 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cee187995b079cb6efc6a37ca084536eaa7309f48fdd7bc661cc75c26723c970
Instruction ID: 9cf4193d1a4ec6a113e9616a1b604e8f685cab717c89e720f9a220e049ebc9d4
Opcode Fuzzy Hash: cee187995b079cb6efc6a37ca084536eaa7309f48fdd7bc661cc75c26723c970
Instruction Fuzzy Hash: D5018174B141215FDB64E66CE89476EB7D5EB89610F108829E60ECB354DE25EC018780

Function 06A2C7C0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9c8b361d16ed21831978d93787069338b20bca1fa87340ce238a3e51ae778fb
Instruction ID: bd1eaf22004e5fc8d97886d6e8d7fc950a99b8d1137fa3c29dc8f335f05514aa
Opcode Fuzzy Hash: d9c8b361d16ed21831978d93787069338b20bca1fa87340ce238a3e51ae778fb
Instruction Fuzzy Hash: 7B01A432F20235ABDB58AB6DF844ADE7775FB85324F508429E906EB340DB31AC158790

Function 06A26461 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c9a4b3a240d192ba9f47d5102148ead3ad89f7a723e6cbcc45d1515df707ff1
Instruction ID: f7c51f9f39816306ea48b250c54c82b139515bb5a3830647b5575da17d82b96f
Opcode Fuzzy Hash: 3c9a4b3a240d192ba9f47d5102148ead3ad89f7a723e6cbcc45d1515df707ff1
Instruction Fuzzy Hash: 9CE0D870D921159BDBA0EFB88B6535D37ABD742314F2089A5D444DF241E137CE018381

Function 06A26470 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3f40778c56a94cb1829351910999078a94cedfe7366333d70a95a28b265ea9a
Instruction ID: ad4c69f99fcec5e0eda53deb059fc66a1cb13caa41dde3a94672a2a184b3ee3f
Opcode Fuzzy Hash: a3f40778c56a94cb1829351910999078a94cedfe7366333d70a95a28b265ea9a
Instruction Fuzzy Hash: 83E01271E5211AABDF50EFB8CB5575A77ADD702214F2088A5D449DF201E576DE014780

Non-executed Functions

Function 06A27688 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$dq, xrefs: 06A27C18
$dq, xrefs: 06A277BC
$dq, xrefs: 06A27C3A
$dq, xrefs: 06A27B85
$dq, xrefs: 06A277ED
$dq, xrefs: 06A27B79
$dq, xrefs: 06A27C24
$dq, xrefs: 06A277C8
$dq, xrefs: 06A27C2E
$dq, xrefs: 06A277F9

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq
API String ID: 0-3623093008
Opcode ID: 31b6f223f2372b1fe0ca335d57445830a5a226f78fe29ec4b9ab103ae8c4340c
Instruction ID: d871a26252c5ec9c3e3903f513bcad95c9563332c6db0a34278a30595c47ed0a
Opcode Fuzzy Hash: 31b6f223f2372b1fe0ca335d57445830a5a226f78fe29ec4b9ab103ae8c4340c
Instruction Fuzzy Hash: DB12FD70E0122A8FDB64EF69D95469EB7B2FF88301F208569D40AAB355DB30DE45CF90

Function 06A2A920 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$dq, xrefs: 06A2AA22
$dq, xrefs: 06A2AA71
$dq, xrefs: 06A2AAD2
$dq, xrefs: 06A2AA7D
$dq, xrefs: 06A2AA9C
$dq, xrefs: 06A2AADE
$dq, xrefs: 06A2AA16
$dq, xrefs: 06A2AAA8

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq
API String ID: 0-634254105
Opcode ID: 2c15ee5acaa1b4bda8df51a1ad2f1f662a562a34f9709a093be872ce2625d3f5
Instruction ID: 1afdfaa25225e0d8e5889df9fbe2481badaf233119549f8d305a31910d1de8fb
Opcode Fuzzy Hash: 2c15ee5acaa1b4bda8df51a1ad2f1f662a562a34f9709a093be872ce2625d3f5
Instruction Fuzzy Hash: FC91A130A4022ADFDB58EF69D9547AEB7F2FF44301F108529D5069B391DB34AD41CB90

Function 06A27088 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$dq, xrefs: 06A273C4
$dq, xrefs: 06A2759C
$dq, xrefs: 06A273D0
.5|q, xrefs: 06A270E3
$dq, xrefs: 06A2736A
$dq, xrefs: 06A27524
$dq, xrefs: 06A27590

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID: .5|q$$dq$$dq$$dq$$dq$$dq$$dq
API String ID: 0-3447281907
Opcode ID: 77c080646072a35d602c5248267fdf0c6ed6a9ec75ab4415f9f02fa88d3c9a95
Instruction ID: f070b08be428d07aef8bb5dd68e9b09e6e3e6d4db64ccb8ccfdb5d81192e49c9
Opcode Fuzzy Hash: 77c080646072a35d602c5248267fdf0c6ed6a9ec75ab4415f9f02fa88d3c9a95
Instruction Fuzzy Hash: 79F14B70B01219CFDB59EB69D494A6EBBB2FF88341F248568D4069B394CB35ED42CB90

Function 06A283C0 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$dq, xrefs: 06A28626
$dq, xrefs: 06A2861A
$dq, xrefs: 06A2867F
$dq, xrefs: 06A2868B

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq$$dq
API String ID: 0-185584874
Opcode ID: 58e1c055d79fc97b708e461fa9c91908e96ee9cc84393669bb1d9ba376f9b042
Instruction ID: 8d4394291fe8073f0aa6edcb500ee554449475b2ff090704e1bb1069e264710e
Opcode Fuzzy Hash: 58e1c055d79fc97b708e461fa9c91908e96ee9cc84393669bb1d9ba376f9b042
Instruction Fuzzy Hash: C0B13E30B10229CFDB54EB69D59469EB7B2FF88301F248429E406DB394DB38DC86CB90

Function 06A287D8 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$dq, xrefs: 06A28863
LRdq, xrefs: 06A288CB
LRdq, xrefs: 06A2891A
$dq, xrefs: 06A28857

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID: LRdq$LRdq$$dq$$dq
API String ID: 0-340319088
Opcode ID: 70b677786aaab66f3e7b414dba7b6d43bd41c3ab76b27719fb447ab569245fe6
Instruction ID: 6e867a26b911ff1c55bda706beac2b5035a9818923700aacb65bfa31e0620fe0
Opcode Fuzzy Hash: 70b677786aaab66f3e7b414dba7b6d43bd41c3ab76b27719fb447ab569245fe6
Instruction Fuzzy Hash: 0D51A030B002269FDB58EB2DD994A6EB7F2FF89300F148569E4069F395DA34EC45CB91

Function 06A2ACAB Relevance: 5.2, Strings: 4, Instructions: 158COMMON

Download Yara Rule

Strings

$dq, xrefs: 06A2AE2C
$dq, xrefs: 06A2AE5B
$dq, xrefs: 06A2ADD9
$dq, xrefs: 06A2AE84

Memory Dump Source

Source File: 00000004.00000002.2950089285.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a20000_CasPol.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq$$dq
API String ID: 0-185584874
Opcode ID: 8b55d22f1c5a321570ec245249b9e6c6089608108be757f4d74513e819560b83
Instruction ID: b1d083488dda69769dbcf351a77465d89507214038880133890c466a65611a66
Opcode Fuzzy Hash: 8b55d22f1c5a321570ec245249b9e6c6089608108be757f4d74513e819560b83
Instruction Fuzzy Hash: E6518030F502269FDB65EB6CE9806AEB7F2EF89211F14452AD906DB354DB34DC42CB90

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Bill_Of _Lading.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Bill_Of _Lading._d5a6bc31333ed2731238387cca9c2baed124745_111ed6a7_b97e09e4-30ca-4144-a8f1-17b94789fc12\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5691.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5886.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER58D5.tmp.xml

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1w10vwtz.wqg.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3kjuxhrd.arq.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dvfrzyx5.k1x.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sux4zclx.ilm.psm1

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
Bill_Of _Lading.exe

Function 00007FFD9BA50002 Relevance: 2.3, Instructions: 2265
COMMON

Function 00007FFD9B988550 Relevance: 2.2, Strings: 1, Instructions: 922
COMMON

Function 00007FFD9B983508 Relevance: 1.8, Strings: 1, Instructions: 566
COMMON

Function 00007FFD9B983495 Relevance: 1.8, Strings: 1, Instructions: 506
COMMON

Function 00007FFD9B98757B Relevance: 1.7, APIs: 1, Instructions: 204
COMMON

Function 00007FFD9B981FEA Relevance: 1.6, APIs: 1, Instructions: 141
memoryCOMMON

Function 00007FFD9B9808B9 Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Function 00007FFD9B980493 Relevance: 1.6, APIs: 1, Instructions: 90
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre