Edit tour

Windows Analysis Report
reup.exe

Overview

General Information

Sample name:	reup.exe
Analysis ID:	1545842
MD5:	30fd08b6909e7c61ab934da1c9bb8e40
SHA1:	26f97535f923195475166c3fa7bc197aced503a4
SHA256:	63aa7252e7e0fb3da2dad75515190be17087dd67b592d3f6212a9e8f9825ab01
Tags:	exeuser-lontze7
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Found direct / indirect Syscall (likely to bypass EDR)

Machine Learning detection for sample

AV process strings found (often used to terminate AV products)

Contains functionality to call native functions

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

One or more processes crash

PE file contains more sections than normal

PE file contains sections with non-standard names

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

reup.exe (PID: 7384 cmdline: "C:\Users\user\Desktop\reup.exe" MD5: 30FD08B6909E7C61AB934DA1C9BB8E40)

WerFault.exe (PID: 7552 cmdline: C:\Windows\system32\WerFault.exe -u -p 7384 -s 240 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: reup.exe	ReversingLabs: Detection: 28%
Source: reup.exe	Virustotal: Detection: 30%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.4% probability

Machine Learning detection for sample

Source: reup.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\reup.exe	Code function: 0_2_00007FF7F05E14CB CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptDeriveKey,CryptDecrypt,CryptReleaseContext,CryptDestroyHash,CryptDestroyKey,	0_2_00007FF7F05E14CB
Source: C:\Users\user\Desktop\reup.exe	Code function: 0_2_00007FF7F05F3290 CryptDeriveKey,	0_2_00007FF7F05F3290
Source: C:\Users\user\Desktop\reup.exe	Code function: 0_2_00007FF7F05F32A8 CryptHashData,	0_2_00007FF7F05F32A8

Source: reup.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\reup.exe	Code function: 4x nop then sub rsp, 58h		0_2_00007FF7F05E1A80
Source: C:\Users\user\Desktop\reup.exe	Code function: 4x nop then push rbx		0_2_00007FF7F05E1E24

Source: Amcache.hve.4.dr

String found in binary or memory: http://upx.sf.net

Source: C:\Users\user\Desktop\reup.exe

Code function: 0_2_00007FF7F05E7E10 FreeConsole,GetModuleHandleA,GetModuleHandleA,VirtualAlloc,Sleep,SleepEx,GetModuleHandleA,GetCurrentProcess,GetCurrentProcess,WriteProcessMemory,GetCurrentProcess,NtProtectVirtualMemory,GetModuleHandleA,GetCurrentThread,NtQueueApcThread,

0_2_00007FF7F05E7E10

Source: C:\Users\user\Desktop\reup.exe	Code function: 0_2_00007FF7F05E4FF0		0_2_00007FF7F05E4FF0
Source: C:\Users\user\Desktop\reup.exe	Code function: 0_2_00007FF7F05E3DF0		0_2_00007FF7F05E3DF0

Source: C:\Users\user\Desktop\reup.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7384 -s 240

Source: reup.exe

Static PE information: Number of sections : 20 > 10

Source: classification engine

Classification label: mal60.evad.winEXE@2/5@0/0

Source: C:\Windows\System32\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7384

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\4c442b6f-c67d-4627-8e59-968eb6e033ab

Jump to behavior

Source: reup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\reup.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: reup.exe	ReversingLabs: Detection: 28%
Source: reup.exe	Virustotal: Detection: 30%

Source: unknown	Process created: C:\Users\user\Desktop\reup.exe "C:\Users\user\Desktop\reup.exe"
Source: C:\Users\user\Desktop\reup.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7384 -s 240

Source: C:\Users\user\Desktop\reup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\reup.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\reup.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\reup.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: reup.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: reup.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: reup.exe	Static PE information: section name: .xdata
Source: reup.exe	Static PE information: section name: /4
Source: reup.exe	Static PE information: section name: /19
Source: reup.exe	Static PE information: section name: /31
Source: reup.exe	Static PE information: section name: /45
Source: reup.exe	Static PE information: section name: /57
Source: reup.exe	Static PE information: section name: /70
Source: reup.exe	Static PE information: section name: /81
Source: reup.exe	Static PE information: section name: /97
Source: reup.exe	Static PE information: section name: /113

Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware-42 27 c7 3b 45 a3 e4 a4-61 bc 19 7c 28 5c 10 19
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\reup.exe

Code function: 0_2_00007FF7F05E1180 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_initterm,

0_2_00007FF7F05E1180

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\reup.exe

NtProtectVirtualMemory: Indirect: 0x7FF7F05E7F6C

Jump to behavior

Source: C:\Users\user\Desktop\reup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Process Injection	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	1 Abuse Elevation Control Mechanism	LSASS Memory	2 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 DLL Side-Loading	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Link
reup.exe	29%	ReversingLabs
reup.exe	31%	Virustotal	Browse
reup.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.4.dr	false	URL Reputation: safe URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545842
Start date and time:	2024-10-31 06:48:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	reup.exe
Detection:	MAL
Classification:	mal60.evad.winEXE@2/5@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 3 Number of non-executed functions: 17
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
01:49:04	API Interceptor	1x Sleep call for process: WerFault.exe modified

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_reup.exe_c4144ddf6f397eebaa24f1e81185ec95be2cdb_160b166d_3001f786-4fd1-4962-a087-70279a89038a\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6945482826442844
Encrypted:	false
SSDEEP:	96:xsFLNnbBbRs/hTod7JfUQXIDcQqc6mcEKcw34e4Jd+HbHg/opAnQsZnRmZAX/d5M:GrhRP0kigMJJ6jCzuiFlZ24lO81i
MD5:	62DBBC6AC23D88A2D2E20C973B91605F
SHA1:	933A4EF690F1356A3253647A129C7332CE7E12D6
SHA-256:	AFC08398A79FBCEC379D45167FB04E15B824C3DF4D336FE161522EBAF180E680
SHA-512:	EBC1B9316B4086EFA561EF5ED6EEE7B5B3EF0AEFADE6DF36A42E5E113C79258A99BA7FC948706DDE892F573A69193831D22B352F4816BD3364B8F09ABCC55DE4
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.8.2.7.3.3.9.6.2.4.2.1.0.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.8.2.7.3.4.0.0.3.0.4.5.8.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.0.0.1.f.7.8.6.-.4.f.d.1.-.4.9.6.2.-.a.0.8.7.-.7.0.2.7.9.a.8.9.0.3.8.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.5.b.b.0.b.2.4.-.f.f.8.7.-.4.f.2.1.-.a.7.4.c.-.a.f.8.4.3.7.f.8.b.a.6.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.e.u.p...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.d.8.-.0.0.0.1.-.0.0.1.4.-.6.9.d.9.-.2.0.9.3.5.8.2.b.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.f.a.7.0.0.0.5.7.6.3.e.e.c.d.a.c.4.2.1.6.9.d.0.1.2.a.d.f.b.3.e.0.0.0.0.f.f.f.f.!.0.0.0.0.2.6.f.9.7.5.3.5.f.9.2.3.1.9.5.4.7.5.1.6.6.c.3.f.a.7.b.c.1.9.7.a.c.e.d.5.0.3.a.4.!.r.e.u.p...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.0././.2.9.:.1.7.:.4.7.:.0.8.!.5.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD0F5.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Oct 31 05:48:59 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	68029
Entropy (8bit):	1.482221170888909
Encrypted:	false
SSDEEP:	192:FVU2b/NUlO6I3O5SUZnBu+ShpppESOR4SSKc:/zUI6I3oSULkxORVSp
MD5:	1EABAA83AD66C6EF7941392EA98C1C78
SHA1:	AA85FD3B7FB023FC28A2E1B9BE70B7D6349E2059
SHA-256:	2D4EEDAB21D1356AF28124177B458B42526274222578720BB117400698785547
SHA-512:	7C5BE136F82FE4228E3C84876A74144020CB93BCF83B591E9CE40566C2BA9F4C9551A52B9E9603746E46EFF5D42D726E32625ABF6FF01D495CF7BE64871C9C63
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......K.#g.........................................$..........T.......8...........T.......................................t...............................................................................eJ..............Lw......................T...........H.#g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD182.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8538
Entropy (8bit):	3.7015144529425097
Encrypted:	false
SSDEEP:	192:R6l7wVeJKWgsF6YcDROS2jgmfpb4bhpDa89bYrCfi4Im:R6lXJEsF6YmOS2jgmf1EYufiO
MD5:	FE61E8E66A8F9B86237E53349F7319E5
SHA1:	974E5D5533F5B448AF97B60C539733B9FF85CD25
SHA-256:	E2A45FF26F5F427C4780347E0351B58B620ED488088CA407AA16A765B06377B1
SHA-512:	75F3CD6F5BF896BA7AC11250B8C582061ED654F0EA061DFA3D03C619883519FDBAF3B9C363F355B819C9F4793D8230194B2A77073E6D870955EE5E85C28962DD
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.8.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD1C2.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4655
Entropy (8bit):	4.473018487448725
Encrypted:	false
SSDEEP:	48:cvIwWl8zsdJg771I9fkWpW8VYLYm8M4JEEOKFtryq85l/Oxm0JAuKXd:uIjf3I7A97VXJlt0KmFuKXd
MD5:	5D93BF7270ED60804251683574B1F73A
SHA1:	86D803FB25F3BD0283CD6F070547D242F7876CA1
SHA-256:	C1141405CA796AC95853844464E0705DF4817D7F30CE70C3A7D9A6559B933C58
SHA-512:	33FA3976F0517F5E5A2F7C991FB0A5D84E1D46D5B2048A3BDCA229EF893E9FC5856C974D04AFD0FC5B26F6533975FCFE8F3A1C6933978BDAAE3A07BCFBD72F00
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="567171" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.393800889715689
Encrypted:	false
SSDEEP:	6144:+l4fiJoH0ncNXiUjt10q0G/gaocYGBoaUMMhA2NX4WABlBuNA4OBSqa:+4vF0MYQUMM6VFYS4U
MD5:	C9BCBE0CA7D082ACC351625709BC63F1
SHA1:	DBA35C4640A7ADC47F64C417108E17CF55E966DB
SHA-256:	36FB8F80BB6593C5D129838F241FABB0335960CF0D6A8A484D1B523E30FE9AB9
SHA-512:	2FC2B3DAA7B8D292FECB856F0779CD871AC9A58908B83C3AE5491B40547A1E6D92BEF22EA242A30BE37C63A371ADF516CC831938CCCDC002F146E095433E79A8
Malicious:	false
Reputation:	low
Preview:	regfG...G....\.Z.................... ....`......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.y..X+..............................................................................................................................................................................................................................................................................................................................................`X..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.124123890938614
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	reup.exe
File size:	338'318 bytes
MD5:	30fd08b6909e7c61ab934da1c9bb8e40
SHA1:	26f97535f923195475166c3fa7bc197aced503a4
SHA256:	63aa7252e7e0fb3da2dad75515190be17087dd67b592d3f6212a9e8f9825ab01
SHA512:	17dbfeee669fd54a7d2b01b5e17d1575aa347959f200548abb8767422b6dcd42b44232a5599ba6d039fd81118a825ab4da0054dec48a5ded2228cd95338093b4
SSDEEP:	3072:cbXCXysrkPMZ3zzsYL134BXg/BMVrbQRSbAJAQx418PWZ8m1Xf+QYE+ultEkIhRa:NXPY6z4Yd42iyRS0dJB0
TLSH:	F0745C82B7849CD6DD04473688AB836D2734EE9016C247235A347E763D27ED0AEBE536
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....!g.z..).....&....+.r.....................@.............................P............`... ............................

File Icon


Icon Hash:	8b8bcd4d4466661c

Static PE Info

General

Entrypoint:	0x1400013d0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x67211F9C [Tue Oct 29 17:47:08 2024 UTC]
TLS Callbacks:	0x400016f0, 0x1, 0x400016c0, 0x1
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	a46365168056a76c08378ce735e03699

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [0000E1C5h]
mov dword ptr [eax], 00000001h
call 00007FDC14BCB04Fh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [0000E1A5h]
mov dword ptr [eax], 00000000h
call 00007FDC14BCB02Fh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
call 00007FDC14BD1AECh
dec eax
cmp eax, 01h
sbb eax, eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007FDC14BCB289h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc ecx
push ebp
inc ecx
push esp
push ebp
push edi
push esi
push ebx
dec eax
sub esp, 28h
xor esi, esi
dec eax
arpl word ptr [ecx+3Ch], ax
mov edi, dword ptr [ecx+eax+00000088h]
dec eax
add edi, ecx
dec eax
mov ebx, ecx
dec eax
mov ebp, edx
inc esp
mov esp, dword ptr [edi+20h]
inc esp
mov ebp, dword ptr [edi+18h]
dec ecx
add esp, ecx
inc esp
cmp esi, ebp
jnc 00007FDC14BCB2ECh
inc ecx
mov edx, dword ptr [esp+esi*4]
dec eax
mov ecx, ebp
dec eax
add edx, ebx
call 00007FDC14BD1AE4h
mov edx, eax
dec eax
lea eax, dword ptr [esi+01h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x13000	0x978	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x16000	0x108f0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x10000	0x48c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x27000	0x8c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xee60	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x13278	0x210	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x7030	0x7200	81983784d0054ca9fb1979b1b4caf690	False	0.5813802083333334	data	6.255832411504136	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x9000	0x170	0x200	e902d00d7502b1b486746406be430f7d	False	0.357421875	data	2.464444533067383	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xa000	0x5bc0	0x5c00	f8b980a7fce7ec5352f907df92d4df6c	False	0.8996688179347826	data	7.796645638561551	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pdata	0x10000	0x48c	0x600	5c29d5c83664633b4feeca808c7ffe13	False	0.423828125	data	3.7078689033535497	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xdata	0x11000	0x460	0x600	be96f61e42302debf9c91901ce63c3e6	False	0.2766927083333333	data	3.596735019069027	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x12000	0xb80	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x13000	0x978	0xa00	21f6af842212d313e208ef549ac743a6	False	0.34765625	data	4.23874734634815	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x14000	0x60	0x200	52ba692cfc960d61d99b93747e9721f1	False	0.068359375	data	0.28655982431271465	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x15000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x16000	0x108f0	0x10a00	30d59ffdbef6f726d68665616d41b299	False	0.12379581766917293	data	4.99054537026602	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x27000	0x8c	0x200	4085b2e7905e34335884376f6395367a	False	0.259765625	data	1.6148727460268462	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/4	0x28000	0x620	0x800	d5ce403f3eafadd81cbc7e429e757867	False	0.181640625	data	1.468706124286173	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/19	0x29000	0x1207c	0x12200	48ea14599ea1f17141fac03ca2bceb1b	False	0.42386853448275863	data	5.787988171783133	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/31	0x3c000	0x321c	0x3400	335de062d2872a1053913069789fc304	False	0.24466646634615385	data	4.77587302511516	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/45	0x40000	0x6d6d	0x6e00	53872e9d9f24b640d1da85807a63476a	False	0.5143110795454545	data	5.052045464909125	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/57	0x47000	0x16c0	0x1800	c8b523cc2417521af7c60fa104f9ed9c	False	0.2882486979166667	data	4.427054931057493	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/70	0x49000	0x39d	0x400	7525f1145b47b06d73d7667bb1386b5f	False	0.435546875	data	4.6233906248986	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/81	0x4a000	0x15fa	0x1600	b15394a328eca738bc353b3ca53f2a1e	False	0.16352982954545456	data	4.685680000488948	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/97	0x4c000	0x7825	0x7a00	7abc4e0c6ce7709f237d68a1f4ee8b42	False	0.5157210553278688	data	5.811377309786459	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/113	0x54000	0x52b	0x600	c8f735d4379e14fc5ae61b34491dffc7	False	0.63671875	data	5.310144103808594	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x160b0	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	English	United States	0.12324026972672424
RT_GROUP_ICON	0x268d8	0x14	data	English	United States	1.15

Imports

DLL	Import
ADVAPI32.dll	CryptAcquireContextW, CryptCreateHash, CryptDecrypt, CryptDeriveKey, CryptDestroyHash, CryptDestroyKey, CryptHashData, CryptReleaseContext
KERNEL32.dll	DeleteCriticalSection, EnterCriticalSection, FreeConsole, GetCurrentProcess, GetCurrentThread, GetLastError, GetModuleHandleA, InitializeCriticalSection, IsDBCSLeadByteEx, LeaveCriticalSection, MultiByteToWideChar, SetUnhandledExceptionFilter, Sleep, TlsGetValue, VirtualAlloc, VirtualProtect, VirtualQuery, WideCharToMultiByte
msvcrt.dll	__C_specific_handler, ___lc_codepage_func, ___mb_cur_max_func, __getmainargs, __initenv, __iob_func, __set_app_type, __setusermatherr, _amsg_exit, _cexit, _commode, _errno, _fmode, _initterm, _lock, _onexit, _unlock, abort, calloc, exit, fprintf, fputc, free, fwrite, localeconv, malloc, memcpy, memset, signal, strcmp, strerror, strlen, strncmp, vfprintf, wcslen
ntdll.dll	NtProtectVirtualMemory

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	01:48:56
Start date:	31/10/2024
Path:	C:\Users\user\Desktop\reup.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\reup.exe"
Imagebase:	0x7ff7f05e0000
File size:	338'318 bytes
MD5 hash:	30FD08B6909E7C61AB934DA1C9BB8E40
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:48:59
Start date:	31/10/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7384 -s 240
Imagebase:	0x7ff7c2670000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	15.6%
Total number of Nodes:	570
Total number of Limit Nodes:	2

Executed Functions

Function 00007FF7F05E7E10 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 109
nativethreadsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNEL32 ref: 00007FF7F05E7E73
GetModuleHandleA.KERNEL32(-00000008,00000001,?), ref: 00007FF7F05E7E83

Part of subcall function 00007FF7F05E1450: strcmp.MSVCRT ref: 00007FF7F05E148C

Part of subcall function 00007FF7F05E14CB: CryptAcquireContextW.ADVAPI32 ref: 00007FF7F05E14F7

VirtualAlloc.KERNEL32 ref: 00007FF7F05E7EDE
Sleep.KERNEL32 ref: 00007FF7F05E7EEE
GetModuleHandleA.KERNEL32 ref: 00007FF7F05E7EFB
GetCurrentProcess.KERNEL32 ref: 00007FF7F05E7F21
WriteProcessMemory.KERNELBASE ref: 00007FF7F05E7F3A
GetCurrentProcess.KERNEL32 ref: 00007FF7F05E7F47
NtProtectVirtualMemory.NTDLL ref: 00007FF7F05E7F67
GetModuleHandleA.KERNEL32 ref: 00007FF7F05E7F74
GetCurrentThread.KERNEL32 ref: 00007FF7F05E7F8E
NtQueueApcThread.NTDLL ref: 00007FF7F05E7FA7

Strings

ntdll.dll, xrefs: 00007FF7F05E7E29
NtTestAlert, xrefs: 00007FF7F05E7E86
Data decryption failed, xrefs: 00007FF7F05E7EB5
kernel32.dll, xrefs: 00007FF7F05E7EF4
WriteProcessMemory, xrefs: 00007FF7F05E7EFE
NtQueueApcThread, xrefs: 00007FF7F05E7F77

Memory Dump Source

Source File: 00000000.00000002.1411402789.00007FF7F05E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F05E0000, based on PE: true

Associated: 00000000.00000002.1411380882.00007FF7F05E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411421340.00007FF7F05E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411441520.00007FF7F05EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411457671.00007FF7F05F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F05F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F0606000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F061C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f05e0000_reup.jbxd

Similarity

API ID: CurrentHandleModuleProcess$MemoryThreadVirtual$AcquireAllocConsoleContextCryptFreeProtectQueueSleepWritestrcmp
String ID: Data decryption failed$NtQueueApcThread$NtTestAlert$WriteProcessMemory$kernel32.dll$ntdll.dll
API String ID: 416474137-3137615674
Opcode ID: 229d6fc247ab7d4ce4a5b5db93f96d95b52fed5b2a74bd24de551488d26e7f98
Instruction ID: 027d862cfd832c4bb189d8f591360b354babca98be1168b57194a8da064ad10b
Opcode Fuzzy Hash: 229d6fc247ab7d4ce4a5b5db93f96d95b52fed5b2a74bd24de551488d26e7f98
Instruction Fuzzy Hash: EE416F75B19A4241EB10EB11F804AAAA3A1BB847C4F804435EEAE07BD4DEBCE546C795

Function 00007FF7F05E14CB Relevance: 12.1, APIs: 8, Instructions: 66
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32 ref: 00007FF7F05E14F7
CryptCreateHash.ADVAPI32 ref: 00007FF7F05E1523
CryptHashData.ADVAPI32 ref: 00007FF7F05E153B
CryptDeriveKey.ADVAPI32 ref: 00007FF7F05E1561
CryptDecrypt.ADVAPI32 ref: 00007FF7F05E1587
CryptReleaseContext.ADVAPI32 ref: 00007FF7F05E159C
CryptDestroyHash.ADVAPI32 ref: 00007FF7F05E15A7
CryptDestroyKey.ADVAPI32 ref: 00007FF7F05E15B2

Memory Dump Source

Source File: 00000000.00000002.1411402789.00007FF7F05E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F05E0000, based on PE: true

Associated: 00000000.00000002.1411380882.00007FF7F05E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411421340.00007FF7F05E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411441520.00007FF7F05EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411457671.00007FF7F05F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F05F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F0606000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F061C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f05e0000_reup.jbxd

Similarity

API ID: Crypt$Hash$ContextDestroy$AcquireCreateDataDecryptDeriveRelease
String ID:
API String ID: 1089615719-0
Opcode ID: 304eee59d264ed6e1a47fb55f276d38f3e8d3918458381701061066960d2e41e
Instruction ID: 2fe8b2ffc20b65dae6f85803f2ec1413a0ada94cf1d1bc5dd1e8992847a17529
Opcode Fuzzy Hash: 304eee59d264ed6e1a47fb55f276d38f3e8d3918458381701061066960d2e41e
Instruction Fuzzy Hash: 4721B93570894185FB509F61F844E2BA7A0FBC5B91F944131EA9E87BA4DF3DD0408B50

Function 00007FF7F05E1180 Relevance: 10.6, APIs: 7, Instructions: 138
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,00007FF7F05E13E6), ref: 00007FF7F05E11BE
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7F05E122F
malloc.MSVCRT ref: 00007FF7F05E1263
strlen.MSVCRT ref: 00007FF7F05E1284
malloc.MSVCRT ref: 00007FF7F05E1290
memcpy.MSVCRT ref: 00007FF7F05E12A8

Memory Dump Source

Source File: 00000000.00000002.1411402789.00007FF7F05E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F05E0000, based on PE: true

Associated: 00000000.00000002.1411380882.00007FF7F05E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411421340.00007FF7F05E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411441520.00007FF7F05EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411457671.00007FF7F05F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F05F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F0606000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F061C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f05e0000_reup.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandledmemcpystrlen
String ID:
API String ID: 3806033187-0
Opcode ID: be1463fdfd596bcdd2fc5144fc7cfc53a048e2afbdd7c39a6ad9add1e5ef1454
Instruction ID: 3141615b3b80ef0d2904dca213717c3caa36f0ef712ed1f833d0904eb9a77593
Opcode Fuzzy Hash: be1463fdfd596bcdd2fc5144fc7cfc53a048e2afbdd7c39a6ad9add1e5ef1454
Instruction Fuzzy Hash: 4F518D36F0860286FB10BF15E844E79A3A5AF84780F944431CABD473D1DEACF840C3A6

Non-executed Functions

Function 00007FF7F05E4FF0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 1390COMMON

Download Yara Rule

Strings

, xrefs: 00007FF7F05E6495
Infinity, xrefs: 00007FF7F05E5320
NaN, xrefs: 00007FF7F05E529F
, xrefs: 00007FF7F05E6727

Memory Dump Source

Source File: 00000000.00000002.1411402789.00007FF7F05E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F05E0000, based on PE: true

Associated: 00000000.00000002.1411380882.00007FF7F05E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411421340.00007FF7F05E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411441520.00007FF7F05EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411457671.00007FF7F05F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F05F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F0606000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F061C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f05e0000_reup.jbxd

Similarity

API ID:
String ID: $ $Infinity$NaN
API String ID: 0-3274152445
Opcode ID: 3651d51e860882d26989f330b52fe57ec2d765ad09fe8574cc91e30b53bd889f
Instruction ID: 584cd2c7fc85e2db7ad50bd8249239e1b8fe64e01cb8ec5531e1f366608fefac
Opcode Fuzzy Hash: 3651d51e860882d26989f330b52fe57ec2d765ad09fe8574cc91e30b53bd889f
Instruction Fuzzy Hash: 99D2C632A1C2818BEB619F25A050B6AF791FB857C0F944135EADA43BC5DB7CF4408F91

Function 00007FF7F05E1A80 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 232
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Unknown pseudo relocation protocol version %d., xrefs: 00007FF7F05E1DD0
%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p., xrefs: 00007FF7F05E1C0D
Unknown pseudo relocation bit size %d., xrefs: 00007FF7F05E1DC4

Memory Dump Source

Source File: 00000000.00000002.1411402789.00007FF7F05E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F05E0000, based on PE: true

Associated: 00000000.00000002.1411380882.00007FF7F05E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411421340.00007FF7F05E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411441520.00007FF7F05EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411457671.00007FF7F05F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F05F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F0606000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F061C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f05e0000_reup.jbxd

Similarity

API ID:
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.
API String ID: 0-1286557213
Opcode ID: 707b814e65c0927c0a939c08ff902a35765f6cb4c7a5ff95b79a0d1a94518205
Instruction ID: 8eeccd7bc96d800bed204e7032533486753320442e0ef3b219a3b8caaff3fd86
Opcode Fuzzy Hash: 707b814e65c0927c0a939c08ff902a35765f6cb4c7a5ff95b79a0d1a94518205
Instruction Fuzzy Hash: F391D632F4950286EF106B24D900E79A3A1BF557A4F948231CDBD577C8DEACF84287A6

Function 00007FF7F05E1E24 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

signal.MSVCRT ref: 00007FF7F05E1EE2

Strings

CCG , xrefs: 00007FF7F05E1E45

Memory Dump Source

Source File: 00000000.00000002.1411402789.00007FF7F05E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F05E0000, based on PE: true

Associated: 00000000.00000002.1411380882.00007FF7F05E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411421340.00007FF7F05E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411441520.00007FF7F05EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411457671.00007FF7F05F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F05F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F0606000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F061C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f05e0000_reup.jbxd

Similarity

API ID: signal
String ID: CCG
API String ID: 1946981877-1584390748
Opcode ID: 38cbdb9df70b0cd2d1d4d15e3cebddffd7a42ec4d9567ac10add89b971a3a6c2
Instruction ID: 8f2ad83dc5173049eed0477ef836c9618ac32978cf3b346a19314db833089e19
Opcode Fuzzy Hash: 38cbdb9df70b0cd2d1d4d15e3cebddffd7a42ec4d9567ac10add89b971a3a6c2
Instruction Fuzzy Hash: 84218B31E0C10646FF6836648450B7D96868F49394FA88936D9BE833D5CE9CF88182FB

Function 00007FF7F05E3DF0 Relevance: 1.6, Strings: 1, Instructions: 303COMMON

Download Yara Rule

Strings

., xrefs: 00007FF7F05E3F50

Memory Dump Source

Source File: 00000000.00000002.1411402789.00007FF7F05E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F05E0000, based on PE: true

Associated: 00000000.00000002.1411380882.00007FF7F05E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411421340.00007FF7F05E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411441520.00007FF7F05EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411457671.00007FF7F05F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F05F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F0606000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F061C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f05e0000_reup.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: b1cc8295f4589949e1a95339fcec62e27a85a0d60d03e1e284163e2cea26f545
Instruction ID: 31aa804ff684227aaaf65cb379ec87abe76692b0400db746388ad54bd1f7cc03
Opcode Fuzzy Hash: b1cc8295f4589949e1a95339fcec62e27a85a0d60d03e1e284163e2cea26f545
Instruction Fuzzy Hash: ECB1EB22E1C24346F7696E259518F79E651EF40B84F848134DEAE4B7C8DEECF940C7A2

Function 00007FF7F05F32A8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411457671.00007FF7F05F3000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF7F05E0000, based on PE: true

Associated: 00000000.00000002.1411380882.00007FF7F05E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411402789.00007FF7F05E1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411421340.00007FF7F05E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411441520.00007FF7F05EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F05F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F0606000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F061C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f05e0000_reup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92fdf99e67d50528087659c48e7e8a2ee44962eb579421a8b013c99af0864db5
Instruction ID: 8de46a081db9d539fd4417dd8fd0a86d8bbf63e118996209ca49364ba155e0ac
Opcode Fuzzy Hash: 92fdf99e67d50528087659c48e7e8a2ee44962eb579421a8b013c99af0864db5
Instruction Fuzzy Hash: 33E0B65B90EAC50EF7531B381D6686C6F709BA2B51B8DC0A7C7E48B3C3D94D29099371

Function 00007FF7F05F3290 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411457671.00007FF7F05F3000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF7F05E0000, based on PE: true

Associated: 00000000.00000002.1411380882.00007FF7F05E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411402789.00007FF7F05E1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411421340.00007FF7F05E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411441520.00007FF7F05EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F05F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F0606000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F061C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f05e0000_reup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd39d028e5a834b95e695ac6a8485020f0a5d4ac7b08371110a5aec9f50fa8cb
Instruction ID: 7314d98a0897bd1b32a502bf90e588466c856466513b64d20da8e0dc1ae8396a
Opcode Fuzzy Hash: cd39d028e5a834b95e695ac6a8485020f0a5d4ac7b08371110a5aec9f50fa8cb
Instruction Fuzzy Hash: 2DD0C76FC0D4851DF7516A3816968685F50DB51792B884134C7B44F3C1A55E3A165260

Function 00007FF7F05E18A0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 00007FF7F05E19BB

Strings

VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF7F05E1A51
Address %p has no image-section, xrefs: 00007FF7F05E1912, 00007FF7F05E1A65
VirtualProtect failed with code 0x%x, xrefs: 00007FF7F05E1A2E
Mingw-w64 runtime failure:, xrefs: 00007FF7F05E18D7

Memory Dump Source

Source File: 00000000.00000002.1411402789.00007FF7F05E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F05E0000, based on PE: true

Associated: 00000000.00000002.1411380882.00007FF7F05E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411421340.00007FF7F05E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411441520.00007FF7F05EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411457671.00007FF7F05F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F05F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F0606000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F061C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f05e0000_reup.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 1804819252-1534286854
Opcode ID: 20d9624ecf9f028208786233a238fd775843d5a8464e776ca3e41638734fbe35
Instruction ID: a887c21f4f4780fd15a472c4eb945088927dd44fd65b4d256a1d5309df221e86
Opcode Fuzzy Hash: 20d9624ecf9f028208786233a238fd775843d5a8464e776ca3e41638734fbe35
Instruction Fuzzy Hash: 7B51B272A09A4696EB10AB11E840EA9F760FF84B94FC44131DEAD073D5DEBCF545C7A0

Function 00007FF7F05E2C10 Relevance: 7.8, APIs: 5, Instructions: 340
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF7F05E2CE5
fputc.MSVCRT ref: 00007FF7F05E2E82

Memory Dump Source

Source File: 00000000.00000002.1411402789.00007FF7F05E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F05E0000, based on PE: true

Associated: 00000000.00000002.1411380882.00007FF7F05E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411421340.00007FF7F05E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411441520.00007FF7F05EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411457671.00007FF7F05F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F05F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F0606000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F061C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f05e0000_reup.jbxd

Similarity

API ID: fputcmemset
String ID:
API String ID: 947785774-0
Opcode ID: da3c285661c426b02d7bb0ec014253430d73f74fbfff98cab1b4f34172564aeb
Instruction ID: ca1c58676bfe84c50686fdc676b58d66519d642a26073f7f8a0eed840cf984e5
Opcode Fuzzy Hash: da3c285661c426b02d7bb0ec014253430d73f74fbfff98cab1b4f34172564aeb
Instruction Fuzzy Hash: 22D1FA73F1855186E724AF34C504B3DA6A1BB44B68FA48234CABD577C8CA7CF941C7A2

Function 00007FF7F05E3140 Relevance: 6.2, APIs: 4, Instructions: 246
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1411402789.00007FF7F05E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F05E0000, based on PE: true

Associated: 00000000.00000002.1411380882.00007FF7F05E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411421340.00007FF7F05E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411441520.00007FF7F05EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411457671.00007FF7F05F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F05F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F0606000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F061C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f05e0000_reup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ea7c3da68f83a21f651fba5fd714f987f39fb7b2b10eaa3ab35943c9a8b1726
Instruction ID: bc6d967360e6b118bc210d05037cb92227b597ef3f741ea898abfbe18b12fdb9
Opcode Fuzzy Hash: 3ea7c3da68f83a21f651fba5fd714f987f39fb7b2b10eaa3ab35943c9a8b1726
Instruction Fuzzy Hash: A491F976F0825286E765AF29C208F39AA91AB44B54F958134CFAC5B3C4CB7CF841C7A1

Function 00007FF7F05E78B0 Relevance: 6.1, APIs: 4, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsDBCSLeadByteEx.KERNEL32 ref: 00007FF7F05E790A
MultiByteToWideChar.KERNEL32 ref: 00007FF7F05E794A

Memory Dump Source

Source File: 00000000.00000002.1411402789.00007FF7F05E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F05E0000, based on PE: true

Associated: 00000000.00000002.1411380882.00007FF7F05E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411421340.00007FF7F05E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411441520.00007FF7F05EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411457671.00007FF7F05F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F05F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F0606000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F061C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f05e0000_reup.jbxd

Similarity

API ID: Byte$CharLeadMultiWide
String ID:
API String ID: 2561704868-0
Opcode ID: e03050c30f18c24fa5dcc3351e31bd7e7ad72f99cf085e855522ae638b88029d
Instruction ID: 9ea7edab1b650a2457da50059df056207fc3517f88c92c492068df504592594a
Opcode Fuzzy Hash: e03050c30f18c24fa5dcc3351e31bd7e7ad72f99cf085e855522ae638b88029d
Instruction Fuzzy Hash: 6B31D272A0C2858AE3709F24F400B69B6A0FF94784F948134EAE8877D6DFBDE445CB51

Function 00007FF7F05E1790 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 00007FF7F05E1810

Strings

Unknown error, xrefs: 00007FF7F05E187C
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7F05E17F7

Memory Dump Source

Source File: 00000000.00000002.1411402789.00007FF7F05E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F05E0000, based on PE: true

Associated: 00000000.00000002.1411380882.00007FF7F05E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411421340.00007FF7F05E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411441520.00007FF7F05EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411457671.00007FF7F05F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F05F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F0606000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F061C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f05e0000_reup.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: aebd9311fc89dde6a5940af1e0a0525750b95a9bbdf4680b8b37aabebd9ab4a6
Instruction ID: ca723c0e351be39db23a85f1c90a9e30a40562438b5abd690f3a1c86f8ebec28
Opcode Fuzzy Hash: aebd9311fc89dde6a5940af1e0a0525750b95a9bbdf4680b8b37aabebd9ab4a6
Instruction Fuzzy Hash: F4019E22C1CE8882D7019F18E8005AAB331FB6E748F659325EACC263A5DF68E5828700

Function 00007FF7F05E1860 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 00007FF7F05E1810

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7F05E17F7
The result is too small to be represented (UNDERFLOW), xrefs: 00007FF7F05E1860

Memory Dump Source

Source File: 00000000.00000002.1411402789.00007FF7F05E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F05E0000, based on PE: true

Associated: 00000000.00000002.1411380882.00007FF7F05E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411421340.00007FF7F05E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411441520.00007FF7F05EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411457671.00007FF7F05F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F05F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F0606000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F061C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f05e0000_reup.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: e2f5d011fee0467edccf5175e1823d1f7b8d1e7c977933f128d19f29c1654296
Instruction ID: beea0589598bd79f9c86fd5c4095836247d4515676c7a635da7ac3baceae88d4
Opcode Fuzzy Hash: e2f5d011fee0467edccf5175e1823d1f7b8d1e7c977933f128d19f29c1654296
Instruction Fuzzy Hash: C7F04F22818E8882D7129F1CA4005AAB371FB5DB88F645325EADD26395DF69E5828750

Function 00007FF7F05E1870 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7F05E1810

Strings

Total loss of significance (TLOSS), xrefs: 00007FF7F05E1870
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7F05E17F7

Memory Dump Source

Source File: 00000000.00000002.1411402789.00007FF7F05E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F05E0000, based on PE: true

Associated: 00000000.00000002.1411380882.00007FF7F05E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411421340.00007FF7F05E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411441520.00007FF7F05EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411457671.00007FF7F05F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F05F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F0606000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F061C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f05e0000_reup.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: bbc40371ef3aa1044c130e7f2ff04ce9029d6dae37edfdb144930c62b3003a67
Instruction ID: df8729d405bfdf41ca7c9585ddef7c9d93b9547cba6edb15423939b314f39fdd
Opcode Fuzzy Hash: bbc40371ef3aa1044c130e7f2ff04ce9029d6dae37edfdb144930c62b3003a67
Instruction Fuzzy Hash: 2CF0AF22808E8882D3029F1CA4000AAB331FB4DB88F645325EACC26391DF68F5828310

Function 00007FF7F05E1840 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 00007FF7F05E1810

Strings

Partial loss of significance (PLOSS), xrefs: 00007FF7F05E1840
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7F05E17F7

Memory Dump Source

Source File: 00000000.00000002.1411402789.00007FF7F05E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F05E0000, based on PE: true

Associated: 00000000.00000002.1411380882.00007FF7F05E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411421340.00007FF7F05E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411441520.00007FF7F05EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411457671.00007FF7F05F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F05F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F0606000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F061C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f05e0000_reup.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: 5ea3434662c021d503e7b7b163a4bb26d1960d4a018860e43aa3dc63db1405a4
Instruction ID: 22bc5f47dd7819a296b936c640c8f835505835be23d16ef068b0128557cd3838
Opcode Fuzzy Hash: 5ea3434662c021d503e7b7b163a4bb26d1960d4a018860e43aa3dc63db1405a4
Instruction Fuzzy Hash: 55F04F22818E8882D7129F1CA4005AAB371FB4DB88F645325EADD26395DF69F5828750

Function 00007FF7F05E1850 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 00007FF7F05E1810

Strings

Overflow range error (OVERFLOW), xrefs: 00007FF7F05E1850
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7F05E17F7

Memory Dump Source

Source File: 00000000.00000002.1411402789.00007FF7F05E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F05E0000, based on PE: true

Associated: 00000000.00000002.1411380882.00007FF7F05E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411421340.00007FF7F05E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411441520.00007FF7F05EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411457671.00007FF7F05F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F05F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F0606000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F061C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f05e0000_reup.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: a0da3d28bd5d6a08110ce6d2fb87386a3964d9525e60d5aa56a36adc9f26231b
Instruction ID: 011ebbc5612fb952c995c0a69370cbc64413d27aa9aaf9b7b98cd8bfce272ede
Opcode Fuzzy Hash: a0da3d28bd5d6a08110ce6d2fb87386a3964d9525e60d5aa56a36adc9f26231b
Instruction Fuzzy Hash: FAF04F22818E8882D7129F1CA4005AAB375FB4DB88F645325EACD263A5DF69E5828750

Function 00007FF7F05E1830 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 00007FF7F05E1810

Strings

Argument domain error (DOMAIN), xrefs: 00007FF7F05E1830
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7F05E17F7

Memory Dump Source

Source File: 00000000.00000002.1411402789.00007FF7F05E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F05E0000, based on PE: true

Associated: 00000000.00000002.1411380882.00007FF7F05E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411421340.00007FF7F05E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411441520.00007FF7F05EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411457671.00007FF7F05F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F05F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F0606000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F061C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f05e0000_reup.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: e4e1877e0d865bf28fd455034e041e9dd37c03c9d04bcca5f18ea6dacc9115cb
Instruction ID: 45c77c8694fee76ef88f0096750312e5fd0dbdd8ddef45e33dd04c88245cebf7
Opcode Fuzzy Hash: e4e1877e0d865bf28fd455034e041e9dd37c03c9d04bcca5f18ea6dacc9115cb
Instruction Fuzzy Hash: 4DF04F22C18E8886D7129F2CA4005AAB375FB4DB88F645325EACD26395DF69E5828750

Function 00007FF7F05E17C8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7F05E1810

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7F05E17F7
Argument singularity (SIGN), xrefs: 00007FF7F05E17C8

Memory Dump Source

Source File: 00000000.00000002.1411402789.00007FF7F05E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F05E0000, based on PE: true

Associated: 00000000.00000002.1411380882.00007FF7F05E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411421340.00007FF7F05E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411441520.00007FF7F05EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411457671.00007FF7F05F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F05F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F0606000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411472194.00007FF7F061C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f05e0000_reup.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: 32be479702281cc5ce71a768fbb2b8428d468b92f09d40936d187439912a51d4
Instruction ID: b90af178b2c9c8d7604725e32d9a3c2a641ff8f73bd7be53aa6d88bd7c89ef8f
Opcode Fuzzy Hash: 32be479702281cc5ce71a768fbb2b8428d468b92f09d40936d187439912a51d4
Instruction Fuzzy Hash: 41F06212818E8882D3129F1CE8001ABB335FB4D788F549325EFCC2A255DF69E5828710

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report reup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_reup.exe_c4144ddf6f397eebaa24f1e81185ec95be2cdb_160b166d_3001f786-4fd1-4962-a087-70279a89038a\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD0F5.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD182.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD1C2.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

Windows Analysis Report
reup.exe

Function 00007FF7F05E7E10 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 109
nativethreadsleepCOMMON

Function 00007FF7F05E14CB Relevance: 12.1, APIs: 8, Instructions: 66
encryptionCOMMON

Function 00007FF7F05E1180 Relevance: 10.6, APIs: 7, Instructions: 138
sleepstringCOMMON

Function 00007FF7F05E1A80 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 232
COMMON

Function 00007FF7F05E1E24 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83
COMMON

Function 00007FF7F05E18A0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 138
COMMON

Function 00007FF7F05E2C10 Relevance: 7.8, APIs: 5, Instructions: 340
COMMON

Function 00007FF7F05E3140 Relevance: 6.2, APIs: 4, Instructions: 246
COMMON

Function 00007FF7F05E78B0 Relevance: 6.1, APIs: 4, Instructions: 83
COMMON

Function 00007FF7F05E1790 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38
COMMON

Function 00007FF7F05E1860 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Function 00007FF7F05E1840 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Function 00007FF7F05E1850 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Function 00007FF7F05E1830 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON