Edit tour

Windows Analysis Report
ocs.exe

Overview

General Information

Sample name:	ocs.exe
Analysis ID:	1559382
MD5:	725da9f8ec7b0b8316dae970f35590ef
SHA1:	81bc4602c202fc735785e99f338e8e73861b5113
SHA256:	c047c39f77e0313414d81b081d2c80efd1295bb2b1a57faa0f911d43e22bc8be
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected suspicious sample

Machine Learning detection for sample

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Found dropped PE file which has not been started or loaded

May sleep (evasive loops) to hinder dynamic analysis

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Classification

Process Tree

System is w10x64

ocs.exe (PID: 3200 cmdline: "C:\Users\user\Desktop\ocs.exe" MD5: 725DA9F8EC7B0B8316DAE970F35590EF)

cmd.exe (PID: 1196 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\A3BE.tmp\start.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

runasspc.exe (PID: 2924 cmdline: runasspc.exe /program:"ocsagentsetup.exe /S /SERVER:192.168.32.7 /PNUM:80 /NP /NOSPLASH /NoOcs_ContactLnk /NOW" /domain:"localhost" /user:"Administrator" /password:"mitro,1916" /quiet MD5: 85848267B79C1BF176EEFF46EA4B3537)

runasspc.exe (PID: 2704 cmdline: runasspc.exe /program:"ocsagentsetup.exe /S /SERVER:192.168.32.7 /PNUM:80 /NP /NOSPLASH /NoOcs_ContactLnk /NOW" /domain:"localhost" /user:"Administrator" /password:"bk0906!!" /quiet MD5: 85848267B79C1BF176EEFF46EA4B3537)

runasspc.exe (PID: 5624 cmdline: runasspc.exe /program:"ocsagentsetup.exe /S /SERVER:192.168.32.7 /PNUM:80 /NP /NOSPLASH /NoOcs_ContactLnk /NOW" /domain:"localhost" /user:"Administrator" /password:"Abello" /quiet MD5: 85848267B79C1BF176EEFF46EA4B3537)

runasspc.exe (PID: 5508 cmdline: runasspc.exe /program:"ocsagentsetup.exe /S /SERVER:192.168.32.7 /PNUM:80 /NP /NOSPLASH /NoOcs_ContactLnk /NOW" /domain:"localhost" /user:"Administrator" /password:"tSyDqvEwA6UL" /quiet MD5: 85848267B79C1BF176EEFF46EA4B3537)

runasspc.exe (PID: 320 cmdline: runasspc.exe /program:"ocsagentsetup.exe /S /SERVER:192.168.32.7 /PNUM:80 /NP /NOSPLASH /NoOcs_ContactLnk /NOW" /domain:"localhost" /user:"Administrator" /password:"&9brASEt-eYe" /quiet MD5: 85848267B79C1BF176EEFF46EA4B3537)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 92.0% probability

Machine Learning detection for sample

Source: ocs.exe

Joe Sandbox ML: detected

Source: ocs.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe

Code function: 4_2_00405E80 _mbscmp,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,#533,#350,#540,#860,#540,#540,#540,#540,#540,#540,#5194,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,#800,#800,#800,#800,#800,#800,#800,#798,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,#800,#800,#800,#800,#800,#800,#800,#798,#823,#823,#823,#2915,#5448,#5448,#3790,#1997,#3337,#3337,#3337,#3337,time,time,#2818,#860,#940,#4129,#858,#800,#6778,#6663,#6663,#4129,#858,#800,#6648,#6663,#4129,#858,#800,#6648,#6663,#4129,#858,#800,#6648,#6663,#4129,#858,#800,#6648,#6663,#4129,#858,#800,#6648,#6663,#4129,#858,#800,#6648,#6663,#4129,#858,#800,#6648,#6663,#4129,#858,#800,#6648,#6663,#4129,#858,#800,#6648,#6663,#4129,#858,#800,#6648,#6663,#4129,#858,#800,#6648,#6663,#4129,#858,#800,#6648,#6663,#4129,#858,#800,#6648,_mbscmp,_mbscmp,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,#800,#800,#800,#800,#800,#800,#800,#798,#922,#5194,#800,#1997,_mbscmp,#540,#540,GetCurrentDirectoryA,#860,#941,#922,#858,#800,#5194,#1997,#858,#800,#800,_mbscmp,#922,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,#800,#800,#800,#800,#800,#800,#800,#798,GetLogicalDriveStringsA,#860,#860,#858,#6648,#926,#858,#800,#922,#5194,#800,lstrlenA,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$ba

4_2_00405E80

Source: ocs.exe, OcsAgentSetup.exe.0.dr	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: OcsAgentSetup.exe.0.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: ocs.exe, OcsAgentSetup.exe.0.dr	String found in binary or memory: http://www.ocsinventory-ng.org

Source: C:\Users\user\Desktop\ocs.exe

Code function: 0_2_00405D3C GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetFocus,GetFocus,GetClassNameA,strncmp,GetFocus,SendMessageA,GetPropA,

0_2_00405D3C

Source: C:\Users\user\Desktop\ocs.exe	Code function: 0_2_00405B1F GetPropA,DefFrameProcA,SetLastError,NtdllDefWindowProc_A,	0_2_00405B1F
Source: C:\Users\user\Desktop\ocs.exe	Code function: 0_2_00407E1A sprintf,GetPropA,HeapFree,HeapFree,HeapFree,RemovePropA,CallWindowProcA,NtdllDefWindowProc_A,	0_2_00407E1A
Source: C:\Users\user\Desktop\ocs.exe	Code function: 0_2_00404714 GetWindowLongA,CallWindowProcA,RemovePropA,RemovePropA,RemovePropA,RevokeDragDrop,SetWindowLongA,NtdllDefWindowProc_A,	0_2_00404714

Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe

Code function: 4_2_00407190 _mbscmp,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,#540,#540,#926,#922,#924,#924,#922,#858,#800,#800,#800,#800,#800,MessageBoxA,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z,#2915,MultiByteToWideChar,MultiByteToWideChar,_mbscmp,#2915,GetComputerNameA,#5572,#2915,MultiByteToWideChar,#2915,MultiByteToWideChar,#2915,MultiByteToWideChar,_mbscmp,#858,#2915,MultiByteToWideChar,_mbscmp,_mbscmp,_mbscmp,_mbscmp,GetCurrentProcess,OpenProcessToken,CreateEnvironmentBlock,#800,#800,_mbscmp,_mbscmp,_mbscmp,#6663,#6648,#2915,MultiByteToWideChar,#2915,MultiByteToWideChar,_mbscmp,#2514,#656,#641,#2915,MultiByteToWideChar,#656,#641,CreateProcessWithLogonW,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,#540,GetLastError,#2818,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z,#926,#922,#924,#922,#924,#858,#800,#800,#800,#800,#800,#2915,MultiByteToWideChar,CreateProcessWithLogonW,#800,#800,#800,WaitForSingleObject,WaitForSingleObject,#2915,TerminateProcess,#800,DestroyEnvironmentBlock,CloseHandle,CloseHandle,CloseHandle,CloseHandle,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV2

4_2_00407190

Source: C:\Users\user\Desktop\ocs.exe	Code function: 0_2_00406960	0_2_00406960
Source: C:\Users\user\Desktop\ocs.exe	Code function: 0_2_00423173	0_2_00423173
Source: C:\Users\user\Desktop\ocs.exe	Code function: 0_2_0040E930	0_2_0040E930
Source: C:\Users\user\Desktop\ocs.exe	Code function: 0_2_0040D9C0	0_2_0040D9C0
Source: C:\Users\user\Desktop\ocs.exe	Code function: 0_2_0040E240	0_2_0040E240
Source: C:\Users\user\Desktop\ocs.exe	Code function: 0_2_00424A51	0_2_00424A51
Source: C:\Users\user\Desktop\ocs.exe	Code function: 0_2_00406C10	0_2_00406C10
Source: C:\Users\user\Desktop\ocs.exe	Code function: 0_2_0040EC30	0_2_0040EC30
Source: C:\Users\user\Desktop\ocs.exe	Code function: 0_2_0040E630	0_2_0040E630
Source: C:\Users\user\Desktop\ocs.exe	Code function: 0_2_0040DE80	0_2_0040DE80
Source: C:\Users\user\Desktop\ocs.exe	Code function: 0_2_0040EE90	0_2_0040EE90
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Code function: 4_2_00402410	4_2_00402410
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Code function: 4_2_004014A0	4_2_004014A0
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Code function: 4_2_00401960	4_2_00401960
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Code function: 4_2_00402970	4_2_00402970
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Code function: 4_2_00402110	4_2_00402110
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Code function: 4_2_00401D20	4_2_00401D20
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Code function: 4_2_00402710	4_2_00402710

Source: ocs.exe

Binary or memory string: OriginalFilename vs ocs.exe

Source: ocs.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: ocs.exe

Static PE information: Section: UPX1 ZLIB complexity 0.9993838396633768

Source: classification engine

Classification label: mal48.winEXE@15/8@0/0

Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe

Code function: 4_2_00402C10 ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,#860,#860,#540,GetLastError,GetLastError,#2818,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z,#926,#922,#939,#800,#800,MessageBoxA,#800,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z,#926,#924,#922,#939,#800,#800,#800,MessageBoxA,#800,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z,#941,MessageBoxA,#800,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,?endl@std@@YAAAV?$basic

4_2_00402C10

Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe

Code function: 4_2_00408990 WaitForSingleObject,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,CreateToolhelp32Snapshot,??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z,Process32First,CloseHandle,Process32Next,CloseHandle,

4_2_00408990

Source: C:\Users\user\Desktop\ocs.exe

Code function: 0_2_004020C9 FindResourceA,LoadResource,SizeofResource,

0_2_004020C9

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6152:120:WilError_03

Source: C:\Users\user\Desktop\ocs.exe

File created: C:\Users\user\AppData\Local\Temp\A3BE.tmp

Jump to behavior

Source: C:\Users\user\Desktop\ocs.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\A3BE.tmp\start.bat" "

Source: C:\Users\user\Desktop\ocs.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ocs.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ocs.exe "C:\Users\user\Desktop\ocs.exe"
Source: C:\Users\user\Desktop\ocs.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\A3BE.tmp\start.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe runasspc.exe /program:"ocsagentsetup.exe /S /SERVER:192.168.32.7 /PNUM:80 /NP /NOSPLASH /NoOcs_ContactLnk /NOW" /domain:"localhost" /user:"Administrator" /password:"mitro,1916" /quiet
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe runasspc.exe /program:"ocsagentsetup.exe /S /SERVER:192.168.32.7 /PNUM:80 /NP /NOSPLASH /NoOcs_ContactLnk /NOW" /domain:"localhost" /user:"Administrator" /password:"bk0906!!" /quiet
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe runasspc.exe /program:"ocsagentsetup.exe /S /SERVER:192.168.32.7 /PNUM:80 /NP /NOSPLASH /NoOcs_ContactLnk /NOW" /domain:"localhost" /user:"Administrator" /password:"Abello" /quiet
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe runasspc.exe /program:"ocsagentsetup.exe /S /SERVER:192.168.32.7 /PNUM:80 /NP /NOSPLASH /NoOcs_ContactLnk /NOW" /domain:"localhost" /user:"Administrator" /password:"tSyDqvEwA6UL" /quiet
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe runasspc.exe /program:"ocsagentsetup.exe /S /SERVER:192.168.32.7 /PNUM:80 /NP /NOSPLASH /NoOcs_ContactLnk /NOW" /domain:"localhost" /user:"Administrator" /password:"&9brASEt-eYe" /quiet
Source: C:\Users\user\Desktop\ocs.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\A3BE.tmp\start.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe runasspc.exe /program:"ocsagentsetup.exe /S /SERVER:192.168.32.7 /PNUM:80 /NP /NOSPLASH /NoOcs_ContactLnk /NOW" /domain:"localhost" /user:"Administrator" /password:"mitro,1916" /quiet	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe runasspc.exe /program:"ocsagentsetup.exe /S /SERVER:192.168.32.7 /PNUM:80 /NP /NOSPLASH /NoOcs_ContactLnk /NOW" /domain:"localhost" /user:"Administrator" /password:"bk0906!!" /quiet	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe runasspc.exe /program:"ocsagentsetup.exe /S /SERVER:192.168.32.7 /PNUM:80 /NP /NOSPLASH /NoOcs_ContactLnk /NOW" /domain:"localhost" /user:"Administrator" /password:"Abello" /quiet	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe runasspc.exe /program:"ocsagentsetup.exe /S /SERVER:192.168.32.7 /PNUM:80 /NP /NOSPLASH /NoOcs_ContactLnk /NOW" /domain:"localhost" /user:"Administrator" /password:"tSyDqvEwA6UL" /quiet	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe runasspc.exe /program:"ocsagentsetup.exe /S /SERVER:192.168.32.7 /PNUM:80 /NP /NOSPLASH /NoOcs_ContactLnk /NOW" /domain:"localhost" /user:"Administrator" /password:"&9brASEt-eYe" /quiet	Jump to behavior

Source: C:\Users\user\Desktop\ocs.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Section loaded: mfc42.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Section loaded: mfc42.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Section loaded: mfc42.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Section loaded: mfc42.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Section loaded: mfc42.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: C:\Users\user\Desktop\ocs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: ocs.exe

Static file information: File size 1454592 > 1048576

Source: ocs.exe

Static PE information: Raw size of UPX1 is bigger than: 0x100000 < 0x162a00

Source: C:\Users\user\Desktop\ocs.exe

Code function: 0_2_00405EB2 GetTempPathA,LoadLibraryA,GetProcAddress,GetLongPathNameA,FreeLibrary,

0_2_00405EB2

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\Desktop\ocs.exe	File created: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe			Jump to dropped file
Source: C:\Users\user\Desktop\ocs.exe	File created: C:\Users\user\AppData\Local\Temp\A3BE.tmp\OcsAgentSetup.exe			Jump to dropped file

Source: C:\Users\user\Desktop\ocs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ocs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\ocs.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\A3BE.tmp\OcsAgentSetup.exe

Jump to dropped file

Source: C:\Users\user\Desktop\ocs.exe TID: 3372

Thread sleep count: 93 > 30

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe

4_2_00405E80

Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe

API call chain: ExitProcess graph end node

graph_4-1458

Source: C:\Users\user\Desktop\ocs.exe

Code function: 0_2_00405EB2 GetTempPathA,LoadLibraryA,GetProcAddress,GetLongPathNameA,FreeLibrary,

0_2_00405EB2

Source: C:\Users\user\Desktop\ocs.exe	Code function: 0_2_00403B70 SetUnhandledExceptionFilter,SetUnhandledExceptionFilter,SetUnhandledExceptionFilter,		0_2_00403B70
Source: C:\Users\user\Desktop\ocs.exe	Code function: 0_2_00403CC0 SetUnhandledExceptionFilter,		0_2_00403CC0

Source: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe

4_2_00407190

Source: C:\Users\user\Desktop\ocs.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\A3BE.tmp\start.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe runasspc.exe /program:"ocsagentsetup.exe /S /SERVER:192.168.32.7 /PNUM:80 /NP /NOSPLASH /NoOcs_ContactLnk /NOW" /domain:"localhost" /user:"Administrator" /password:"mitro,1916" /quiet	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe runasspc.exe /program:"ocsagentsetup.exe /S /SERVER:192.168.32.7 /PNUM:80 /NP /NOSPLASH /NoOcs_ContactLnk /NOW" /domain:"localhost" /user:"Administrator" /password:"bk0906!!" /quiet	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe runasspc.exe /program:"ocsagentsetup.exe /S /SERVER:192.168.32.7 /PNUM:80 /NP /NOSPLASH /NoOcs_ContactLnk /NOW" /domain:"localhost" /user:"Administrator" /password:"Abello" /quiet	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe runasspc.exe /program:"ocsagentsetup.exe /S /SERVER:192.168.32.7 /PNUM:80 /NP /NOSPLASH /NoOcs_ContactLnk /NOW" /domain:"localhost" /user:"Administrator" /password:"tSyDqvEwA6UL" /quiet	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe runasspc.exe /program:"ocsagentsetup.exe /S /SERVER:192.168.32.7 /PNUM:80 /NP /NOSPLASH /NoOcs_ContactLnk /NOW" /domain:"localhost" /user:"Administrator" /password:"&9brASEt-eYe" /quiet	Jump to behavior

Source: C:\Users\user\Desktop\ocs.exe

Code function: 0_2_00403CD7 GetVersionExA,GetVersionExA,GetVersionExA,

0_2_00403CD7

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Valid Accounts	1 Native API	1 Valid Accounts	1 Valid Accounts	1 Valid Accounts	1 Input Capture	1 Virtualization/Sandbox Evasion	Remote Services	1 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	1 Exploitation for Privilege Escalation	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 Access Token Manipulation	1 Access Token Manipulation	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	11 Process Injection	11 Process Injection	NTDS	2 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 DLL Side-Loading	1 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ocs.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\A3BE.tmp\OcsAgentSetup.exe	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://www.ocsinventory-ng.org	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://nsis.sf.net/NSIS_Error	ocs.exe, OcsAgentSetup.exe.0.dr	false		high
http://nsis.sf.net/NSIS_ErrorError	OcsAgentSetup.exe.0.dr	false		high
http://www.ocsinventory-ng.org	ocs.exe, OcsAgentSetup.exe.0.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559382
Start date and time:	2024-11-20 13:17:23 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ocs.exe
Detection:	MAL
Classification:	mal48.winEXE@15/8@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 21 Number of non-executed functions: 56
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.65.92
Excluded domains from analysis (whitelisted): onedsblobprdeus17.eastus.cloudapp.azure.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: ocs.exe

Process:	C:\Users\user\Desktop\ocs.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	1411754
Entropy (8bit):	7.992246724895325
Encrypted:	true
SSDEEP:	24576:BTR8/w+ZyocpBfZISwHWSscEsCK7ltJk0J7yOmpSPst4PW+aRVsCUEkSOIT:9Rizc1ISwHEc9CKBtJxA4PXXa3JUv+
MD5:	E80DF9439AB058DB7BFAAF673C4E6F10
SHA1:	58164ECE556FAC3049545D3FD1DF881C9803C495
SHA-256:	02BC0030A5FE05B44A6FFF9760C312F73766B6A04B3527B68F9F3A4BEDFB2DB3
SHA-512:	9382954DEFF028E2EFB8AE2D89C2DDA9484CB0ABB8D58FC6553D87641B21A11805A0C71539ECBF3DF38BFCA1F3A272AB3DDB43D5BC36FAC975E47640EC0FE51F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i..iw..iu..i...i..id..i!..i...i...it..iRichu..i........................PE..L.....*J.................\..........<2.......p....@..........................0...............................................s...........6...........................................................................p...............................text...ZZ.......\.................. ..`.rdata.......p.......`..............@..@.data................r..............@....ndata.......@...........................rsrc....6.......8...v..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe

Download File

Process:	C:\Users\user\Desktop\ocs.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	5.9545164774404675
Encrypted:	false
SSDEEP:	1536:cMr0X46Cu8QPBHjmyylTN9S4A3eT8npW:cy046Cu8wBHjmXCi8npW
MD5:	85848267B79C1BF176EEFF46EA4B3537
SHA1:	A80E727454A00DFA711D1A4CC9A1DBEE20501147
SHA-256:	524CA04561A0420973E00EB6831C4F33F5FBCC58EF71C1AC0B77C0C0BAD69713
SHA-512:	5FE40B21047527C5F7A96FECBF3BEED4E487790C9CD973A125FAC32FCA255B011092626B2AC411930CF243B2BCC9A3C602445C98A53F0A393FF6B2D2BADAC8DE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E.f.............z...............n.......n.......n.......x.......x................U....................Rich............................PE..L...H..K............................".............@..........................0....................................................... ...............................................................................................................text............................... ..`.rdata...X.......`..................@..@.data...x...........................@....rsrc........ ....... ..............@..@........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\A3BE.tmp\start.bat

Download File

Process:	C:\Users\user\Desktop\ocs.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	938
Entropy (8bit):	5.288076112390791
Encrypted:	false
SSDEEP:	12:pyFe6XVAyFe6Xg2NPcyFe6XxFyFe6XWQUcyFe6XtiqR:pMWMrcMfMKQUcMBiq
MD5:	83902E28B0AFAC3F862ECF1CAD0A7709
SHA1:	709DAE951E4E0CF093FB2CC7E7152345F80ECBE9
SHA-256:	30A3302CD829FF93F261D2FF5493881DFAD5D70AB2F508B95924A88A17A71921
SHA-512:	A72F4C1D2320BD7E9BEE38205D3F4852D3CAC883B0271D1C76B3105B4EDEE9B41CFA5FA21DD77D46965E60DAAD5579AA1E2435B0FFBADCC6BE48A42C401BB56D
Malicious:	false
Reputation:	low
Preview:	@echo off..runasspc.exe /program:"ocsagentsetup.exe /S /SERVER:192.168.32.7 /PNUM:80 /NP /NOSPLASH /NoOcs_ContactLnk /NOW" /domain:"localhost" /user:"Administrator" /password:"mitro,1916" /quiet..runasspc.exe /program:"ocsagentsetup.exe /S /SERVER:192.168.32.7 /PNUM:80 /NP /NOSPLASH /NoOcs_ContactLnk /NOW" /domain:"localhost" /user:"Administrator" /password:"bk0906!!" /quiet..runasspc.exe /program:"ocsagentsetup.exe /S /SERVER:192.168.32.7 /PNUM:80 /NP /NOSPLASH /NoOcs_ContactLnk /NOW" /domain:"localhost" /user:"Administrator" /password:"Abello" /quiet..runasspc.exe /program:"ocsagentsetup.exe /S /SERVER:192.168.32.7 /PNUM:80 /NP /NOSPLASH /NoOcs_ContactLnk /NOW" /domain:"localhost" /user:"Administrator" /password:"tSyDqvEwA6UL" /quiet..runasspc.exe /program:"ocsagentsetup.exe /S /SERVER:192.168.32.7 /PNUM:80 /NP /NOSPLASH /NoOcs_ContactLnk /NOW" /domain:"localhost" /user:"Administrator" /password:"&9brASEt-eYe" /quiet..exit

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	349
Entropy (8bit):	4.270993527672736
Encrypted:	false
SSDEEP:	6:IomFL2SKIRv9euB90UQAP9jzbUi1ovdnybX4p9WMq5RQ1:IomFL2STRVhbrQYzlohyz4pP
MD5:	2AB60142E6C1877C88DA6AAF7DDC6F0D
SHA1:	5BFF5488A81E23F86849AFB8CD24A3C8528C4421
SHA-256:	619DDAFEF60FA38F76B7102E821ED60E4FA3DE3BC399DD4819FDDBB08B20E8C3
SHA-512:	6C0B3B2F2BAD93708D13312573D0CB43504BC525CF5EC34D2F933DB4D6237F530F5B96A9269366E9097949440208E2920B9C9220504620363B8EAF0CF71C7C08
Malicious:	false
Reputation:	low
Preview:	.. ***********--> RUNASSPC <--***********.. FOR PRIVATE USE .. Commercial use license at: .. www.robotronic.de/orderen.php .. ******************************************....Errorcode: 1326..Logon failure: unknown user name or bad password...username: Administrator..domainname: 536720....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Entropy (8bit):	7.999673760379866
TrID:	Win32 Executable (generic) a (10002005/4) 99.39% UPX compressed Win32 Executable (30571/9) 0.30% Win32 EXE Yoda's Crypter (26571/9) 0.26% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	ocs.exe
File size:	1'454'592 bytes
MD5:	725da9f8ec7b0b8316dae970f35590ef
SHA1:	81bc4602c202fc735785e99f338e8e73861b5113
SHA256:	c047c39f77e0313414d81b081d2c80efd1295bb2b1a57faa0f911d43e22bc8be
SHA512:	ecd54963a9ffa12008d9dbaac11a30b50c3df32e375c1bf9b3601506e2d23bcbdfa603f131ba81c2d063f79b66f1b84d2fcb7785b2eaa6e47fe0dda46f3bd8d6
SSDEEP:	24576:/hypkdgOkBg/7u7JHSIDT5J0//uJvrSwvRgL/bEdxTvehry04Q/lcSNOtYMIuY4k:/h4dOkBgyHhxJkuBSwKL4nwrUQ/lbJF5
TLSH:	7C65333497EB1E82DB1D05BF42A761C887F2A0EC980E158C3FA441634F5F596E2BBD25
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...'..L...............2.0.......... .............@........................................................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x57dd20
Entrypoint Section:	UPX1
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x4CD7F727 [Mon Nov 8 13:12:07 2010 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	1d88d597200c0081784c27940d743ec5

Entrypoint Preview

Instruction
pushad
mov esi, 0041C015h
lea edi, dword ptr [esi-0001B015h]
push edi
mov ebp, esp
lea ebx, dword ptr [esp-00003E80h]
xor eax, eax
push eax
cmp esp, ebx
jne 00007F9820C7F8BDh
inc esi
inc esi
push ebx
push 00178988h
push edi
add ebx, 04h
push ebx
push 00161D01h
push esi
add ebx, 04h
push ebx
push eax
mov dword ptr [ebx], 00020003h
nop
nop
nop
nop
nop
push ebp
push edi
push esi
push ebx
sub esp, 7Ch
mov edx, dword ptr [esp+00000090h]
mov dword ptr [esp+74h], 00000000h
mov byte ptr [esp+73h], 00000000h
mov ebp, dword ptr [esp+0000009Ch]
lea eax, dword ptr [edx+04h]
mov dword ptr [esp+78h], eax
mov eax, 00000001h
movzx ecx, byte ptr [edx+02h]
mov ebx, eax
shl ebx, cl
mov ecx, ebx
dec ecx
mov dword ptr [esp+6Ch], ecx
movzx ecx, byte ptr [edx+01h]
shl eax, cl
dec eax
mov dword ptr [esp+68h], eax
mov eax, dword ptr [esp+000000A8h]
movzx esi, byte ptr [edx]
mov dword ptr [ebp+00h], 00000000h
mov dword ptr [esp+60h], 00000000h
mov dword ptr [eax], 00000000h
mov eax, 00000300h
mov dword ptr [esp+64h], esi
mov dword ptr [esp+5Ch], 00000001h
mov dword ptr [esp+58h], 00000001h
mov dword ptr [esp+54h], 00000001h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x17f3dc	0x220	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x17f000	0x3dc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x1b000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0x1c000	0x163000	0x162a00	2e95b468fd72927733b79d82a3fbb98e	False	0.9993838396633768	data	7.999818594479577	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x17f000	0x1000	0x600	dd3a3fbfb1714752ea2771292be65115	False	0.4928385416666667	data	4.8603841620156665	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_RCDATA	0xc174	0x3aa	empty	0
RT_RCDATA	0xc520	0x16baaa	empty	0
RT_RCDATA	0x177fcc	0x2d	data	1.2444444444444445
RT_RCDATA	0x177ffc	0x9	data	1.8888888888888888
RT_RCDATA	0x178008	0x6	data	2.3333333333333335
RT_MANIFEST	0x17f178	0x263	XML 1.0 document, ASCII text	0.5319148936170213

Imports

DLL	Import
KERNEL32.DLL	LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
COMCTL32.dll	InitCommonControls
GDI32.dll	SetBkColor
MSVCRT.dll	memset
OLE32.dll	CoInitialize
SHELL32.dll	ShellExecuteExA
SHLWAPI.dll	PathQuoteSpacesA
USER32.dll	IsChild

Target ID:	0
Start time:	07:18:11
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\ocs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ocs.exe"
Imagebase:	0x400000
File size:	1'454'592 bytes
MD5 hash:	725DA9F8EC7B0B8316DAE970F35590EF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:18:12
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\A3BE.tmp\start.bat" "
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:18:12
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:18:12
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe
Wow64 process (32bit):	true
Commandline:	runasspc.exe /program:"ocsagentsetup.exe /S /SERVER:192.168.32.7 /PNUM:80 /NP /NOSPLASH /NoOcs_ContactLnk /NOW" /domain:"localhost" /user:"Administrator" /password:"mitro,1916" /quiet
Imagebase:	0x400000
File size:	77'824 bytes
MD5 hash:	85848267B79C1BF176EEFF46EA4B3537
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	07:18:15
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe
Wow64 process (32bit):	true
Commandline:	runasspc.exe /program:"ocsagentsetup.exe /S /SERVER:192.168.32.7 /PNUM:80 /NP /NOSPLASH /NoOcs_ContactLnk /NOW" /domain:"localhost" /user:"Administrator" /password:"bk0906!!" /quiet
Imagebase:	0x400000
File size:	77'824 bytes
MD5 hash:	85848267B79C1BF176EEFF46EA4B3537
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:18:15
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe
Wow64 process (32bit):	true
Commandline:	runasspc.exe /program:"ocsagentsetup.exe /S /SERVER:192.168.32.7 /PNUM:80 /NP /NOSPLASH /NoOcs_ContactLnk /NOW" /domain:"localhost" /user:"Administrator" /password:"Abello" /quiet
Imagebase:	0x400000
File size:	77'824 bytes
MD5 hash:	85848267B79C1BF176EEFF46EA4B3537
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:18:15
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe
Wow64 process (32bit):	true
Commandline:	runasspc.exe /program:"ocsagentsetup.exe /S /SERVER:192.168.32.7 /PNUM:80 /NP /NOSPLASH /NoOcs_ContactLnk /NOW" /domain:"localhost" /user:"Administrator" /password:"tSyDqvEwA6UL" /quiet
Imagebase:	0x400000
File size:	77'824 bytes
MD5 hash:	85848267B79C1BF176EEFF46EA4B3537
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	07:18:15
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe
Wow64 process (32bit):	true
Commandline:	runasspc.exe /program:"ocsagentsetup.exe /S /SERVER:192.168.32.7 /PNUM:80 /NP /NOSPLASH /NoOcs_ContactLnk /NOW" /domain:"localhost" /user:"Administrator" /password:"&9brASEt-eYe" /quiet
Imagebase:	0x400000
File size:	77'824 bytes
MD5 hash:	85848267B79C1BF176EEFF46EA4B3537
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.1%
Total number of Nodes:	782
Total number of Limit Nodes:	5

Executed Functions

Function 00405EB2 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 39
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00407750: RtlReAllocateHeap.NTDLL(02300000,00000001,02300700,000040FF), ref: 00407797

GetTempPathA.KERNEL32(00000104,00000000,00000104,004013CA,?,?,?,00000000,00401C13,00000000,00000000,00000400,00000000,00000000,00000000,00000000), ref: 00405EC9
LoadLibraryA.KERNEL32(Kernel32.DLL,?,?,?,00000000,00401C13,00000000,00000000,00000400,00000000,00000000,00000000,00000000,004013CA,OPS,00000000), ref: 00405ED6
GetProcAddress.KERNEL32(00000000,GetLongPathNameA), ref: 00405EE8
GetLongPathNameA.KERNELBASE(00000000,00000000,00000104,?,?,?,00000000,00401C13,00000000,00000000,00000400,00000000,00000000,00000000,00000000,004013CA), ref: 00405EF5
FreeLibrary.KERNEL32(00000000,?,?,?,00000000,00401C13,00000000,00000000,00000400,00000000,00000000,00000000,00000000,004013CA,OPS,00000000), ref: 00405EFA

Strings

Kernel32.DLL, xrefs: 00405ECF
GetLongPathNameA, xrefs: 00405EE2

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: LibraryPath$AddressAllocateFreeHeapLoadLongNameProcTemp
String ID: GetLongPathNameA$Kernel32.DLL
API String ID: 752937943-822094646
Opcode ID: 2ee994cbced775828cbb784a7e8bc6389ef974a6875798f7d5984685419f755b
Instruction ID: 2fdf95b4f3bb88d5f25b72bcecc505d16b40b69b5bc7ba3a5d03bddc1f48918c
Opcode Fuzzy Hash: 2ee994cbced775828cbb784a7e8bc6389ef974a6875798f7d5984685419f755b
Instruction Fuzzy Hash: A5F0BE322012146BC32127B5AD4CF6B3A6CDB82791B04003AFA04B3282CABD9C1182BE

Function 00406960 Relevance: 7.6, APIs: 5, Instructions: 128
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000080,00000000,00000000,?,00000000,00000000), ref: 00406987
RtlAllocateHeap.NTDLL(02330000,00000000,00001000), ref: 004069AA
ReadFile.KERNELBASE(00000000,00000000,00001000,?,00000000,?,?,00000000,00000000), ref: 004069CE
HeapFree.KERNEL32(02330000,00000000,00000000,?,?,00000000,00000000), ref: 00406B05
CloseHandle.KERNELBASE(00000000,?,00000000,00000000), ref: 00406B0D

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: FileHeap$AllocateCloseCreateFreeHandleRead
String ID:
API String ID: 873069550-0
Opcode ID: 3652f549abcd2857d86857aab28a77ee2e5e896dfda86d6c962bdceb55ecb8e0
Instruction ID: ff62adfd02c82ff6d2fb6992739edd60424dd107fe33d02030225fc65b1a4817
Opcode Fuzzy Hash: 3652f549abcd2857d86857aab28a77ee2e5e896dfda86d6c962bdceb55ecb8e0
Instruction Fuzzy Hash: D9417A326403910BD3149F74EDDAB773760EB46301F09823AEB82A62D2D67D9514DB18

Function 00401000 Relevance: 74.2, APIs: 16, Strings: 26, Instructions: 666
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 0040100F
GetModuleHandleA.KERNEL32(00000000), ref: 0040101C
HeapCreate.KERNEL32(00000000,00001000,00000000,00000000), ref: 00401035

Part of subcall function 00407470: HeapCreate.KERNELBASE(00000001,00001000,00000000), ref: 0040747C
Part of subcall function 00407470: RtlAllocateHeap.NTDLL(02300000,00000001,00004104), ref: 004074AA

Part of subcall function 00406807: HeapCreate.KERNEL32(00000000,00000400,00000000,0040104E,00000000,00001000,00000000,00000000), ref: 00406810

Part of subcall function 00404AB3: LoadIconA.USER32(00000001,00000058), ref: 00404AE1
Part of subcall function 00404AB3: LoadCursorA.USER32(00000000,00007F00), ref: 00404AF3

Part of subcall function 004040E0: RtlInitializeCriticalSection.NTDLL(0040B454), ref: 004040EA
Part of subcall function 004040E0: GetStockObject.GDI32(00000011), ref: 004040F2
Part of subcall function 004040E0: memset.MSVCRT ref: 0040412E

Part of subcall function 00403D90: HeapCreate.KERNELBASE(00000000,00001000,00000000,00401062,00000000,00001000,00000000,00000000), ref: 00403D99

Part of subcall function 0040393B: RtlInitializeCriticalSection.NTDLL(0040B400), ref: 00403950

Part of subcall function 00403694: 6F781CD0.COMCTL32(0040106C,00000000,00001000,00000000,00000000), ref: 00403694
Part of subcall function 00403694: CoInitialize.OLE32(00000000), ref: 0040369B

Part of subcall function 00403EF0: RtlAllocateHeap.NTDLL(00000000,0000002C), ref: 00403EFD

Part of subcall function 00403060: HeapFree.KERNEL32(00000000,023312C8,00000000,004010A6,0040A37C,0040B1F4,00000007,00000008,00000000,0040A384,00000007,00000000,00001000,00000000,00000000), ref: 00403091

Part of subcall function 004030A0: RtlAllocateHeap.NTDLL(00000008,-00000018,00000401), ref: 004030B5

Part of subcall function 00403DC0: RtlAllocateHeap.NTDLL(02510000,00000008,00000000), ref: 00403DD1

GetUserDefaultLangID.KERNEL32(00000008,00000400,00000008,0040A37C,0040B1F4,00000007,00000008,00000000,0040A384,00000007,00000000,00001000,00000000,00000000), ref: 004010CF
VerLanguageNameA.KERNEL32(00000000,00000008,00000400,00000008,0040A37C,0040B1F4,00000007,00000008,00000000,0040A384,00000007,00000000,00001000,00000000,00000000), ref: 004010D5
CharLowerA.USER32(00000000,00000008,00000400,00000008,0040A37C,0040B1F4,00000007,00000008,00000000,0040A384,00000007,00000000,00001000,00000000,00000000), ref: 004010E0

Part of subcall function 00403E30: HeapFree.KERNEL32(02510000,00000000,00000000,00401113,00000000,00000000), ref: 00403E3E

GetModuleHandleA.KERNEL32(00000000,00000000,00000000), ref: 00401311

Part of subcall function 00403A18: strncpy.MSVCRT ref: 00403A53

Part of subcall function 004074F0: strlen.MSVCRT ref: 00407503

Part of subcall function 004036A2: MessageBoxA.USER32(00000000,00000010,00000000,?), ref: 004036BC

ExitProcess.KERNEL32(00000001,00000010,OPS,00000000,00000000,00000000), ref: 00401BBB
HeapDestroy.KERNEL32(00000001,00000010,OPS,00000000,00000000,00000000), ref: 00401BC6
ExitProcess.KERNEL32(00000001,00000010,OPS,00000000,00000000,00000000), ref: 00401BCB

Strings

Error!, xrefs: 0040120F
An unknown error occured. The program will be terminated., xrefs: 0040127F
deutsch, xrefs: 00401119
Please enter the password., xrefs: 004012BF
Fortfahren?, xrefs: 0040112A
Einige Include Dateien konnten nicht erstellt werden., xrefs: 0040114A
Password, xrefs: 004012AF
already exists in the current directory. Overwrite?, xrefs: 0040126F
Bitte whlen Sie einen Ordner zum Speichern der Dateien aus., xrefs: 004011CA
Can not create some of your include files., xrefs: 0040121F
2, xrefs: 004012D6
Can not allocate the memory., xrefs: 0040122F
Ein unbekannter Fehler ist aufgetreten. Das Programm wird beendet., xrefs: 004011AA
The file , xrefs: 0040125F
Bitte geben Sie das Passwort ein., xrefs: 004011EA
"*, xrefs: 00401383
This program is not supported on this operating system., xrefs: 0040128F
Die Datei , xrefs: 0040118A
Overwrite?, xrefs: 0040124F
Choose a location to save the files., xrefs: 0040129F
Fehler!, xrefs: 0040113A
Passwort, xrefs: 004011DA
Wrong password., xrefs: 0040123F
Falsches Passwort., xrefs: 0040116A
\BDFINOPS, xrefs: 00401A4D
Continue?, xrefs: 004011FF

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: Heap$AllocateCreate$Initialize$CriticalExitFreeHandleLoadModuleProcessSectionmemset$CharCursorDefaultDestroyF781IconLangLanguageLowerMessageNameObjectStockUserstrlenstrncpy
String ID: "*$ already exists in the current directory. Overwrite?$2$An unknown error occured. The program will be terminated.$Bitte geben Sie das Passwort ein.$Bitte whlen Sie einen Ordner zum Speichern der Dateien aus.$Can not allocate the memory.$Can not create some of your include files.$Choose a location to save the files.$Continue?$Die Datei $Ein unbekannter Fehler ist aufgetreten. Das Programm wird beendet.$Einige Include Dateien konnten nicht erstellt werden.$Error!$Falsches Passwort.$Fehler!$Fortfahren?$Overwrite?$Password$Passwort$Please enter the password.$The file $This program is not supported on this operating system.$Wrong password.$\BDFINOPS$deutsch
API String ID: 52241757-4079455548
Opcode ID: f54154b58939660886aa1753846721257ab89259d8018ab4a3b5c12191934324
Instruction ID: 3783c48d9a695ad555a110271d4ece50a90aebaed67b6da37d86febcd6e90675
Opcode Fuzzy Hash: f54154b58939660886aa1753846721257ab89259d8018ab4a3b5c12191934324
Instruction Fuzzy Hash: CE423C71250201EBD700BF62EE62E693B65EB48749F50403BF9007E2F2CB7D5951AB9E

Function 00406060 Relevance: 7.6, APIs: 5, Instructions: 100
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,023305B8,?,?,?,023312E0,?,00406244,00000001,00000000), ref: 00406090
CreateFileA.KERNEL32(?,C0000000,00000001,00000000,00000004,00000080,00000000,023305B8,?,?,?,023312E0,?,00406244,00000001,00000000), ref: 004060B2
RtlAllocateHeap.NTDLL(02330000,00000000,00001000), ref: 00406116

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: CreateFile$AllocateHeap
String ID:
API String ID: 2813278966-0
Opcode ID: dacec175d2f13c65ab783333143c09b2bd774a12aeda7b94236f53bba455d297
Instruction ID: 01b71ff79a8bf0c406e829018b558c6d2fff1d90de16ee11da95a5ed4ef269dc
Opcode Fuzzy Hash: dacec175d2f13c65ab783333143c09b2bd774a12aeda7b94236f53bba455d297
Instruction Fuzzy Hash: 2521E77278031176E6309B28AD06F57B3589744B71F22873AFB62BB2C1C6B5AC60479D

Function 00402779 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteEx.SHELL32(?), ref: 004027F1
Sleep.KERNEL32(00000019), ref: 004027FF
GetExitCodeProcess.KERNEL32(?,?), ref: 00402810

Strings

open, xrefs: 004027D0

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: CodeExecuteExitProcessShellSleep
String ID: open
API String ID: 3887608683-2758837156
Opcode ID: df14b4278b00ed0d26c83213d7738cdcd665813f5d206012612cba75c38f70a4
Instruction ID: 008d11a2a8203ddc74c484c16875f5973d42d86a5d435cc8cf274525409f5c07
Opcode Fuzzy Hash: df14b4278b00ed0d26c83213d7738cdcd665813f5d206012612cba75c38f70a4
Instruction Fuzzy Hash: 0F213A71508309AFD700EF15C841A9FBBE4EF44308F10893EF49866290D779EA15DB86

Function 00406330 Relevance: 6.1, APIs: 4, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(?,?,00000000,00000001,?,?,?,00406298,00000000,?,?,?,023305B8,00000000), ref: 00406352
memcpy.MSVCRT(?,?,00000000,?,?,?,00406298,00000000,?,?,?,023305B8,00000000,?,?,00401A92), ref: 00406390

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: FilePointermemcpy
String ID:
API String ID: 1104741977-0
Opcode ID: b49d06cf3595ba276dc545326d44b73e09d5a742b1af48970d0989ac99cef6b7
Instruction ID: 6313678625fda58dd2c5a9f412bfcc8c508d375f5e4440298ee736b1d6e11be6
Opcode Fuzzy Hash: b49d06cf3595ba276dc545326d44b73e09d5a742b1af48970d0989ac99cef6b7
Instruction Fuzzy Hash: 95316C763006009FC224DF2AD448E5BF7E9EFD4321F14C82EE69697B90C634E854CBA6

Function 004015F4 Relevance: 6.0, APIs: 4, Instructions: 25
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_rmdir.MSVCRT ref: 004015E2
_rmdir.MSVCRT ref: 00401702
ExitProcess.KERNEL32(00000001,00000010,OPS,00000000,00000000,00000000), ref: 00401BBB
HeapDestroy.KERNEL32(00000001,00000010,OPS,00000000,00000000,00000000), ref: 00401BC6
ExitProcess.KERNEL32(00000001,00000010,OPS,00000000,00000000,00000000), ref: 00401BCB

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: ExitProcess_rmdir$DestroyHeap
String ID:
API String ID: 2349447675-0
Opcode ID: ae173b18bee318a8e6ee3c6bd9685daada826712dcb14547edc22c3fc5a19cf2
Instruction ID: 60e15e31e36ec4f341ea57578d9192aa5bb5f3c1abe7231800a78ac4dbabb27b
Opcode Fuzzy Hash: ae173b18bee318a8e6ee3c6bd9685daada826712dcb14547edc22c3fc5a19cf2
Instruction Fuzzy Hash: 98E0E57106460099D9407BB2A993A1D29689F8835EF10047FF582781E39A3D5651657F

Function 00401BAC Relevance: 6.0, APIs: 4, Instructions: 15
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 00401BB1
ExitProcess.KERNEL32(00000001,00000010,OPS,00000000,00000000,00000000), ref: 00401BBB
HeapDestroy.KERNEL32(00000001,00000010,OPS,00000000,00000000,00000000), ref: 00401BC6
ExitProcess.KERNEL32(00000001,00000010,OPS,00000000,00000000,00000000), ref: 00401BCB

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: ExitProcess$DestroyFreeHeapLibrary
String ID:
API String ID: 2053948195-0
Opcode ID: 11df7a65c876ebf354b943cab2a5a00fea6b763c2f44af75c1fb0680a71a7411
Instruction ID: a76ebcc7f67d18b801f3b767a6748b9316446318bb46ef4dd2753a3a033da90a
Opcode Fuzzy Hash: 11df7a65c876ebf354b943cab2a5a00fea6b763c2f44af75c1fb0680a71a7411
Instruction Fuzzy Hash: 7AD095700A062080EA80BBF36813A4C2C1C8F88B8EF4580BFB141380E39E3C921416BF

Function 00406170 Relevance: 4.6, APIs: 3, Instructions: 72
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(00000000,C0000000,00000001,00000000,00000002,00000080,00000000,023305B8,00000000,?,?,?,00000000,00401A7E,00000001,00000000), ref: 004061A4
CreateFileA.KERNEL32(00000000,40000000,00000001,00000000,00000005,00000000,00000000,?,?,?,00000000,00401A7E,00000001,00000000,00000000,0040A0C7), ref: 004061BD
RtlAllocateHeap.NTDLL(02330000,00000000,00001000), ref: 004061DA

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: CreateFile$AllocateHeap
String ID:
API String ID: 2813278966-0
Opcode ID: 99a9d3515a7f5ea1aac53cc33fb41400ef055c128be24c43cb4af01eba4f15bd
Instruction ID: 000130b85e76915fa5d363925ece99765dbccc5cf3196bdbfab5f4711e28a0ca
Opcode Fuzzy Hash: 99a9d3515a7f5ea1aac53cc33fb41400ef055c128be24c43cb4af01eba4f15bd
Instruction Fuzzy Hash: F211B67234030066D230AB69AD49F57B798D790B71F21872AF3A1BB2D1C7B6A8548768

Function 00405F13 Relevance: 4.5, APIs: 3, Instructions: 38
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strncpy.MSVCRT ref: 00405F31
strlen.MSVCRT ref: 00405F41
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00405F7E

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: CreateDirectorystrlenstrncpy
String ID:
API String ID: 2535372781-0
Opcode ID: 5f9ec9ca626cb59e2bb931f94f6eb124402c094757fdd0720826d6c6c0dd85c4
Instruction ID: 106eb3b8964d5d9676c23aae3fc3b966741f8cbe397171ba60076510be6c1ab0
Opcode Fuzzy Hash: 5f9ec9ca626cb59e2bb931f94f6eb124402c094757fdd0720826d6c6c0dd85c4
Instruction Fuzzy Hash: 0701F9319086099EDB21DA24CC89BEB77799B10344F5400B6E5C4E21D1DBBC9BC8CF1A

Function 00401BF4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00403DC0: RtlAllocateHeap.NTDLL(02510000,00000008,00000000), ref: 00403DD1

Part of subcall function 00405EB2: GetTempPathA.KERNEL32(00000104,00000000,00000104,004013CA,?,?,?,00000000,00401C13,00000000,00000000,00000400,00000000,00000000,00000000,00000000), ref: 00405EC9
Part of subcall function 00405EB2: LoadLibraryA.KERNEL32(Kernel32.DLL,?,?,?,00000000,00401C13,00000000,00000000,00000400,00000000,00000000,00000000,00000000,004013CA,OPS,00000000), ref: 00405ED6
Part of subcall function 00405EB2: GetProcAddress.KERNEL32(00000000,GetLongPathNameA), ref: 00405EE8
Part of subcall function 00405EB2: GetLongPathNameA.KERNELBASE(00000000,00000000,00000104,?,?,?,00000000,00401C13,00000000,00000000,00000400,00000000,00000000,00000000,00000000,004013CA), ref: 00405EF5
Part of subcall function 00405EB2: FreeLibrary.KERNEL32(00000000,?,?,?,00000000,00401C13,00000000,00000000,00000400,00000000,00000000,00000000,00000000,004013CA,OPS,00000000), ref: 00405EFA

GetTempFileNameA.KERNEL32(?,0040A00D,00000000,?,00000000,00000400,00000000,00000000,00000000,00000000,004013CA,OPS,00000000,00000000,00000000), ref: 00401C2E

Part of subcall function 00403E50: memcpy.MSVCRT(00000000,00000000,00000000,00000000,004013CA,?,?,00000000,00401C43,00000000,00000000,00000000,?,0040A00D,00000000), ref: 00403E83

Part of subcall function 00403E30: HeapFree.KERNEL32(02510000,00000000,00000000,00401113,00000000,00000000), ref: 00403E3E

Part of subcall function 00405F13: strncpy.MSVCRT ref: 00405F31
Part of subcall function 00405F13: strlen.MSVCRT ref: 00405F41
Part of subcall function 00405F13: CreateDirectoryA.KERNELBASE(?,00000000), ref: 00405F7E

Part of subcall function 00405DD5: GetCurrentDirectoryA.KERNEL32(00000104,00000000,00000104,?,?,?,00000000,00401C79,00000000,00000000,00000000,00000000,?,0040A00D,00000000), ref: 00405DEB

Part of subcall function 004074F0: strlen.MSVCRT ref: 00407503

Strings

"*, xrefs: 00401CBA

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: DirectoryFreeHeapLibraryNamePathTempstrlen$AddressAllocateCreateCurrentFileLoadLongProcmemcpystrncpy
String ID: "*
API String ID: 4243183096-3137671172
Opcode ID: 258b0bdd16078e4e43f2e8e261a203eec998e560d85382cff294dbf00959b2b4
Instruction ID: 51c46ce23f5c993c5dfa76041344c512df945007a9040ee44b4dad7dc5fa6996
Opcode Fuzzy Hash: 258b0bdd16078e4e43f2e8e261a203eec998e560d85382cff294dbf00959b2b4
Instruction Fuzzy Hash: 9A3110701143019FC700EF75ED92A5B7B69EB44315F50483EB440B61B2CB39AD419B9D

Function 00407470 Relevance: 3.0, APIs: 2, Instructions: 18
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000001,00001000,00000000), ref: 0040747C
RtlAllocateHeap.NTDLL(02300000,00000001,00004104), ref: 004074AA

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: Heap$AllocateCreate
String ID:
API String ID: 2875408731-0
Opcode ID: d8f8987bb97edb255ba3889bf5c0dc041ec10e30f73c29571913b02a327f35f2
Instruction ID: 19be193239eadfd6624696bddd9959c39b43b36c58367bdf702e2eb6773df9a6
Opcode Fuzzy Hash: d8f8987bb97edb255ba3889bf5c0dc041ec10e30f73c29571913b02a327f35f2
Instruction Fuzzy Hash: 2AE0B6B018030AAFE3008F52EE45B553BA8E304704F108425FE44AB2E2C7B66454AFAD

Function 00403694 Relevance: 3.0, APIs: 2, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

6F781CD0.COMCTL32(0040106C,00000000,00001000,00000000,00000000), ref: 00403694
CoInitialize.OLE32(00000000), ref: 0040369B

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: F781Initialize
String ID:
API String ID: 2647752693-0
Opcode ID: 49e222b2d56f548959c65dd71d5b368c1574338499d51fc90ab1b458b9a7ed0b
Instruction ID: 29068fd5cd95f449554aa114ea224efd59727ecef1bc25bc8998cc2648164d1b
Opcode Fuzzy Hash: 49e222b2d56f548959c65dd71d5b368c1574338499d51fc90ab1b458b9a7ed0b
Instruction Fuzzy Hash: DAA0027194924056DD4477619A0B7093650578178AF0084E9B506752D64E78182185BB

Function 00407750 Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(02300000,00000001,02300700,000040FF), ref: 00407797

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b741e1a18e1ec6a1c8cc36c4e8ff102d5075275f906b6a1070ac9639d2900657
Instruction ID: c9249488049c71a3dc6bfb1d13f9ea7f9653b61409185b4aebe1202f111d2c66
Opcode Fuzzy Hash: b741e1a18e1ec6a1c8cc36c4e8ff102d5075275f906b6a1070ac9639d2900657
Instruction Fuzzy Hash: 6F01F275900208EFC708CF59EA81A597BF4EB88304B10C039ED49A7352D334AA64DFAE

Function 004030A0 Relevance: 1.5, APIs: 1, Instructions: 26
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,-00000018,00000401), ref: 004030B5

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: fde173810f0f770b3ee8f92bf0d91459233e569a11f5aae0c4369e4be50e7f1b
Instruction ID: 45182e430f07211e2c2e7b9e92e733268b633b3e5bb8cd087db9ad99d1a89cb5
Opcode Fuzzy Hash: fde173810f0f770b3ee8f92bf0d91459233e569a11f5aae0c4369e4be50e7f1b
Instruction Fuzzy Hash: 5BF0BCB1604701AFC308CF05C940A0AFBE6EFC9311F25C96AE4889B36AE775D842CB91

Function 00405F90 Relevance: 1.5, APIs: 1, Instructions: 24fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,?,?,00000000,00000000,00000000,?,004063E4,00000000,?,?,?,00406298,00000000,?,?), ref: 00405FB5

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: e39570a374a9e73ecbca4878267657e2ccddeabf15ea9a18561b4119754d7263
Instruction ID: eebe7d1dfbf70ebc15f045d01e808d655b32d5a11f46bacfc96fedd4abe8ca9e
Opcode Fuzzy Hash: e39570a374a9e73ecbca4878267657e2ccddeabf15ea9a18561b4119754d7263
Instruction Fuzzy Hash: 90E0AEB6514701AFC324DF68C948C67B7F8EB88620B00C92EA49A93A00E630F840CF61

Function 00403D90 Relevance: 1.5, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,00401062,00000000,00001000,00000000,00000000), ref: 00403D99

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 5ebacb2a8a1c22710d2d4a0e59dd9adb87e4cd845f16d6a5353a8221d79a7afd
Instruction ID: e6ed55b92d251dbf60f0c4db2285402f79bbd6f4894813bfaa03374b9dc15d69
Opcode Fuzzy Hash: 5ebacb2a8a1c22710d2d4a0e59dd9adb87e4cd845f16d6a5353a8221d79a7afd
Instruction Fuzzy Hash: 7CB012B428130056E3200B105D06B003530D304B43F144021B644781E5C7F010104E0F

Non-executed Functions

Function 00405D3C Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 60keyboardwindowstringCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000009), ref: 00405D4A
GetKeyState.USER32(00000011), ref: 00405D52
GetKeyState.USER32(00000010), ref: 00405D5A
GetKeyState.USER32(00000012), ref: 00405D62
GetFocus.USER32 ref: 00405D74
GetClassNameA.USER32(00000000), ref: 00405D77
strncmp.MSVCRT ref: 00405D88
GetFocus.USER32 ref: 00405D9B
SendMessageA.USER32(00000000), ref: 00405D9E
GetPropA.USER32(?,PB_WindowID), ref: 00405DB2

Strings

PB_WindowID, xrefs: 00405DAA
Rich, xrefs: 00405D82

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: State$Focus$ClassMessageNamePropSendstrncmp
String ID: PB_WindowID$Rich
API String ID: 2735883691-1396934994
Opcode ID: 2786138d884ec91afe30685b1d2f9404e6739455fca6a10e8f2cf972b6164ca8
Instruction ID: 295880306d369912066631a8706d072366ea9287afa58a3d02d5e853e8738312
Opcode Fuzzy Hash: 2786138d884ec91afe30685b1d2f9404e6739455fca6a10e8f2cf972b6164ca8
Instruction Fuzzy Hash: 1F0125715407286AED006B61DD0AF9B3F6CEF10744F048533B901F71D6D679A815DAAA

Function 00404714 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 61nativeCOMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F4), ref: 0040471F
CallWindowProcA.USER32(?,?,?,?,?), ref: 00404748
RemovePropA.USER32(?,PB_ID), ref: 00404773
RemovePropA.USER32(?,PB_DropAccept), ref: 0040477B
RevokeDragDrop.OLE32(?), ref: 00404782
SetWindowLongA.USER32(?,000000F4,000000FF), ref: 0040478D
NtdllDefWindowProc_A.NTDLL(?,?,?,?), ref: 004047AF

Strings

PB_DropAccept, xrefs: 00404775
PB_ID, xrefs: 0040476D

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: Window$LongPropRemove$CallDragDropNtdllProcProc_Revoke
String ID: PB_DropAccept$PB_ID
API String ID: 1182866496-3688647018
Opcode ID: e24715f7b2ca1719647f69d9aaab655f391fd5491f897dae3125c14ef974b860
Instruction ID: 26d55dd3bc0a13faf615adc1f81c0240ac0331d9be61dc94d2e7277a1ea7d7dc
Opcode Fuzzy Hash: e24715f7b2ca1719647f69d9aaab655f391fd5491f897dae3125c14ef974b860
Instruction Fuzzy Hash: 36118231000205BFCB016F65ED84D6B3BB9EB867747108235F925721E1C7399C219B6A

Function 00407E1A Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 71memorynativeCOMMON

Download Yara Rule

APIs

sprintf.MSVCRT ref: 00407E31
GetPropA.USER32(?,?), ref: 00407E40
HeapFree.KERNEL32(00000000,?), ref: 00407E95
HeapFree.KERNEL32(00000000,00000000), ref: 00407E9F
RemovePropA.USER32(?,?), ref: 00407EA8
CallWindowProcA.USER32(?,?,00000082,?,?), ref: 00407EC3
NtdllDefWindowProc_A.NTDLL(?,?,?,?), ref: 00407ED7

Strings

PB_GadgetStack_%i, xrefs: 00407E2B

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: FreeHeapPropWindow$CallNtdllProcProc_Removesprintf
String ID: PB_GadgetStack_%i
API String ID: 1062891511-1190326050
Opcode ID: e84caf6ab20a979853fd8a155a0d10c59c3a74f03406633f4e3a48b8313abcd8
Instruction ID: 9495be4684c954f4985c5bbed51e6b929ec62d50171bbc7e14f773bf1326b445
Opcode Fuzzy Hash: e84caf6ab20a979853fd8a155a0d10c59c3a74f03406633f4e3a48b8313abcd8
Instruction Fuzzy Hash: F9213772901209FFCF019F90ED44CAA7B7AFB44345B10807AF905A6270D735AE61EB9A

Function 00405B1F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 004056EF: GetPropA.USER32(?,PB_WindowID), ref: 00405736
Part of subcall function 004056EF: GetParent.USER32(?), ref: 00405746

GetPropA.USER32(?,PB_MDI_Gadget), ref: 00405B47
DefFrameProcA.USER32(?,00000000,?,?,?), ref: 00405B88
SetLastError.KERNEL32(00000000), ref: 00405B92
NtdllDefWindowProc_A.NTDLL(?,?,?,?), ref: 00405BA8

Strings

PB_MDI_Gadget, xrefs: 00405B41

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: Prop$ErrorFrameLastNtdllParentProcProc_Window
String ID: PB_MDI_Gadget
API String ID: 1329112550-983833826
Opcode ID: 269fd701e99a7b285811eae7f8217e619eb12575e1e2615cef081d2ae9d6db4b
Instruction ID: d2e232ab503cb8b3b068a5d0a19e0a488f47f1087f69ffadd7d86e8e816e6ed0
Opcode Fuzzy Hash: 269fd701e99a7b285811eae7f8217e619eb12575e1e2615cef081d2ae9d6db4b
Instruction Fuzzy Hash: EC114C3190161DAFDB209E159D84EBF3A3CEB44350F004037F905B22808778BC61DAAA

Function 00403B70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(0;@,00401302,00000000), ref: 00403BAC
SetUnhandledExceptionFilter.KERNEL32(00000000,00401302,00000000), ref: 00403BC0

Strings

0;@, xrefs: 00403B90, 00403BAB
0;@, xrefs: 00403B70

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID: 0;@$0;@
API String ID: 3192549508-1108649562
Opcode ID: 64c2b6b9c31235df9d05b2dba24abafc85a962d7f965a94dd5b50041edd19de7
Instruction ID: 03ed1251e5b82d0a9b1dd8357dd2ea466bfd254288420da3d75d37e4e8d64f8a
Opcode Fuzzy Hash: 64c2b6b9c31235df9d05b2dba24abafc85a962d7f965a94dd5b50041edd19de7
Instruction Fuzzy Hash: 2EF0A5B0545300DBC700DF94DA8C60A7BF8EBA875AF00887EA005A7361C778DA90DB9E

Function 004020C9 Relevance: 4.5, APIs: 3, Instructions: 27COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(004013B1,00000000,0000000A), ref: 004020E6
LoadResource.KERNEL32(?,00000000,00000000,00000000,004013B1,OPS,00000000,00000000), ref: 004020FE
SizeofResource.KERNEL32(?,00000000,?,00000000,00000000,00000000,004013B1,OPS,00000000,00000000), ref: 00402110

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: Resource$FindLoadSizeof
String ID:
API String ID: 507330600-0
Opcode ID: aa1a8b08b7dc22c46b1c861aeba25619853496701750f453b4bb729b9282f012
Instruction ID: ee1045747f34407a6d6bc23282b484ecb6b20e6a617ab4d886f8bfa51eb75997
Opcode Fuzzy Hash: aa1a8b08b7dc22c46b1c861aeba25619853496701750f453b4bb729b9282f012
Instruction Fuzzy Hash: 05F0B770508301EFC705AF20DE05A1EBAE5FB98B05F008C3EB5886A1A1D7359D24EB4A

Function 00423173 Relevance: 4.2, Strings: 3, Instructions: 478COMMON

Download Yara Rule

Strings

, xrefs: 00423735
N, xrefs: 00423407
M, xrefs: 00423323

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID:
String ID: $M$N
API String ID: 0-813528018
Opcode ID: 296eed21de5bc5a5b87bd96189a2c08ec8076c82fe3154c41960cc97ffc7d6a5
Instruction ID: c1850dc7fb9948695e9b9607665a1da3ec38db9305dac3888d0e67d99c0468f0
Opcode Fuzzy Hash: 296eed21de5bc5a5b87bd96189a2c08ec8076c82fe3154c41960cc97ffc7d6a5
Instruction Fuzzy Hash: 1802C370A00218FFDB21DF54EC45AAE7BB5FB44315F50816AF610AA2A1C77D9A42CF58

Function 00403CD7 Relevance: 3.1, APIs: 2, Instructions: 75COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 00403CF8
GetVersionExA.KERNEL32(?), ref: 00403D2C

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: ba98cba157ab3b960229647d21839f567787df23c3c7d879bd2f0e37a5dce517
Instruction ID: 8f98cf7366f8b09a5e2b92140d047ce8a00d89b420ca6a4debb2036adb0e8e2a
Opcode Fuzzy Hash: ba98cba157ab3b960229647d21839f567787df23c3c7d879bd2f0e37a5dce517
Instruction Fuzzy Hash: 1E117231644A0A95EF309E689845FAF7EACAF10747F140037A201B53D4E67C8B46C66F

Function 00403CC0 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,00401BDA,00401BC0,00000001,00000010,OPS,00000000,00000000,00000000), ref: 00403CC6

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: e0e7740ab41f41c427503136dfe7f7d29bd2fdb7ab83b42a702d68ec8da14e00
Instruction ID: cd7c64c5dc77f132242c3daac67179aa2c9d7864a58c2e899d60234b9b4753e9
Opcode Fuzzy Hash: e0e7740ab41f41c427503136dfe7f7d29bd2fdb7ab83b42a702d68ec8da14e00
Instruction Fuzzy Hash: 64B092740402008BCB008B90EE8C74836A4E398214F8009A8A000A6230C33880808BCD

Function 00406C10 Relevance: .6, Instructions: 601COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1d082fc67961cf9c9017bdebd9d0fdabf83cbc1f99fd689fd60a11460bf935a
Instruction ID: 7102d13b211e639c190c95f68438129d24ba1901ff3681f10da7641a22d18450
Opcode Fuzzy Hash: a1d082fc67961cf9c9017bdebd9d0fdabf83cbc1f99fd689fd60a11460bf935a
Instruction Fuzzy Hash: 7A12D3BBA557124BD708CA55CC80295B3E3BBC8364B1F913DD959D3305EEB9BA0B46C0

Function 0040D9C0 Relevance: .4, Instructions: 375COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eb5f94d6d0be51d33e17c60d64c3c9350acf6c8481f3ed75c10603f2939ffed
Instruction ID: b85d43cf09f5069055057e0f9dd4e3a5ce79a5ed486bef41d357e511c92d6c7a
Opcode Fuzzy Hash: 3eb5f94d6d0be51d33e17c60d64c3c9350acf6c8481f3ed75c10603f2939ffed
Instruction Fuzzy Hash: B7E1F571A042418FD718CF69C4906AAB7E2EFCC304F0985BEE889EB355DB34EA45CB45

Function 0040E240 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d925c00ae1dd091c8efefa3aaaf8493b12ef5f9ccbdbcf6b88be7bd9186c30f9
Instruction ID: 55f82a2a2860603184d5158b03bdb4406137b8e9b15ddf23800e49180ff61f50
Opcode Fuzzy Hash: d925c00ae1dd091c8efefa3aaaf8493b12ef5f9ccbdbcf6b88be7bd9186c30f9
Instruction Fuzzy Hash: 24C150326083D14FD705CF7D94A00ABFFE1AF9E300B5E94ADE5D99B352C574A4098B89

Function 0040DE80 Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e08022115337b6a48b31d80d8b8fdce5f5367cf90ea7c3831ccbe139a2457d1
Instruction ID: e1b82d14655f62c6ea2909a00c3306c027c3f8bf08d7b58be1d298e62f910c97
Opcode Fuzzy Hash: 0e08022115337b6a48b31d80d8b8fdce5f5367cf90ea7c3831ccbe139a2457d1
Instruction Fuzzy Hash: B8C18D266082C24FD305CF7988D00ABFFE2AFDE204B4E95ADE5C99B362C57594498789

Function 00424A51 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9159130f6e97a1f63c990d67648fd71c31b14a0cedd044277c05469dce088cf0
Instruction ID: ae2b8487e3aea49084d6fd28d5a3ed456773d8e70f5b5837c631c5ba5c29d16b
Opcode Fuzzy Hash: 9159130f6e97a1f63c990d67648fd71c31b14a0cedd044277c05469dce088cf0
Instruction Fuzzy Hash: FEB13675E00269CBCF18CFA9D8942EDBBB0FF44305F64856EC456AB281D7781A8ACF45

Function 0040E930 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f13e73bcc20d6da386c3673c597a920b835246fb3133f97e2dd74b96cf6a4e2
Instruction ID: 29a3946611212e07eba827bf4ec3dd965f785ad503a435f61f8e75341ee429c7
Opcode Fuzzy Hash: 3f13e73bcc20d6da386c3673c597a920b835246fb3133f97e2dd74b96cf6a4e2
Instruction Fuzzy Hash: B791BF756083828FC718CF29D8806AABBE2FFC9304F18487EE989D7351D635E915CB85

Function 0040E630 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce511f72298da0d49d558c10a5ff1193a7f805c1641b3a629b5ce4ada354f5cd
Instruction ID: 04d1cfc55325213d7eac5a63abe2581ec3c557b6e87fb71a75c23a52b251ea84
Opcode Fuzzy Hash: ce511f72298da0d49d558c10a5ff1193a7f805c1641b3a629b5ce4ada354f5cd
Instruction Fuzzy Hash: 9991D0756083828FC718CF29D8806AABBE2FFC9304F14497EE989D7341D635E916CB85

Function 0040EC30 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54305795cb5eab5a73fbc3fcf3239a085ce63c2c27f643dafc7d4a3a57f488cd
Instruction ID: 0129dfdfa06e8e145608a72f25beec552b62ecacafaafa8e4a62ac3fa9911df8
Opcode Fuzzy Hash: 54305795cb5eab5a73fbc3fcf3239a085ce63c2c27f643dafc7d4a3a57f488cd
Instruction Fuzzy Hash: E761D3316043458BC714DF26D8809ABB7E6EFCD704F04897EE889BB381C6799E198B59

Function 0040EE90 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee8ba0f6775abdc610cca4af624066302448de64448e7960d18526cae57c8319
Instruction ID: 60a83fcbf127d852f21b6d02f3097c58393ed52201a3528062d383d887290a9d
Opcode Fuzzy Hash: ee8ba0f6775abdc610cca4af624066302448de64448e7960d18526cae57c8319
Instruction Fuzzy Hash: EE61D4316043468BC715DF25D8509ABB7E6BBC8304F04497FFC89BB381C679AA0ACB59

Function 0040523F Relevance: 46.8, APIs: 31, Instructions: 333windowkeyboardCOMMON

Download Yara Rule

APIs

SystemParametersInfoA.USER32(00000026,00000000,?,00000000), ref: 00405290
GetWindowRect.USER32(?,00000010), ref: 004052B8
GetWindowRect.USER32(?,00000020), ref: 004052C1
GetSystemMetrics.USER32(0000003D), ref: 004052D1
GetSystemMetrics.USER32(0000003E), ref: 004052D8
GetWindowLongA.USER32(?,000000F0), ref: 004052E2
GetSystemMetrics.USER32(00000005), ref: 004052F1
GetWindowLongA.USER32(?,000000EC), ref: 004052FC
GetSystemMetrics.USER32(0000002D), ref: 0040530A
GetSystemMetrics.USER32(0000002E), ref: 00405311
GetSystemMetrics.USER32(00000022), ref: 00405320
GetSystemMetrics.USER32(00000023), ref: 00405327
GetSystemMetrics.USER32(0000003B), ref: 0040532E
GetSystemMetrics.USER32(0000003C), ref: 00405335
SendMessageA.USER32(?,00000024,00000000,00000034), ref: 0040534A
GetKeyState.USER32(00000001), ref: 0040534E
SendMessageA.USER32(?,00000201,00000001,00000000), ref: 00405364
SetCapture.USER32(?), ref: 00405369
PostMessageA.USER32(?,00000231,00000000,00000000), ref: 00405379
GetCursorPos.USER32(-00000008), ref: 0040538F
LoadImageA.USER32(00000000,00007F86,00000002,00000000,00000000,00008040), ref: 004053A4
SetCursor.USER32(00000000), ref: 004053AB
MapWindowPoints.USER32(?,00000000,?,00000001), ref: 004053E7
SendMessageA.USER32(?,00000214,?,00000010), ref: 0040540A

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: System$Metrics$Window$Message$Send$CursorLongRect$CaptureImageInfoLoadParametersPointsPostState
String ID:
API String ID: 985555588-0
Opcode ID: 01a2725190c872bf159c5bd0852e996972fb722d7f3f84b5786a012411d90e5f
Instruction ID: 586f9979426b920aefc07ff19cb97ca9c93cebbcd8dc2859b64a59a748dbd016
Opcode Fuzzy Hash: 01a2725190c872bf159c5bd0852e996972fb722d7f3f84b5786a012411d90e5f
Instruction Fuzzy Hash: ADC1A271A00A06BFDB10AF64CD48ABB7B75FB04340F50453BF905A66D0D779A8A1CF99

Function 00404B03 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 238memoryregistryCOMMON

Download Yara Rule

APIs

sprintf.MSVCRT ref: 00404B46
memset.MSVCRT ref: 00404B63
RegisterClassA.USER32(?), ref: 00404BA8
AdjustWindowRect.USER32(?,00000010,00000000), ref: 00404C01
GetSystemMetrics.USER32(00000000), ref: 00404C3E
GetSystemMetrics.USER32(00000001), ref: 00404C58
GetActiveWindow.USER32 ref: 00404C7F
GetWindowRect.USER32(?,?), ref: 00404C8E
CreateWindowExA.USER32(00000000,?,?,00000010,?,?,00000001,?,?,00000000,00000000), ref: 00404CEF
SetPropA.USER32(00000000,PB_WindowID,00000100), ref: 00404D0C
ShowWindow.USER32(00000000,00000001), ref: 00404D33
RtlAllocateHeap.NTDLL(00000000,0000000C), ref: 00404D58
CreateAcceleratorTableA.USER32(?,?), ref: 00404D95
UnregisterClassA.USER32(?), ref: 00404DC9

Part of subcall function 004066BB: memset.MSVCRT ref: 004066D8

Strings

PB_WindowID, xrefs: 00404D06
WindowClass_%d, xrefs: 00404B40

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: Window$ClassCreateMetricsRectSystemmemset$AcceleratorActiveAdjustAllocateHeapPropRegisterShowTableUnregistersprintf
String ID: PB_WindowID$WindowClass_%d
API String ID: 1820370190-2937193648
Opcode ID: e722d2cbf670614303020c1e730dda992e2a6a8db4ea0d57e5f5c4a9d38830f9
Instruction ID: c7ce8232fcfdd9da0e6d01810650b6905c309b16ddaece5cc0acf35632e3a176
Opcode Fuzzy Hash: e722d2cbf670614303020c1e730dda992e2a6a8db4ea0d57e5f5c4a9d38830f9
Instruction Fuzzy Hash: 49A17BB190020ADFDB10CF68D989B9EBBF4FF44344F14862AF955A32A0D778D950CB99

Function 004036F8 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 106librarystringloaderCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00403718
memset.MSVCRT ref: 00403725
LoadLibraryA.KERNEL32(SHELL32.DLL), ref: 00403732
strncpy.MSVCRT ref: 00403763
strlen.MSVCRT ref: 00403772
GetProcAddress.KERNEL32(?,SHBrowseForFolder), ref: 0040379C
GetProcAddress.KERNEL32(?,SHGetPathFromIDList), ref: 004037EB
CoTaskMemFree.COMBASE(?), ref: 00403806
strlen.MSVCRT ref: 0040380D
FreeLibrary.KERNEL32(?,00000000), ref: 00403829

Strings

@, xrefs: 004037B7
SHELL32.DLL, xrefs: 0040372D
SHGetPathFromIDList, xrefs: 004037E3
SHBrowseForFolder, xrefs: 00403794

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: AddressFreeLibraryProcstrlen$InitializeLoadTaskmemsetstrncpy
String ID: @$SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
API String ID: 1137656791-1801489780
Opcode ID: 00adc2b8da381255dd164f99cb6407cbd1248913ca3723a3718b7c387585913b
Instruction ID: ea8c443e7643bfdbcdfbd2f4adfdb3851681cb8806fbf168f8689d10ea387318
Opcode Fuzzy Hash: 00adc2b8da381255dd164f99cb6407cbd1248913ca3723a3718b7c387585913b
Instruction Fuzzy Hash: 35418F71800208AFDB11AFA5CC45ADE7FB8AF05315F0080BAF554B7292D7B99E14CB69

Function 00404925 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 73memorywindowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(00000000,00000004), ref: 0040494B
SetActiveWindow.USER32(00000000), ref: 0040495C
RemovePropA.USER32(00000000,PB_WindowID), ref: 00404970
RemovePropA.USER32(00000000,PB_DropAccept), ref: 00404979
RevokeDragDrop.OLE32(00000000), ref: 00404982
SendMessageA.USER32(?,00000221,00000000,00000000), ref: 00404999
sprintf.MSVCRT ref: 004049B8
UnregisterClassA.USER32(?), ref: 004049CD
HeapFree.KERNEL32(00000000,?), ref: 004049E3
DestroyAcceleratorTable.USER32(?), ref: 004049EC
DeleteObject.GDI32(?), ref: 004049FA

Strings

PB_WindowID, xrefs: 00404969
PB_DropAccept, xrefs: 00404972
WindowClass_%d, xrefs: 004049B2

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: PropRemoveWindow$AcceleratorActiveClassDeleteDestroyDragDropFreeHeapMessageObjectRevokeSendTableUnregistersprintf
String ID: PB_DropAccept$PB_WindowID$WindowClass_%d
API String ID: 192457453-976223216
Opcode ID: bd1377bf46f55631dd1ddbc54ba1d147947137b251771725122199eddbfbce36
Instruction ID: f0b996a718386a9457227e303234a4a67d6852f77ee41d513e9fa1cdc6f7bee2
Opcode Fuzzy Hash: bd1377bf46f55631dd1ddbc54ba1d147947137b251771725122199eddbfbce36
Instruction Fuzzy Hash: 38214C71500304EBDB226F61DD09F57BBB9EB44740F148436BA81B21A4C77AD8619B9D

Function 00404F24 Relevance: 16.6, APIs: 11, Instructions: 121windowmemoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?), ref: 00404F58
HeapFree.KERNEL32(00000000,?), ref: 00404F64
HeapFree.KERNEL32(00000000,?), ref: 00404F90
PeekMessageA.USER32(?,00000000,00000000,00000000,00000003), ref: 00404FB8
MsgWaitForMultipleObjects.USER32(00000000,00000000,00000000,000000FF,000001FF), ref: 00404FD5
PeekMessageA.USER32(?,00000000,00000000,00000000,00000003), ref: 00404FEB
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00404FF7
GetActiveWindow.USER32 ref: 00404FFD
TranslateAccelerator.USER32(00000000,00000000,?), ref: 00405015
TranslateMessage.USER32(?), ref: 00405023
DispatchMessageA.USER32(?), ref: 0040502D

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: Message$FreeHeap$PeekTranslate$AcceleratorActiveDispatchMultipleObjectsWaitWindow
String ID:
API String ID: 1286715895-0
Opcode ID: afd76d8d9969832cc39f3518b52fe6eee0ff68f092de640222f9704823c623ab
Instruction ID: 6edb0f9935199db0e56a2c8fe76ef196a0bcbb4c32eec9ba7cc802ce8dc129a4
Opcode Fuzzy Hash: afd76d8d9969832cc39f3518b52fe6eee0ff68f092de640222f9704823c623ab
Instruction Fuzzy Hash: 6C414CB1900705AFCB20DF65DD88C6BBBF8EB85740710853AF556E62A0D338D941CBA9

Function 00405C70 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78windowstringCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 00405C79
GetFocus.USER32 ref: 00405C82
IsChild.USER32(00000001,00000000), ref: 00405C99
GetClassNameA.USER32(00000000,?,00000032), ref: 00405CB3
strcmp.MSVCRT ref: 00405CC2
GetParent.USER32(00000000), ref: 00405CD8
SetFocus.USER32(?), ref: 00405D0D

Strings

MDI_ChildClass, xrefs: 00405CBC

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: Focus$ActiveChildClassNameParentWindowstrcmp
String ID: MDI_ChildClass
API String ID: 1701595447-1946758919
Opcode ID: c935cd3b204af58cfbd2e96b124c70a4575aa5a5e9a59dbc8c47a68151999700
Instruction ID: a705aa9bed059d8bd142721d9e0f0f0abb2c12223c0bddd2eb61c98d35858e50
Opcode Fuzzy Hash: c935cd3b204af58cfbd2e96b124c70a4575aa5a5e9a59dbc8c47a68151999700
Instruction Fuzzy Hash: CE212172D04719EBDF11AFA59D888AFBBB8EF44301B24843BE501B2250D7384E51DF5A

Function 004056EF Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 320windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0040523F: SystemParametersInfoA.USER32(00000026,00000000,?,00000000), ref: 00405290
Part of subcall function 0040523F: GetWindowRect.USER32(?,00000010), ref: 004052B8
Part of subcall function 0040523F: GetWindowRect.USER32(?,00000020), ref: 004052C1
Part of subcall function 0040523F: GetSystemMetrics.USER32(0000003D), ref: 004052D1
Part of subcall function 0040523F: GetSystemMetrics.USER32(0000003E), ref: 004052D8
Part of subcall function 0040523F: GetWindowLongA.USER32(?,000000F0), ref: 004052E2
Part of subcall function 0040523F: GetSystemMetrics.USER32(00000005), ref: 004052F1
Part of subcall function 0040523F: GetSystemMetrics.USER32(0000002E), ref: 00405311
Part of subcall function 0040523F: GetSystemMetrics.USER32(00000022), ref: 00405320
Part of subcall function 0040523F: GetSystemMetrics.USER32(00000023), ref: 00405327
Part of subcall function 0040523F: GetSystemMetrics.USER32(0000003B), ref: 0040532E
Part of subcall function 0040523F: GetSystemMetrics.USER32(0000003C), ref: 00405335
Part of subcall function 0040523F: SendMessageA.USER32(?,00000024,00000000,00000034), ref: 0040534A
Part of subcall function 0040523F: GetKeyState.USER32(00000001), ref: 0040534E
Part of subcall function 0040523F: SendMessageA.USER32(?,00000201,00000001,00000000), ref: 00405364
Part of subcall function 0040523F: SetCapture.USER32(?), ref: 00405369
Part of subcall function 0040523F: PostMessageA.USER32(?,00000231,00000000,00000000), ref: 00405379

GetPropA.USER32(?,PB_WindowID), ref: 00405736
GetParent.USER32(?), ref: 00405746
GetClientRect.USER32(?,00000000), ref: 004058A2
FillRect.USER32(?,00000000,?), ref: 004058B2
GetWindowLongA.USER32(?,000000F4), ref: 0040593F
PostMessageA.USER32(?,000030D6,?,?), ref: 00405AB9

Strings

PB_WindowID, xrefs: 0040572E

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: System$Metrics$MessageRectWindow$LongPostSend$CaptureClientFillInfoParametersParentPropState
String ID: PB_WindowID
API String ID: 2736716905-1508741625
Opcode ID: 287e471188106aa8da4b0da2dea19a098f569f3bafd85ad9382638b62a02d066
Instruction ID: 1772321966a510f6b624cdf624929c11ab729ec9b834574b68c11bb728a73535
Opcode Fuzzy Hash: 287e471188106aa8da4b0da2dea19a098f569f3bafd85ad9382638b62a02d066
Instruction Fuzzy Hash: 26B1AE71600A06EBDF20AF55C884ABB7BB1EB54314F60843BE845B62D0D33D9A91EF1D

Function 0040384E Relevance: 10.5, APIs: 7, Instructions: 41threadwindowCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(?,00000000), ref: 00403858
GetCurrentThreadId.KERNEL32 ref: 00403866
IsWindowVisible.USER32(?), ref: 0040386D
IsWindowEnabled.USER32(?), ref: 00403878
GetForegroundWindow.USER32 ref: 00403882
EnableWindow.USER32(?,00000000), ref: 0040388F

Part of subcall function 004067DA: RtlAllocateHeap.NTDLL(00000008,?,00406649), ref: 004067E6

GetCurrentThreadId.KERNEL32 ref: 004038A8

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: Window$Thread$Current$AllocateEnableEnabledForegroundHeapProcessVisible
String ID:
API String ID: 2983394722-0
Opcode ID: 1d3563f3127e023f913d1c48bb15226510de4f21d660f64e0808139afde0f23e
Instruction ID: 3bd772517b7cdc64e9e8b09daf0a4afa7eecbfefda2ab3240d0ef6d89adb4e94
Opcode Fuzzy Hash: 1d3563f3127e023f913d1c48bb15226510de4f21d660f64e0808139afde0f23e
Instruction Fuzzy Hash: D9F04F321043005BE321AF75AD88B2B7BF8EB45751B14843AF545F3291DB38D811962E

Function 004042DD Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

IsWindowEnabled.USER32(00000133), ref: 004042FE
SetTextColor.GDI32(?,?), ref: 0040431E
GetSysColor.USER32(00000014), ref: 0040432C
SetBkColor.GDI32(?,00000000), ref: 00404334
GetSysColorBrush.USER32(00000014), ref: 00404338
SetBkColor.GDI32(?,?), ref: 0040434A

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: Color$BrushEnabledTextWindow
String ID:
API String ID: 3110319690-0
Opcode ID: 2a7694824716aea3b6171af8bdbe108ba02cf11c8357a94443167fb256057ea0
Instruction ID: e9a5ba519cd36739e06616fa0996cea1dec027768706913cc5cca44d1be32f40
Opcode Fuzzy Hash: 2a7694824716aea3b6171af8bdbe108ba02cf11c8357a94443167fb256057ea0
Instruction Fuzzy Hash: 78012571200304AFD6206B659C44967B3FCEF94321F145B36FA75E32E1C778EC558A25

Function 004047BB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

SetWindowLongA.USER32(000000FF,000000FC,00404714), ref: 004047F5
SetWindowLongA.USER32(000000FF,000000F4,000000FF), ref: 00404800
SetPropA.USER32(000000FF,PB_ID,000000FF), ref: 0040480B
SendMessageA.USER32(000000FF,00000030,000000FF,00000001), ref: 0040481C

Strings

PB_ID, xrefs: 00404805

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: LongWindow$MessagePropSend
String ID: PB_ID
API String ID: 499798845-4173770792
Opcode ID: e916d51ecf110c9439ad90646b44f685ef3287c059c0a1308fabae0f9b2599b4
Instruction ID: d0f6b8676c2a3c83e12209fd00d02ec4e2cc3fdc8a34abd3e45ab61e197bb196
Opcode Fuzzy Hash: e916d51ecf110c9439ad90646b44f685ef3287c059c0a1308fabae0f9b2599b4
Instruction Fuzzy Hash: FF0180B5500308BFCB109F55DD84D8A7BB8FB44760F208626F925672D1C374D950CBA4

Function 00405BB5 Relevance: 7.5, APIs: 5, Instructions: 41windowCOMMON

Download Yara Rule

APIs

IsWindowEnabled.USER32(?), ref: 00405BBF
IsWindowVisible.USER32(?), ref: 00405BCA
GetWindowLongA.USER32(?,000000F0), ref: 00405BD7
SetFocus.USER32(?), ref: 00405BF0
SetFocus.USER32(?), ref: 00405C01

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: Window$Focus$EnabledLongVisible
String ID:
API String ID: 1625685152-0
Opcode ID: 4104ecb720695028e7c8581ab3b6637147259ed4616aec29b930e32d6b114f79
Instruction ID: ef9e72a64073e5b6a23494da1a96f52c8b08a2b3360bc794104ab48438c1adb4
Opcode Fuzzy Hash: 4104ecb720695028e7c8581ab3b6637147259ed4616aec29b930e32d6b114f79
Instruction Fuzzy Hash: 72F08130208B015FE2225F659D8876BB3B8EF86B55B14843EE142B22D0C778D8859A2E

Function 0040416A Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,?), ref: 00404195
GetSysColor.USER32(0000000F), ref: 004041A3
SetBkColor.GDI32(?,00000000), ref: 004041AB
GetSysColorBrush.USER32(0000000F), ref: 004041AF
SetBkColor.GDI32(?,?), ref: 004041C1

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: Color$BrushText
String ID:
API String ID: 3324192670-0
Opcode ID: 6172721f2218073eb60c4652dad57f6f5c5b2bdd0d3b9622d53c644380a3572e
Instruction ID: 457ded62e3f9d5314adae7d240338f31a7adc438ae7f8fffd0e9670b0be44b42
Opcode Fuzzy Hash: 6172721f2218073eb60c4652dad57f6f5c5b2bdd0d3b9622d53c644380a3572e
Instruction Fuzzy Hash: ACF044B5100304ABD220AB299C48D67B3ECEBA4331F104B36F675E32D1C774EC558A65

Function 004043AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004043D8
CreateWindowExA.USER32(?,Edit,00000000,?,?,?,?,?,00000000,000000FF,00000000), ref: 00404466
SetWindowLongA.USER32(00000000,000000FC,Function_00004358), ref: 0040448A

Strings

Edit, xrefs: 00404460

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: Window$CreateLongmemset
String ID: Edit
API String ID: 2917088559-554135844
Opcode ID: 535db69b1cdb1d4649623afdd7382da2ea4c0a12aa9df6c724ba0c28ee97b079
Instruction ID: e5c386e0b925eee2f29b2e51a672b597ac0c5d848ebaae7b82fd60e27dbe053f
Opcode Fuzzy Hash: 535db69b1cdb1d4649623afdd7382da2ea4c0a12aa9df6c724ba0c28ee97b079
Instruction Fuzzy Hash: 3C217CB5500309AFDB115F11ED09B5B3EA5FB80325F20823EFA64B62E1C77988248B9C

Function 00403A79 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00407750: RtlReAllocateHeap.NTDLL(02300000,00000001,02300700,000040FF), ref: 00407797

GetModuleFileNameA.KERNEL32(00000000,00000104,00000104,?,?,?,00000000,00401B68,00000000,00000000,00000000,00000000,00000001,00000001,00000001,00000000), ref: 00403A95
strcmp.MSVCRT ref: 00403AA3
memmove.MSVCRT(00000000,00000004,-00000004,?,?,00000000,00401B68,00000000,00000000,00000000,00000000,00000001,00000001,00000001,00000000,00000000), ref: 00403AB7

Strings

\\?\, xrefs: 00403A9B

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: AllocateFileHeapModuleNamememmovestrcmp
String ID: \\?\
API String ID: 1538048364-4282027825
Opcode ID: c005eb037396008ac0310d56044cb34282d931d78145fccdb6e90d5e5ca18477
Instruction ID: eca9fff87242976c9b07fb941aabbd565294bd6051fa6d81b78090b42e967216
Opcode Fuzzy Hash: c005eb037396008ac0310d56044cb34282d931d78145fccdb6e90d5e5ca18477
Instruction Fuzzy Hash: E1F0A7B36053006AD2116A769D89E9B6B9DDF94365F100437F605E2182E738A91483F9

Function 004040E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.NTDLL(0040B454), ref: 004040EA
GetStockObject.GDI32(00000011), ref: 004040F2

Part of subcall function 004066F1: RtlAllocateHeap.NTDLL(00000008,00000020), ref: 00406703
Part of subcall function 004066F1: RtlAllocateHeap.NTDLL(00000008,?), ref: 0040672E

Part of subcall function 00406434: RtlAllocateHeap.NTDLL(00000008,?), ref: 00406441

memset.MSVCRT ref: 0040412E

Strings

3uo, xrefs: 00404148

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: AllocateHeap$CriticalInitializeObjectSectionStockmemset
String ID: 3uo
API String ID: 681713604-2184686533
Opcode ID: eae40ce73e7bc3a5b72a3c68b7ab9022cd92d073ed51a1f903621673ff1c726c
Instruction ID: 54329a541da7fb3abe67cedf3be7a02972069548faaf6a86b27ad4e37661a0cf
Opcode Fuzzy Hash: eae40ce73e7bc3a5b72a3c68b7ab9022cd92d073ed51a1f903621673ff1c726c
Instruction Fuzzy Hash: 21F036B1580308BAD700ABB19D0BF8D3AA8E744708F50813AB301BA1D2DBF956148B9D

Function 00404E09 Relevance: 6.1, APIs: 4, Instructions: 87memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000006), ref: 00404E99
DestroyAcceleratorTable.USER32(?), ref: 00404F07
CreateAcceleratorTableA.USER32(?,?,?), ref: 00404F13

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: AcceleratorTable$AllocateCreateDestroyHeap
String ID:
API String ID: 1846328917-0
Opcode ID: 553c449d7aaab30c656132e4121b42e9cae388fb6654b811fe19028ea8e614b7
Instruction ID: a9d74fe08e35607087e68633b6b3ac79de1f82750c2c3d7b4edd57319feaf6d7
Opcode Fuzzy Hash: 553c449d7aaab30c656132e4121b42e9cae388fb6654b811fe19028ea8e614b7
Instruction Fuzzy Hash: EC317070500702DBC725CF24CA45A6ABBF5FF94714F10C83DE956AB6A0E375EA50DB48

Function 00407650 Relevance: 6.1, APIs: 4, Instructions: 62memorystringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00407665
RtlAllocateHeap.NTDLL(02300000,00000001,-00000005), ref: 00407687
RtlReAllocateHeap.NTDLL(02300000,00000001,?,-00000005), ref: 004076AA
HeapFree.KERNEL32(02300000,00000001), ref: 004076E0

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: Heap$Allocate$Freestrlen
String ID:
API String ID: 3543670626-0
Opcode ID: 4a6dbc0a02a8b1f71d525bb3f498ef1f750a6f1fa80b627f687ffb3843d8e003
Instruction ID: cae9a5905be6ddab59d871ac1b064cb42395ff2a8ffa857ff663baf975441a1f
Opcode Fuzzy Hash: 4a6dbc0a02a8b1f71d525bb3f498ef1f750a6f1fa80b627f687ffb3843d8e003
Instruction Fuzzy Hash: 8D212E75A04208EFCB00DF58C984FAA37B5EF88314F20C469F8059B390D776AE51DB95

Function 00405C1A Relevance: 6.0, APIs: 4, Instructions: 35windowCOMMON

Download Yara Rule

APIs

IsWindowEnabled.USER32(?), ref: 00405C24
IsWindowVisible.USER32(?), ref: 00405C2F
GetWindowLongA.USER32(?,000000F0), ref: 00405C3C
SetFocus.USER32(?), ref: 00405C5A

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: Window$EnabledFocusLongVisible
String ID:
API String ID: 599048109-0
Opcode ID: d6914770e2e1d8594dbfc7a4944e97bb1c076ccadc3317546e9f57e33cdf2bab
Instruction ID: e46cec46e1855522641c6138c738b3172ba88ca019945debca18c59b96db7e29
Opcode Fuzzy Hash: d6914770e2e1d8594dbfc7a4944e97bb1c076ccadc3317546e9f57e33cdf2bab
Instruction Fuzzy Hash: F0F0DA752047019BE7215F36DE8CA57B7ACEB94751718843EB896E3290CA38D850CA6A

Function 004051A3 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F0), ref: 004051AB
GetParent.USER32(?), ref: 004051C1
MapWindowPoints.USER32(00000000,00000000), ref: 004051CA
MoveWindow.USER32(?,?,?,?,?,00000001), ref: 004051E9

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: Window$LongMoveParentPoints
String ID:
API String ID: 473562985-0
Opcode ID: fca909fb8084ca993e23cb08f133c50a6035ac502da8b0c7087f63ad4b74f454
Instruction ID: a18a99c305bfb6e287be399bcb2239b6defd201362481c224b9852c7cddba058
Opcode Fuzzy Hash: fca909fb8084ca993e23cb08f133c50a6035ac502da8b0c7087f63ad4b74f454
Instruction Fuzzy Hash: CCF0F832100209BFDF019F98DD49FAA3BB9FB08310F008120FE19AA1A0C731D961DB55

Function 004041CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004041F9
CreateWindowExA.USER32(?,Static,00000000,?,?,?,?,?,00000000,000000FF,00000000), ref: 00404285

Strings

Static, xrefs: 0040427F

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: CreateWindowmemset
String ID: Static
API String ID: 1730425660-2272013587
Opcode ID: bb31573bacb5a1810e8e94bb570eece3961102becdd18999a8e42a38d137bbd2
Instruction ID: 84a37009a15c89f1d04e7a9e1e9a7395bcedb45b6e7d81063e5dd9e94b969813
Opcode Fuzzy Hash: bb31573bacb5a1810e8e94bb570eece3961102becdd18999a8e42a38d137bbd2
Instruction Fuzzy Hash: B0218BB1501209AFDB115F51ED09F5B3EA4EB85364F00427EFA24BA2E1C37A8920CBDC

Function 004044F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040451C
CreateWindowExA.USER32(00000000,Button,?,?,?,?,?,?,?,000000FF,00000000), ref: 00404583

Strings

Button, xrefs: 0040457D

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: CreateWindowmemset
String ID: Button
API String ID: 1730425660-1034594571
Opcode ID: d655a678b5e88d094de6bd0f529b1c6e06c1790f3825293257081829d2db64ce
Instruction ID: 90da7fe86d05c84136806c6f2a8b258a2b8c23e6b76e78d1d325a15fbfac5b34
Opcode Fuzzy Hash: d655a678b5e88d094de6bd0f529b1c6e06c1790f3825293257081829d2db64ce
Instruction Fuzzy Hash: FB114FB1400254BFCB119F65DD84D9B3FA9EB49358B10803AFA15B62A1C3398921DFDC

Function 00405625 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetPropA.USER32(00000000,PB_ID), ref: 0040563D
GetWindowLongA.USER32(00000000,000000F4), ref: 0040564A

Strings

PB_ID, xrefs: 00405635

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: LongPropWindow
String ID: PB_ID
API String ID: 2492497586-4173770792
Opcode ID: 8efa6761e261a2f416a94a464cb2701e7ca63ff64c9f839587c1fbf4b0cffeb1
Instruction ID: d037ba408e12bde621d74b1635f54e41943069966e08b0c13ae498da23430538
Opcode Fuzzy Hash: 8efa6761e261a2f416a94a464cb2701e7ca63ff64c9f839587c1fbf4b0cffeb1
Instruction Fuzzy Hash: 3CF06232100208BBCF115FA4DC08E5B7B6AEB54350B54843AFD0DB22B0C736CC60DB98

Function 00404836 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetPropA.USER32(?,PB_WindowID), ref: 0040484C
GetParent.USER32(?), ref: 00404859

Strings

PB_WindowID, xrefs: 00404846

Memory Dump Source

Source File: 00000000.00000002.2066192117.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2066124859.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000409000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066192117.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066551878.000000000057A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066572508.000000000057F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ocs.jbxd

Similarity

API ID: ParentProp
String ID: PB_WindowID
API String ID: 919147419-1508741625
Opcode ID: e61d771c9100336b98a7d339edf77a3775cb866c4dae224fea0e610acfc27428
Instruction ID: b6360fad670133492f75da32d3061413dfb7044b1b8f5c3656c8761a87bd68ca
Opcode Fuzzy Hash: e61d771c9100336b98a7d339edf77a3775cb866c4dae224fea0e610acfc27428
Instruction Fuzzy Hash: 25D0C2B770136167C221662A5C84E47A6ACAAD4760300C437F701F3351C278CC0082A9

Analysis Process: runasspc.exePID: 2924, Parent PID: 1196COMMON

Execution Graph

Execution Coverage:	10.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	26.3%
Total number of Nodes:	494
Total number of Limit Nodes:	2

Executed Functions

Function 00402C10 Relevance: 236.9, APIs: 115, Strings: 20, Instructions: 604
windowstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#860.MFC42 ref: 00402C3F
#860.MFC42(00411C60), ref: 00402C50
#540.MFC42(00411C60), ref: 00402C59
GetLastError.KERNEL32(00411C60), ref: 00402C69
#2818.MFC42(?,004113A4,00000000), ref: 00402C78
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(6C8FA3D8,Errorcode: ,?,Access is denied.,username: ,?,domainname: ,?,004113A0,?,?,004113A0,?,6C8BA320,?,?), ref: 00402CD2
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 00402CD8
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 00402CDE
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 00402CE4
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 00402CEA
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 00402CF0
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 00402CF6
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 00402CFC
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 00402D02
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 00402D08
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 00402D0E
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z.MSVCP60(00000000), ref: 00402D11
#926.MFC42(?,Access is denied.,?), ref: 00402D29
#922.MFC42(?,00000000,?,?,Access is denied.,?), ref: 00402D3F
#939.MFC42 ref: 00402D4E
#800.MFC42 ref: 00402D5B
#800.MFC42 ref: 00402D69
MessageBoxA.USER32(00000000,?,RunasSpc Error:,00000040), ref: 00402D85
#800.MFC42 ref: 00402D94
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(6C8FA3D8,Errorcode: ,?,Logon failure: unknown user name or bad password.,username: ,?,domainname: ,?,004113A0,?,6C8BA320,?,?,?,?), ref: 00402E08
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 00402E0E
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 00402E14
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 00402E1A
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 00402E20
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 00402E26
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 00402E2C
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 00402E32
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z.MSVCP60(00000000), ref: 00402E35
#926.MFC42(?,Logon failure:unknown user name or bad password.Username: ,?), ref: 00402E50
#924.MFC42(?,00000000,Domain: ,?,Logon failure:unknown user name or bad password.Username: ,?), ref: 00402E66
#922.MFC42(?,00000000,?), ref: 00402E7E
#939.MFC42(00000000,?,00000000,?), ref: 00402E8D
#800.MFC42(00000000,?,00000000,?), ref: 00402E9B
#800.MFC42(00000000,?,00000000,?), ref: 00402EA8
#800.MFC42(00000000,?,00000000,?), ref: 00402EB6
MessageBoxA.USER32(00000000,?,RunasSpc Error:,00000040), ref: 00402ED2
#800.MFC42(00000000,?,00000000,?), ref: 00402EE1
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(6C8FA3D8,Errorcode: ,?,The service cannot be started:,Secondary Logon Service,?,6C8BA320,?,?,?,?), ref: 00402F3A
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 00402F40
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 00402F46
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 00402F4C
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z.MSVCP60(00000000), ref: 00402F4F
#941.MFC42(The service cannot be started:Secondary Logon Service), ref: 00402F61
MessageBoxA.USER32(00000000,?,RunasSpc Error:,00000040), ref: 00402F7D
#800.MFC42 ref: 00402F8C
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(6C8FA3D8,Errorcode: ,?,The service cannot be started:,Secondary Logon Service,?,6C8BA320,?,?,?,?), ref: 00402FE5
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 00402FEB
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 00402FF1
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 00402FF7
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z.MSVCP60(00000000), ref: 00402FFA
#941.MFC42(The service cannot be started:Secondary Logon Service), ref: 0040300C
MessageBoxA.USER32(00000000,?,RunasSpc Error:,00000040), ref: 00403028
#800.MFC42 ref: 00403037
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(6C8FA3D8,Errorcode: ,?,User ,?, cannot find the path specified:,004113A0,?,?,Mapped drives are not supported.,?,6C8BA320,?,?,?,?), ref: 004030A9
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 004030AF
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 004030B5
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 004030BB
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 004030C1
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 004030C7
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 004030CD
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 004030D3
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 004030D9
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z.MSVCP60(00000000), ref: 004030DC
#926.MFC42(?,User ,?), ref: 004030F7
#924.MFC42(?), ref: 0040310C
#924.MFC42(?,00000000,004113A0,?), ref: 00403121
#922.MFC42(?,00000000,?,?,00000000,004113A0,?), ref: 00403136
#922.MFC42(?,00000000,?,?,00000000,?,?,00000000,004113A0,?), ref: 0040314B
#924.MFC42(?,00000000,Mapped drives are not supported.,?,00000000,?,?,00000000,?,?,00000000,004113A0,?), ref: 00403161
#939.MFC42(00000000,?,00000000,Mapped drives are not supported.,?,00000000,?,?,00000000,?,?,00000000,004113A0,?), ref: 00403170
#800.MFC42(00000000,?,00000000,Mapped drives are not supported.,?,00000000,?,?,00000000,?,?,00000000,004113A0,?), ref: 0040317D
#800.MFC42(00000000,?,00000000,Mapped drives are not supported.,?,00000000,?,?,00000000,?,?,00000000,004113A0,?), ref: 0040318B
#800.MFC42(00000000,?,00000000,Mapped drives are not supported.,?,00000000,?,?,00000000,?,?,00000000,004113A0,?), ref: 00403199
#800.MFC42(00000000,?,00000000,Mapped drives are not supported.,?,00000000,?,?,00000000,?,?,00000000,004113A0,?), ref: 004031A7
#800.MFC42(00000000,?,00000000,Mapped drives are not supported.,?,00000000,?,?,00000000,?,?,00000000,004113A0,?), ref: 004031B5
#800.MFC42(00000000,?,00000000,Mapped drives are not supported.,?,00000000,?,?,00000000,?,?,00000000,004113A0,?), ref: 004031C3
MessageBoxA.USER32(00000000,?,RunasSpc Error:,00000040), ref: 004031DF
#800.MFC42(00000000,?,00000000,Mapped drives are not supported.,?,00000000,?,?,00000000,?,?,00000000,004113A0,?), ref: 004031EE
#540.MFC42(?,6C8BA320,?,?,?,?), ref: 0040321F
GetLastError.KERNEL32 ref: 00403229
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 00403243
lstrlenA.KERNEL32(?), ref: 00403254
lstrlenA.KERNEL32(RunasSpc), ref: 0040325D
LocalAlloc.KERNEL32(00000040,00000028), ref: 00403266
wsprintfA.USER32 ref: 0040327F
#860.MFC42(00000000,?,?,?,?,?,?,6C8BA320,?,?,?,?), ref: 0040328D
#924.MFC42(?,?,Run application as user ,00000000,?,?,?,?,?,?,6C8BA320,?,?,?,?), ref: 004032AE
#922.MFC42(?,00000000,?), ref: 004032C3
#922.MFC42(?,00000000,?,?,00000000,?), ref: 004032D8
#924.MFC42(?,00000000,004111B4,?,00000000,?,?,00000000,?), ref: 004032ED
#922.MFC42(?,00000000,?,?,00000000,004111B4,?,00000000,?,?,00000000,?), ref: 00403302
#924.MFC42(?,00000000,username: ,?,00000000,?,?,00000000,004111B4,?,00000000,?,?,00000000,?), ref: 00403317
#922.MFC42(?,00000000,?,?,00000000,username: ,?,00000000,?,?,00000000,004111B4,?,00000000,?,?), ref: 0040332F
#924.MFC42(?,00000000,domainname: ,?,00000000,?,?,00000000,username: ,?,00000000,?,?,00000000,004111B4,?), ref: 00403344
#922.MFC42(?,00000000,?,?,00000000,domainname: ,?,00000000,?,?,00000000,username: ,?,00000000,?,?), ref: 0040335D
#924.MFC42(?,00000000,For more information contact:service@robotronic.de,?,00000000,?,?,00000000,domainname: ,?,00000000,?,?,00000000,username: ,?), ref: 00403372
MessageBoxA.USER32(00000000,?,Runasspc Information,00000040), ref: 00403383
#800.MFC42 ref: 0040338D
#800.MFC42 ref: 0040339A
#800.MFC42 ref: 004033A8
#800.MFC42 ref: 004033B6
#800.MFC42 ref: 004033C4
#800.MFC42 ref: 004033D2
#800.MFC42 ref: 004033E0
#800.MFC42 ref: 004033EE
#800.MFC42 ref: 004033FC
#800.MFC42 ref: 0040340A
LocalFree.KERNEL32(?,00000000,?,?,?,?,?,?,6C8BA320,?,?,?,?), ref: 0040341A
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,6C8BA320,?,?,?,?), ref: 0040341D
ExitProcess.KERNEL32 ref: 00403420

Strings

Domain: , xrefs: 00402E55
Secondary Logon Service, xrefs: 00402F29, 00402FD4
Runasspc Information, xrefs: 0040337B
domainname: , xrefs: 00402CBB, 00402DF1, 00403334
User , xrefs: 0040309D, 004030F1
For more information contact:service@robotronic.de, xrefs: 00403362
Logon failure: unknown user name or bad password., xrefs: 00402DFC
username: , xrefs: 00402CC1, 00402DF7, 00403307
Mapped drives are not supported., xrefs: 0040307C, 00403150
Access is denied., xrefs: 00402D23
The service cannot be started:, xrefs: 00402F2E, 00402FD9
The service cannot be started:Secondary Logon Service, xrefs: 00402F5C, 00403007
Access is denied., xrefs: 00402CC6
cannot find the path specified:, xrefs: 00403097, 004030FC
RunasSpc Error:, xrefs: 00402D7D, 00402ECA, 00402F75, 00403020, 004031D7
RunasSpc, xrefs: 00403256, 00403274
Run application as user , xrefs: 004032A3
Logon failure:unknown user name or bad password.Username: , xrefs: 00402E4A
%s failed with error %d: %s, xrefs: 00403279
Errorcode: , xrefs: 00402CCC, 00402E02, 00402F34, 00402FDF, 004030A3

Memory Dump Source

Source File: 00000004.00000002.2060336862.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2060320544.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060355682.000000000040B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060371598.0000000000411000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060386418.0000000000412000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_runasspc.jbxd

Similarity

API ID: U?$char_traits@V?$basic_ostream@$??6std@@D@std@@@0@V10@$#800$#922#924$Message$?endl@std@@D@std@@@1@V21@@$#860#926#939Local$#540#941ErrorFreeLastlstrlen$#2818AllocExitFormatProcesswsprintf
String ID: Access is denied.$Access is denied.$Domain: $For more information contact:service@robotronic.de$Logon failure:unknown user name or bad password.Username: $Logon failure: unknown user name or bad password.$Mapped drives are not supported.$Run application as user $Secondary Logon Service$The service cannot be started:$The service cannot be started:Secondary Logon Service$User $domainname: $username: $ cannot find the path specified:$%s failed with error %d: %s$Errorcode: $RunasSpc$RunasSpc Error:$Runasspc Information
API String ID: 2864664778-2974190135
Opcode ID: 1b61cc58dde2c8d07ae5818e1a9d5644681127198610d6753d1108a1e6deca82
Instruction ID: 51212f69be0c9ba29337226590f0ff30186e0f0ec0aeaf0a3d5b08038906b8b7
Opcode Fuzzy Hash: 1b61cc58dde2c8d07ae5818e1a9d5644681127198610d6753d1108a1e6deca82
Instruction Fuzzy Hash: CD22A770548340AAE310D764CD85F9FBBE8AF95708F00491EFAD4A32D1DB789548CABB

Function 00407190 Relevance: 224.6, APIs: 110, Strings: 18, Instructions: 641
synchronizationwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#540.MFC42 ref: 004071D5
#540.MFC42 ref: 004071E9

Part of subcall function 00407BB0: #540.MFC42(00000000,?,763404F0,?,?,?,?,?,?,?,6C8BA320,763404F0,?), ref: 00407BD6
Part of subcall function 00407BB0: #6663.MFC42(00411C30,00000000,00000000,?,763404F0,?,?,?,?,?,?,?,6C8BA320,763404F0,?), ref: 00407BEE
Part of subcall function 00407BB0: #6663.MFC42(00411C30,00000000,00411C30,00000000,00000000,?,763404F0,?,?,?,?,?,?,?,6C8BA320,763404F0), ref: 00407C04
Part of subcall function 00407BB0: #6663.MFC42(00411C30,00000001,00411C30,00000000,00411C30,00000000,00000000,?,763404F0,?,?,?,?,?,?,?), ref: 00407C1A
Part of subcall function 00407BB0: #4278.MFC42(00411C30,00000000,00000001,00411C30,00000001,00411C30,00000000,00411C30,00000000,00000000,?,763404F0,?), ref: 00407C33
Part of subcall function 00407BB0: #939.MFC42 ref: 00407C45
Part of subcall function 00407BB0: #800.MFC42 ref: 00407C52
Part of subcall function 00407BB0: #4278.MFC42(00411C30,00411C30,-00000001), ref: 00407C65
Part of subcall function 00407BB0: #858.MFC42(00000000,00411C30,00411C30,-00000001), ref: 00407C74
Part of subcall function 00407BB0: #800.MFC42(00000000,00411C30,00411C30,-00000001), ref: 00407C81
Part of subcall function 00407BB0: #2915.MFC42(00000100,00000100,00000000,00411C30,00411C30,-00000001), ref: 00407CA1
Part of subcall function 00407BB0: GetEnvironmentVariableA.KERNEL32(00000000,00000000,00000100,00000100,00000000,00411C30,00411C30,-00000001), ref: 00407CAC
Part of subcall function 00407BB0: #5572.MFC42(000000FF), ref: 00407CBE
Part of subcall function 00407BB0: #926.MFC42(00000001,00411C30,00000000,000000FF), ref: 00407CD2
Part of subcall function 00407BB0: #924.MFC42(00000001,00000000,00411C30,00000001,00411C30,00000000,000000FF), ref: 00407CE7

#926.MFC42(?,00411C2C,?), ref: 0040720B
#922.MFC42(?,00000000,00000000,?,00411C2C,?), ref: 00407222
#924.MFC42(?,00000000,00411C2C,?,00000000,00000000,?,00411C2C,?), ref: 0040723A
#924.MFC42(?,00000000,004111B4,?,00000000,00411C2C,?,00000000,00000000,?,00411C2C,?), ref: 00407252
#922.MFC42(?,00000000,?,?,00000000,004111B4,?,00000000,00411C2C,?,00000000,00000000,?,00411C2C,?), ref: 00407269
#858.MFC42(00000000,?,00000000,?,?,00000000,004111B4,?,00000000,00411C2C,?,00000000,00000000,?,00411C2C,?), ref: 0040727B
#800.MFC42(00000000,?,00000000,?,?,00000000,004111B4,?,00000000,00411C2C,?,00000000,00000000,?,00411C2C,?), ref: 0040728C
#800.MFC42(00000000,?,00000000,?,?,00000000,004111B4,?,00000000,00411C2C,?,00000000,00000000,?,00411C2C,?), ref: 0040729D
#800.MFC42(00000000,?,00000000,?,?,00000000,004111B4,?,00000000,00411C2C,?,00000000,00000000,?,00411C2C,?), ref: 004072AE
#800.MFC42(00000000,?,00000000,?,?,00000000,004111B4,?,00000000,00411C2C,?,00000000,00000000,?,00411C2C,?), ref: 004072BF
#800.MFC42(00000000,?,00000000,?,?,00000000,004111B4,?,00000000,00411C2C,?,00000000,00000000,?,00411C2C,?), ref: 004072D0
MessageBoxA.USER32(00000000,Application and parameters more than 256 characters,error,00000001), ref: 004072FC
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(6C8FA3D8,decrypt and open process as user:,Application and parameters more than 256 characters,004113A0), ref: 0040731D
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000,763404F0,?), ref: 00407323
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 00407329
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z.MSVCP60(00000000), ref: 0040732C
#2915.MFC42(00000000,000000FF,?,00000100,00000000,?,00000000,?,?,00000000,004111B4,?,00000000,00411C2C,?,00000000), ref: 0040734F
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,000000FF,?,00000100,00000000,?,00000000,?,?,00000000,004111B4,?,00000000), ref: 0040735F
_mbscmp.MSVCRT ref: 00407371
#2915.MFC42 ref: 0040738F
GetComputerNameA.KERNEL32(00000000), ref: 00407395
#5572.MFC42(000000FF), ref: 0040739F
#2915.MFC42(00000000,000000FF,?,00000010,763404F0,?), ref: 004073B4
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,000000FF,?,00000010,763404F0,?), ref: 004073BE
#2915.MFC42(00000000,000000FF,?,00000100), ref: 004073D8
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,000000FF,?,00000100), ref: 004073E2
#2915.MFC42(00000000,000000FF,?,00000100), ref: 004073F7
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,000000FF,?,00000100), ref: 00407401
_mbscmp.MSVCRT ref: 0040740F
#858.MFC42(?), ref: 00407422
#2915.MFC42(00000000,000000FF,?,00000100), ref: 0040743A
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,000000FF,?,00000100), ref: 00407444
_mbscmp.MSVCRT ref: 0040745D
#800.MFC42 ref: 004078E5
#800.MFC42 ref: 004078F9
WaitForSingleObject.KERNEL32(?,000003E8), ref: 0040791A
#2915.MFC42(00000000), ref: 00407925

Part of subcall function 00408990: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,6C8BA320,?,00000000,759230D0), ref: 0040899E
Part of subcall function 00408990: Process32First.KERNEL32(00000000,6C8BA320), ref: 004089B8
Part of subcall function 00408990: CloseHandle.KERNEL32(00000000,00000002,00000000), ref: 004089C2

TerminateProcess.KERNEL32(?,?,00000000,00000000), ref: 00407948
#800.MFC42 ref: 0040795A
DestroyEnvironmentBlock.USERENV(?), ref: 00407964
CloseHandle.KERNEL32(?), ref: 00407979
CloseHandle.KERNEL32(?), ref: 00407980
CloseHandle.KERNEL32(?), ref: 00407987
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(6C8FA3D8,decrypt and open process as user:,?,application:,?,004113A0,domain: ,?,004113A0,user: ,?,004113A0), ref: 004079D1
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 004079D7
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 004079DD
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 004079E3
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 004079E9
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 004079EF
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 004079F5
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 004079FB
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 00407A01
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 00407A07
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 00407A0D
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z.MSVCP60(00000000), ref: 00407A10
#800.MFC42 ref: 00407A25
#800.MFC42 ref: 00407A39

Strings

env, xrefs: 00407487
crcrunasspc, xrefs: 00407557
localhost, xrefs: 00407367
domain: , xrefs: 004079B5
D, xrefs: 004071C2
ELEVATION_REQUIRED , xrefs: 00407749
error, xrefs: 004072F0
hide, xrefs: 0040753B
application:, xrefs: 004079C0
decrypt and open process as user:, xrefs: 00407317, 004079CB
maximize, xrefs: 004074F9
netonly, xrefs: 0040746D
Info: , xrefs: 0040774F
minimize, xrefs: 0040751F
cmd.exe /C ", xrefs: 0040778D
user: , xrefs: 004079AA
Application and parameters more than 256 characters, xrefs: 004072F5, 00407312
noprofile, xrefs: 0040744F

Memory Dump Source

Source File: 00000004.00000002.2060336862.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2060320544.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060355682.000000000040B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060371598.0000000000411000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060386418.0000000000412000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_runasspc.jbxd

Similarity

API ID: U?$char_traits@V?$basic_ostream@$??6std@@D@std@@@0@V10@$#800$#2915$ByteCharMultiWide$CloseHandle$#540#6663#858#924_mbscmp$#4278#5572#922#926?endl@std@@D@std@@@1@EnvironmentV21@@$#939BlockComputerCreateDestroyFirstMessageNameObjectProcessProcess32SingleSnapshotTerminateToolhelp32VariableWait
String ID: ELEVATION_REQUIRED $application:$Application and parameters more than 256 characters$D$Info: $cmd.exe /C "$crcrunasspc$decrypt and open process as user:$domain: $env$error$hide$localhost$maximize$minimize$netonly$noprofile$user:
API String ID: 2895198816-1800106406
Opcode ID: 4e50818912c03981c1d6084873f25ec61435b2654a60cef489e774b0d69ab78a
Instruction ID: 5c87b927571da435c10eb4658c016776b8efde65206660c3d855931957721db4
Opcode Fuzzy Hash: 4e50818912c03981c1d6084873f25ec61435b2654a60cef489e774b0d69ab78a
Instruction Fuzzy Hash: 95328570648340AAE720EB64CD55FAF77E8AF94704F004A1EF599A22D1DB78B508C77B

Function 00403430 Relevance: 501.8, APIs: 243, Strings: 43, Instructions: 1336
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineA.KERNEL32(00000000), ref: 00403456
GetModuleHandleA.KERNEL32(00000000,00000000,00000000), ref: 0040345F
#1575.MFC42(00000000), ref: 00403466
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(6C8FA484,Fatal Error: MFC initialization failed,00000000), ref: 00403480
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z.MSVCP60(00000000), ref: 00403483
#537.MFC42( *************--> RUNASSPC <--************** * FOR PRIVATE USE * * Commercial use license at: * * www.robotronic.de/orderen.php * *******************************************,00000000), ref: 004034A2
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(6C8FA3D8,?, *************--> RUNASSPC <--************** * FOR PRIVATE USE * * Commercial use license at: * * www.robotronic.de/orderen.php * *******************************************,00000000), ref: 004034C0
#540.MFC42 ref: 004034DA
#860.MFC42(00000000), ref: 00403502
#860.MFC42(00000000), ref: 00403512
_mbscmp.MSVCRT ref: 00403527
_mbscmp.MSVCRT ref: 0040353A
_mbscmp.MSVCRT ref: 0040354D
#860.MFC42(00411C60), ref: 0040355F
#860.MFC42(00411C60,00411C60), ref: 0040357D
#860.MFC42(00000000,00411C60,00411C60), ref: 00403589
#6877.MFC42(/program:,00411C60,00000000,00411C60,00411C60), ref: 0040359C
#858.MFC42(00411C60,/program:,00411C60,00000000,00411C60,00411C60), ref: 004035AE
#6877.MFC42(/param:,00000000,/program:,00411C60,00000000,00411C60,00411C60), ref: 004035BE
#858.MFC42(00411C60,/param:,00000000,/program:,00411C60,00000000,00411C60,00411C60), ref: 004035D0
#6877.MFC42(/domain:,00000000,/param:,00000000,/program:,00411C60,00000000,00411C60,00411C60), ref: 004035E0
#858.MFC42(00411C60,/domain:,00000000,/param:,00000000,/program:,00411C60,00000000,00411C60,00411C60), ref: 004035F2
#6877.MFC42(/user:,00000000,/domain:,00000000,/param:,00000000,/program:,00411C60,00000000,00411C60,00411C60), ref: 00403602
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(6C8FA3D8,****************** Help RunasSpc ***************), ref: 00404A41
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(6C8FA3D8,Parameters:,runasspc /program:<applicationname> /domain:<domainname/localhost>, /user:<username> /password:<password> /cryptfile:<name of cryptfile>, /param:<programmoptions> /executein:<path to execute>, /logon:<noprofile/netonly/env>, /wstyle:<maximize/minimize/hide>, /crcOff /quiet /alldrives), ref: 00404A70
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 00404A76
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 00404A7C
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 00404A82
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 00404A88
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 00404A8E
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 00404A94
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(6C8FA3D8,Examples:), ref: 00404AA2
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(6C8FA3D8,1: call runasspc without cryptfile,runasspc /program:"prog.exe" /domain:"localhost" /user:"admin" /password:"pass"), ref: 00404AB7
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 00404ABD
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(6C8FA3D8,2: open a runasspc cryptfile and run the application without dialog of runasSpc,runasspc /cryptfile:"crypt.spc"), ref: 00404AD3
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 00404AD9
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(6C8FA3D8,3: generate a cryptfile,runasspc /cryptfile:"crypt.spc" /program:"prog.exe" /domain:"localhost" /user:"admin" /password:"pass"), ref: 00404AEF
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 00404AF5
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(6C8FA3D8,Additional Info:), ref: 00404B02
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(6C8FA3D8, For local user -> /domain:"localhost" ), ref: 00404B10
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(6C8FA3D8, For domain user -> /domain:"domainname.com" ), ref: 00404B1E
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(6C8FA3D8, Let option /password empty if you want to ask for it on runtime), ref: 00404B2B
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(6C8FA3D8,************************************************), ref: 00404B39
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z.MSVCP60(00000000), ref: 00404B3C

Strings

crypt.spc, xrefs: 00403770
/password:, xrefs: 0040361B
/quiet, xrefs: 0040365F
/domain:, xrefs: 004035D7
TRUE, xrefs: 0040371B
************************************************, xrefs: 00404B2D
/logon:<noprofile/netonly/env>, xrefs: 00404A56
Let option /password empty if you want to ask for it on runtime, xrefs: 00404B25
/user:<username> /password:<password> /cryptfile:<name of cryptfile>, xrefs: 00404A60
/program:, xrefs: 00403593
z, xrefs: 0040461E
Crc32SumOff, xrefs: 004036F9
Fatal Error: MFC initialization failed, xrefs: 0040347A
runasspc /cryptfile:"crypt.spc", xrefs: 00404AC8
Examples:, xrefs: 00404A9C
****************** Help RunasSpc ***************, xrefs: 00404A3B
Exit: , xrefs: 004049E3
/cryptfile:, xrefs: 0040363D
Additional Info:, xrefs: 00404AFC
For local user -> /domain:"localhost" , xrefs: 00404B0A
runasspc /program:<applicationname> /domain:<domainname/localhost>, xrefs: 00404A65
runasspc /program:"prog.exe" /domain:"localhost" /user:"admin" /password:"pass", xrefs: 00404AAC
1: call runasspc without cryptfile, xrefs: 00404AB1
}, xrefs: 004046F2
y, xrefs: 0040460A
/logon:, xrefs: 004036A3
Parameters:, xrefs: 00404A6A
/wstyle:, xrefs: 004036C5
*************--> RUNASSPC <--************** * FOR PRIVATE USE * * Commercial use license at: * * www.robotronic.de/orderen.php * *******************************************, xrefs: 00403499
For domain user -> /domain:"domainname.com" , xrefs: 00404B18
/crcOff /quiet /alldrives, xrefs: 00404A4C
Error argc6 could not create cryptfile, xrefs: 00404985
/param:, xrefs: 004035B5
/wstyle:<maximize/minimize/hide>, xrefs: 00404A51
/crcoff, xrefs: 004036E7
/executein:, xrefs: 00403681
runasspc /cryptfile:"crypt.spc" /program:"prog.exe" /domain:"localhost" /user:"admin" /password:"pass", xrefs: 00404AE4
/param:<programmoptions> /executein:<path to execute>, xrefs: 00404A5B
callDirectWithoutCryptfile, xrefs: 0040482A
/user:, xrefs: 004035F9
2: open a runasspc cryptfile and run the application without dialog of runasSpc, xrefs: 00404ACD
3: generate a cryptfile, xrefs: 00404AE9
/alldrives, xrefs: 00403709

Memory Dump Source

Source File: 00000004.00000002.2060336862.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2060320544.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060355682.000000000040B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060371598.0000000000411000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060386418.0000000000412000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_runasspc.jbxd

Similarity

API ID: U?$char_traits@V?$basic_ostream@$??6std@@D@std@@@0@V10@$#860$#6877$#858_mbscmp$?endl@std@@D@std@@@1@V21@@$#1575#537#540CommandHandleLineModule
String ID: *************--> RUNASSPC <--************** * FOR PRIVATE USE * * Commercial use license at: * * www.robotronic.de/orderen.php * *******************************************$****************** Help RunasSpc ***************$************************************************$ /crcOff /quiet /alldrives$ /logon:<noprofile/netonly/env>$ /param:<programmoptions> /executein:<path to execute>$ /user:<username> /password:<password> /cryptfile:<name of cryptfile>$ /wstyle:<maximize/minimize/hide>$ For domain user -> /domain:"domainname.com" $ For local user -> /domain:"localhost" $ Let option /password empty if you want to ask for it on runtime$/alldrives$/crcoff$/cryptfile:$/domain:$/executein:$/logon:$/param:$/password:$/program:$/quiet$/user:$/wstyle:$1: call runasspc without cryptfile$2: open a runasspc cryptfile and run the application without dialog of runasSpc$3: generate a cryptfile$Additional Info:$Crc32SumOff$Error argc6 could not create cryptfile$Examples:$Exit: $Fatal Error: MFC initialization failed$Parameters:$TRUE$callDirectWithoutCryptfile$crypt.spc$runasspc /cryptfile:"crypt.spc"$runasspc /cryptfile:"crypt.spc" /program:"prog.exe" /domain:"localhost" /user:"admin" /password:"pass"$runasspc /program:"prog.exe" /domain:"localhost" /user:"admin" /password:"pass"$runasspc /program:<applicationname> /domain:<domainname/localhost>$y$z$}
API String ID: 1323381780-2985205317
Opcode ID: a5c02205037d565e866783021207720665e46038fc9f700e2b0ff70c6e766d56
Instruction ID: 69980da934618290c00fe8498e0abb2143914263a6a59288fb1c3e80223440d7
Opcode Fuzzy Hash: a5c02205037d565e866783021207720665e46038fc9f700e2b0ff70c6e766d56
Instruction Fuzzy Hash: E9D26D300493858AE374EB65C985FDFB7E4AF95308F04492EE5C9626D1EF78A108CB76

Function 00408E22 Relevance: 15.1, APIs: 10, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__set_app_type.MSVCRT ref: 00408E4E
__p__fmode.MSVCRT ref: 00408E63
__p__commode.MSVCRT ref: 00408E71
__setusermatherr.MSVCRT ref: 00408E9E
_initterm.MSVCRT ref: 00408EB4
__getmainargs.MSVCRT ref: 00408ED7
_initterm.MSVCRT ref: 00408EE7
__p___initenv.MSVCRT ref: 00408EEC
exit.KERNELBASE ref: 00408F0C
_XcptFilter.MSVCRT ref: 00408F1E

Memory Dump Source

Source File: 00000004.00000002.2060336862.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2060320544.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060355682.000000000040B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060371598.0000000000411000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060386418.0000000000412000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_runasspc.jbxd

Similarity

API ID: _initterm$FilterXcpt__getmainargs__p___initenv__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID:
API String ID: 167530163-0
Opcode ID: d7ed23da3a3a434dfc51be14d2c2ff1d4cbd9168e2ecdfa8cff615a9edd8d984
Instruction ID: 7ce569bc752729422ce2ffbd169d6d4b203643de0be0b8f44e0e3c6953163d1a
Opcode Fuzzy Hash: d7ed23da3a3a434dfc51be14d2c2ff1d4cbd9168e2ecdfa8cff615a9edd8d984
Instruction Fuzzy Hash: 58311A75900205AFCB149FA0ED49ADD7B79FB09714F10426EF651B62F0DB386440CBAC

Non-executed Functions

Function 00405E80 Relevance: 449.2, APIs: 240, Strings: 16, Instructions: 1184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#533.MFC42(?,6C8BA320,763404F0,00000062), ref: 00405EA5
#350.MFC42(?,6C8BA320,763404F0,00000062), ref: 00405EB7
#540.MFC42 ref: 00405EC8
#860.MFC42(00000000), ref: 00405EEE
#540.MFC42(00000000), ref: 00405EFF
#540.MFC42(00000000), ref: 00405F10
#540.MFC42(00000000), ref: 00405F21
#540.MFC42(00000000), ref: 00405F32
#540.MFC42(00000000), ref: 00405F43
#540.MFC42(00000000), ref: 00405F54
#5194.MFC42(?,00008000,?,00000000), ref: 00405F73
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(6C8FA3D8,?,File could not be opened,?,004113A0,?,00008000,?,00000000), ref: 00405F9F
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000,763404F0,00000062), ref: 00405FA5
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z.MSVCP60 ref: 00405FAC
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 00405FB3
#800.MFC42 ref: 00405FC4
#800.MFC42 ref: 00405FD5
#800.MFC42 ref: 00405FE6
#800.MFC42 ref: 00405FF7
#800.MFC42 ref: 00406008
#800.MFC42 ref: 00406019
#800.MFC42 ref: 0040602E
#798.MFC42 ref: 00406046
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(6C8FA3D8,?,File empty?,?,004113A0), ref: 0040608D
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000,763404F0,00000062), ref: 00406093
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z.MSVCP60 ref: 0040609A
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z.MSVCP60(00000000), ref: 004060A1
#800.MFC42 ref: 004060B2
#800.MFC42 ref: 004060C3
#800.MFC42 ref: 004060D4
#800.MFC42 ref: 004060E5
#800.MFC42 ref: 004060F6
#800.MFC42 ref: 00406107
#800.MFC42 ref: 0040611C
#798.MFC42 ref: 00406134

Strings

V1967, xrefs: 00406221
), xrefs: 0040713D
$, xrefs: 00406D4D
ERROR Decrypt 5: Error crc32 checksum of file , xrefs: 00406FC0
4q7, xrefs: 00406382, 004063D3, 00406426, 00406477, 004064C8, 00406519, 0040656A, 004065BB, 0040660C, 0040665D, 004066AE, 004066FF, 00406751
ERROR Decrypt 4: Error crc32 checksum of file , xrefs: 00406EA2
TRUE, xrefs: 00406900
4q7endOfLine4q7, xrefs: 00406372
ERROR Decrypt 3: Failed to read the application file , xrefs: 00406A40, 00406D90
Crc32SumOff, xrefs: 004069F4
ERROR Decrypt 7: Failed to read the cryptfile , xrefs: 004067D6
', xrefs: 00406F8A
, xrefs: 00406B8F
File empty?, xrefs: 00406080
ERROR Decrypt 3: failed to find the application, xrefs: 00406C2E
File could not be opened, xrefs: 00405F92

Memory Dump Source

Source File: 00000004.00000002.2060336862.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2060320544.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060355682.000000000040B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060371598.0000000000411000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060386418.0000000000412000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_runasspc.jbxd

Similarity

API ID: #800$U?$char_traits@$#540$??6std@@D@std@@@0@V10@V?$basic_ostream@$#798??6?$basic_ostream@D@std@@@std@@V01@$#350#5194#533#860
String ID: File could not be opened$File empty?$ $$$'$)$4q7$4q7endOfLine4q7$Crc32SumOff$ERROR Decrypt 3: Failed to read the application file $ERROR Decrypt 3: failed to find the application$ERROR Decrypt 4: Error crc32 checksum of file $ERROR Decrypt 5: Error crc32 checksum of file $ERROR Decrypt 7: Failed to read the cryptfile $TRUE$V1967
API String ID: 793790089-1127613661
Opcode ID: aea6a39aa208a2bb2cd85dd05a37ab1c4d4fa077030aa74d21730ccfdb11e916
Instruction ID: 93e124d25150c48dbf4f8967e8f07043bab98652d2e5a726337c96f4fe52c956
Opcode Fuzzy Hash: aea6a39aa208a2bb2cd85dd05a37ab1c4d4fa077030aa74d21730ccfdb11e916
Instruction Fuzzy Hash: A8B2637100C3859AD324EB61C951BAFBBE4AFA5304F04492EF5C5632D2DF78A509CBA7

Function 00402970 Relevance: 12.2, APIs: 8, Instructions: 209COMMON

Download Yara Rule

APIs

??0exception@@QAE@ABQBD@Z.MSVCRT(004110CC), ref: 00402989
_CxxThrowException.MSVCRT(?,0040F1E0), ref: 00402999
??0exception@@QAE@ABQBD@Z.MSVCRT(004110CC), ref: 00402A88
_CxxThrowException.MSVCRT(?,0040F1E0), ref: 00402A98
??0exception@@QAE@ABQBD@Z.MSVCRT(004110CC), ref: 00402B55
_CxxThrowException.MSVCRT(?,0040F1E0), ref: 00402B65
??0exception@@QAE@ABQBD@Z.MSVCRT(004110D0), ref: 00402BBB
_CxxThrowException.MSVCRT(?,0040F1E0), ref: 00402BCB

Part of subcall function 00402BE0: #561.MFC42(00000000,00402BD5,?,0040F1E0,?,?,?,?,?,?,?,?,V1967,?,00000000,00000000), ref: 00402BE7

Memory Dump Source

Source File: 00000004.00000002.2060336862.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2060320544.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060355682.000000000040B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060371598.0000000000411000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060386418.0000000000412000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_runasspc.jbxd

Similarity

API ID: ??0exception@@ExceptionThrow$#561
String ID:
API String ID: 4183359236-0
Opcode ID: ee8ba0f6775abdc610cca4af624066302448de64448e7960d18526cae57c8319
Instruction ID: 600755a4557f33603e9c92ad1b29a8888be992e1ae723103c5e5d34b1f300c71
Opcode Fuzzy Hash: ee8ba0f6775abdc610cca4af624066302448de64448e7960d18526cae57c8319
Instruction Fuzzy Hash: 0761D5317043418BC715DE25895496BB7E6FBC8704F04457EEC89BB3C1CAB8AA06CB59

Function 00402710 Relevance: 12.2, APIs: 8, Instructions: 209COMMON

Download Yara Rule

APIs

??0exception@@QAE@ABQBD@Z.MSVCRT(004110CC), ref: 00402729
_CxxThrowException.MSVCRT(?,0040F1E0), ref: 00402739
??0exception@@QAE@ABQBD@Z.MSVCRT(004110CC), ref: 00402824
_CxxThrowException.MSVCRT(?,0040F1E0), ref: 00402834
??0exception@@QAE@ABQBD@Z.MSVCRT(004110CC), ref: 004028EF
_CxxThrowException.MSVCRT(?,0040F1E0), ref: 004028FF
??0exception@@QAE@ABQBD@Z.MSVCRT(004110D0), ref: 00402955
_CxxThrowException.MSVCRT(?,0040F1E0), ref: 00402965

Memory Dump Source

Source File: 00000004.00000002.2060336862.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2060320544.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060355682.000000000040B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060371598.0000000000411000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060386418.0000000000412000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_runasspc.jbxd

Similarity

API ID: ??0exception@@ExceptionThrow
String ID:
API String ID: 941485209-0
Opcode ID: 54305795cb5eab5a73fbc3fcf3239a085ce63c2c27f643dafc7d4a3a57f488cd
Instruction ID: 466c68a17dc0d3f82790e04f2a0453448e09557c6905b2b3a78967f9c722e71c
Opcode Fuzzy Hash: 54305795cb5eab5a73fbc3fcf3239a085ce63c2c27f643dafc7d4a3a57f488cd
Instruction Fuzzy Hash: E661C1356043458BC714DF25D98496BB7E6AFCC704F08867EEC89BB381C6749E09CB59

Function 004014A0 Relevance: 9.4, APIs: 6, Instructions: 375COMMON

Download Yara Rule

APIs

??0exception@@QAE@ABQBD@Z.MSVCRT ref: 004014BF
_CxxThrowException.MSVCRT(?,0040F1E0), ref: 004014CF
??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 004014F8
_CxxThrowException.MSVCRT(?,0040F1E0), ref: 00401508
??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 00401531
_CxxThrowException.MSVCRT(?,0040F1E0), ref: 00401541

Memory Dump Source

Source File: 00000004.00000002.2060336862.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2060320544.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060355682.000000000040B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060371598.0000000000411000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060386418.0000000000412000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_runasspc.jbxd

Similarity

API ID: ??0exception@@ExceptionThrow
String ID:
API String ID: 941485209-0
Opcode ID: 3eb5f94d6d0be51d33e17c60d64c3c9350acf6c8481f3ed75c10603f2939ffed
Instruction ID: b4c26c01885419149a1ed748d7a7ee9faf8056654f3dac687f6c59d5d5e8b4df
Opcode Fuzzy Hash: 3eb5f94d6d0be51d33e17c60d64c3c9350acf6c8481f3ed75c10603f2939ffed
Instruction Fuzzy Hash: 23E1E2716042418FD718CF29C8906AAB7E2EFCD304F49857EE88AEB365DB34DA45CB45

Function 00408990 Relevance: 7.6, APIs: 5, Instructions: 91processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,6C8BA320,?,00000000,759230D0), ref: 0040899E
Process32First.KERNEL32(00000000,6C8BA320), ref: 004089B8
CloseHandle.KERNEL32(00000000,00000002,00000000), ref: 004089C2
Process32Next.KERNEL32(00000000,00000128), ref: 00408A1B
CloseHandle.KERNEL32(00000000,00000002,00000000), ref: 00408A5C

Memory Dump Source

Source File: 00000004.00000002.2060336862.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2060320544.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060355682.000000000040B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060371598.0000000000411000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060386418.0000000000412000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_runasspc.jbxd

Similarity

API ID: CloseHandleProcess32$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 1789362936-0
Opcode ID: 5f24443cd0201599320946b3296bbfed24c61365564dbbae36ee14a2de7d9ddb
Instruction ID: 287636196161a16c6dd40c29d03daf9913f8cb35a0f63b75fa8a2840499e8a8d
Opcode Fuzzy Hash: 5f24443cd0201599320946b3296bbfed24c61365564dbbae36ee14a2de7d9ddb
Instruction Fuzzy Hash: CB2107756042441AD3206A345EA16F77BD98B67324F191A3FECD0A33C0FA3F980DC659

Function 00407BB0 Relevance: 129.5, APIs: 86, Instructions: 493
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#540.MFC42(00000000,?,763404F0,?,?,?,?,?,?,?,6C8BA320,763404F0,?), ref: 00407BD6
#6663.MFC42(00411C30,00000000,00000000,?,763404F0,?,?,?,?,?,?,?,6C8BA320,763404F0,?), ref: 00407BEE
#6663.MFC42(00411C30,00000000,00411C30,00000000,00000000,?,763404F0,?,?,?,?,?,?,?,6C8BA320,763404F0), ref: 00407C04
#6663.MFC42(00411C30,00000001,00411C30,00000000,00411C30,00000000,00000000,?,763404F0,?,?,?,?,?,?,?), ref: 00407C1A
#4278.MFC42(00411C30,00000000,00000001,00411C30,00000001,00411C30,00000000,00411C30,00000000,00000000,?,763404F0,?), ref: 00407C33
#939.MFC42 ref: 00407C45
#800.MFC42 ref: 00407C52
#4278.MFC42(00411C30,00411C30,-00000001), ref: 00407C65
#858.MFC42(00000000,00411C30,00411C30,-00000001), ref: 00407C74
#800.MFC42(00000000,00411C30,00411C30,-00000001), ref: 00407C81
#2915.MFC42(00000100,00000100,00000000,00411C30,00411C30,-00000001), ref: 00407CA1
GetEnvironmentVariableA.KERNEL32(00000000,00000000,00000100,00000100,00000000,00411C30,00411C30,-00000001), ref: 00407CAC
#5572.MFC42(000000FF), ref: 00407CBE
#926.MFC42(00000001,00411C30,00000000,000000FF), ref: 00407CD2
#924.MFC42(00000001,00000000,00411C30,00000001,00411C30,00000000,000000FF), ref: 00407CE7
#858.MFC42(00000000,00000001,00000000,00411C30,00000001,00411C30,00000000,000000FF), ref: 00407CF6
#800.MFC42(00000000,00000001,00000000,00411C30,00000001,00411C30,00000000,000000FF), ref: 00407D04
#800.MFC42(00000000,00000001,00000000,00411C30,00000001,00411C30,00000000,000000FF), ref: 00407D11
#2764.MFC42(00000000,00000000,00000001,00000000,00411C30,00000001,00411C30,00000000,000000FF), ref: 00407D1D
#6648.MFC42(00000000,?,00000000,00000000,00000001,00000000,00411C30,00000001,00411C30,00000000,000000FF), ref: 00407D31
#6779.MFC42(00000000,?,00000000,?,00000000,00000000,00000001,00000000,00411C30,00000001,00411C30,00000000,000000FF), ref: 00407D41
#6663.MFC42(00411C30,00000000), ref: 00407D54
#6663.MFC42(00411C30,00000000,00411C30,00000000,00000000,?,763404F0,?,?,?,?,?,?,?,6C8BA320,763404F0), ref: 00407D73
#6663.MFC42(00411C30,00000000,00411C30,00000000,00411C30,00000000,00000000,?,763404F0,?,?,?,?,?,?,?), ref: 00407D89
#6663.MFC42(00411C30,00000001,00411C30,00000000,00411C30,00000000,00411C30,00000000,00000000,?,763404F0,?), ref: 00407D9F
#4278.MFC42(00000001,00000000,00000001,00411C30,00000001,00411C30,00000000,00411C30,00000000,00411C30,00000000,00000000,?,763404F0,?), ref: 00407DB8
#939.MFC42(00000000,00000001,00000000,00000001,00411C30,00000001,00411C30,00000000,00411C30,00000000,00411C30,00000000), ref: 00407DCA
#800.MFC42(00000000,00000001,00000000,00000001,00411C30,00000001,00411C30,00000000,00411C30,00000000,00411C30,00000000), ref: 00407DD7
#4278.MFC42(00000001,00411C30,-00000001), ref: 00407DEA
#858.MFC42(00000000,00000001,00411C30,-00000001), ref: 00407DF9
#800.MFC42(00000000,00000001,00411C30,-00000001), ref: 00407E06
#2915.MFC42(00000100,00000100,00000000,00000001,00411C30,-00000001), ref: 00407E26
GetEnvironmentVariableA.KERNEL32(00411C30,00000000,00000100,00000100,00000000,00000001,00411C30,-00000001), ref: 00407E31
#5572.MFC42(000000FF), ref: 00407E43
#926.MFC42(00411C30,00411C30,00000000,000000FF), ref: 00407E57
#924.MFC42(00000000,00000000,00411C30,00411C30,00411C30), ref: 00407E6C
#858.MFC42(00000000,00000000,00000000,00411C30,00411C30,00411C30), ref: 00407E7B
#800.MFC42(00000000,00000000,00000000,00411C30,00411C30,00411C30), ref: 00407E89
#800.MFC42(00000000,00000000,00000000,00411C30,00411C30,00411C30), ref: 00407E96
#2764.MFC42(00000000,00000000,00000000,00000000,00411C30,00411C30,00411C30), ref: 00407EA2
#6648.MFC42(00000000,?,00000000,00000000,00000000,00000000,00411C30,00411C30,00411C30), ref: 00407EB6
#6779.MFC42(00000000,?,00000000,?,00000000,00000000,00000000,00000000,00411C30,00411C30,00411C30), ref: 00407EC6
#6663.MFC42(00411C30,00000000), ref: 00407ED9
#6663.MFC42(00411C30,00000000,00411C30,00000000,00411C30,00000000,00000000,?,763404F0,?,?,?,?,?,?,?), ref: 00407EF8
#6663.MFC42(00411C30,00000000,00411C30,00000000,00411C30,00000000,00411C30,00000000,00000000,?,763404F0,?), ref: 00407F0E
#6663.MFC42(00411C30,00000001,00411C30,00000000,00411C30,00000000,00411C30,00000000,00411C30,00000000,00000000,?,763404F0,?), ref: 00407F24
#4278.MFC42(00411C30,00000000,00000001,00411C30,00000001,00411C30,00000000,00411C30,00000000,00411C30,00000000,00411C30,00000000,00000000,?,763404F0), ref: 00407F3D
#939.MFC42(00000000,00411C30), ref: 00407F4F
#800.MFC42(00000000,00411C30), ref: 00407F5C
#4278.MFC42(00411C30,00411C30,-00000001,00000000,00411C30), ref: 00407F6F
#858.MFC42(00000000,00411C30,00411C30,-00000001,00000000,00411C30), ref: 00407F7E
#800.MFC42(00000000,00411C30,00411C30,-00000001,00000000,00411C30), ref: 00407F8B
#2915.MFC42(00000100,00000100,00000000,00411C30,00411C30,-00000001,00000000,00411C30), ref: 00407FAB
GetEnvironmentVariableA.KERNEL32(00000000,00000000,00000100,00000100,00000000,00411C30,00411C30,-00000001,00000000,00411C30), ref: 00407FB6
#5572.MFC42(000000FF), ref: 00407FC8
#926.MFC42(00411C30,00411C30,00000000,000000FF), ref: 00407FDC
#924.MFC42(00411C30,00000000,00411C30,00411C30,00411C30), ref: 00407FF1
#858.MFC42(00000000,00411C30,00000000,00411C30,00411C30,00411C30), ref: 00408000
#800.MFC42(00000000,00411C30,00000000,00411C30,00411C30,00411C30), ref: 0040800E
#800.MFC42(00000000,00411C30,00000000,00411C30,00411C30,00411C30), ref: 0040801B
#2764.MFC42(00000000,00000000,00411C30,00000000,00411C30,00411C30,00411C30), ref: 00408027
#6648.MFC42(00000000,?,00000000,00000000,00411C30,00000000,00411C30,00411C30,00411C30), ref: 0040803B
#6779.MFC42(00000000,?,00000000,?,00000000,00000000,00411C30,00000000,00411C30,00411C30,00411C30), ref: 0040804B
#6663.MFC42(00411C30,00000000), ref: 0040805E
#6663.MFC42(00411C30,00000000,00411C30,00000000,00411C30,00000000,00411C30,00000000,00000000,?,763404F0,?), ref: 0040807D
#6663.MFC42(00411C30,00000000,00411C30,00000000,00411C30,00000000,00411C30,00000000,00411C30,00000000,00000000,?,763404F0,?), ref: 004080A1
#6663.MFC42(00411C30,00000001,00411C30,00000000,00411C30,00000000,00411C30,00000000,00411C30,00000000,00411C30,00000000,00000000,?,763404F0,?), ref: 004080B7
#4278.MFC42(00000000,00000000,00000001,00411C30,00000001,00411C30,00000000,00411C30,00000000,00411C30,00000000,00411C30,00000000,00411C30,00000000,00000000), ref: 004080D0
#939.MFC42(00000000,00000000,00000000,00000001), ref: 004080DF
#800.MFC42(00000000,00000000,00000000,00000001), ref: 004080EC
#4278.MFC42(00000000,00411C30,-00000001,00000000,00000000,00000000,00000001), ref: 004080FF
#858.MFC42(00000000,00000000,00411C30,-00000001,00000000,00000000,00000000,00000001), ref: 0040810E
#800.MFC42(00000000,00000000,00411C30,-00000001,00000000,00000000,00000000,00000001), ref: 0040811B
#2915.MFC42(00000100,00000100,00000000,00000000,00411C30,-00000001,00000000,00000000,00000000,00000001), ref: 00408132
GetEnvironmentVariableA.KERNEL32(00000000,00000000,00000100,00000100,00000000,00000000,00411C30,-00000001,00000000,00000000,00000000,00000001), ref: 00408139
#5572.MFC42(000000FF), ref: 0040814D
#926.MFC42(00411C30,00411C30,00000000,000000FF), ref: 00408161
#924.MFC42(00411C30,00000000,00411C30,00411C30,00411C30), ref: 00408176
#858.MFC42(00000000,00411C30,00000000,00411C30,00411C30,00411C30), ref: 00408185
#800.MFC42(00000000,00411C30,00000000,00411C30,00411C30,00411C30), ref: 00408193
#800.MFC42(00000000,00411C30,00000000,00411C30,00411C30,00411C30), ref: 004081A0
#2764.MFC42(00000000,00000000,00411C30,00000000,00411C30,00411C30,00411C30), ref: 004081AC
#6648.MFC42(00000000,?,00000000,00000000,00411C30,00000000,00411C30,00411C30,00411C30), ref: 004081BE
#6779.MFC42(00000000,00000000,00000000,?,00000000,00000000,00411C30,00000000,00411C30,00411C30,00411C30), ref: 004081CD
#6663.MFC42(00411C30,00000000), ref: 004081E0
#800.MFC42(00411C30,00000000), ref: 004081FA

Memory Dump Source

Source File: 00000004.00000002.2060336862.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2060320544.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060355682.000000000040B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060371598.0000000000411000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060386418.0000000000412000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_runasspc.jbxd

Similarity

API ID: #800$#6663$#4278#858$#2764#2915#5572#6648#6779#924#926#939EnvironmentVariable$#540
String ID:
API String ID: 644718658-0
Opcode ID: b3875298e88dde9b3a1a7f68ce8572d523ecc6b12d7aae0b01e1a1f58cf4a4ca
Instruction ID: b5e7f6783f2a53484c9e783abcf1978f599fac888e5d3e1c9bb0bb08875e91d2
Opcode Fuzzy Hash: b3875298e88dde9b3a1a7f68ce8572d523ecc6b12d7aae0b01e1a1f58cf4a4ca
Instruction Fuzzy Hash: BC02AE71108345AFC704EB25C951E6F77E8AFD9708F004A2EF5D5632D1EF3899098BAA

Function 00408290 Relevance: 105.4, APIs: 70, Instructions: 406
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#540.MFC42(00000000,?,?,?,?,?,00008000,?,?,?,00000000), ref: 004082B6
#6663.MFC42(00411C30,00000000,00000000,?,?,?,?,?,00008000,?,?,?,00000000), ref: 004082CC
#6663.MFC42(00411C30,00000000,00411C30,00000000,00000000,?,?,?,?,?,00008000,?,?,?,00000000), ref: 004082E5
#6663.MFC42(00411C30,00000001,00411C30,00000000,00411C30,00000000,00000000,?,?,?,?,?,00008000,?,?,?), ref: 004082FB
#4278.MFC42(00411C30,00411C30,-00000001,00411C30,00000001,00411C30,00000000,00411C30,00000000,00000000,?,?,?,?,?,00008000), ref: 00408314
#858.MFC42 ref: 00408323
#800.MFC42 ref: 00408331
#2915.MFC42(00000100,00000100), ref: 00408346
GetEnvironmentVariableA.KERNEL32(00000000,00000000,00000100,00000100), ref: 0040834D
#5572.MFC42(000000FF), ref: 0040835B
#2764.MFC42(00000000,000000FF), ref: 00408368
#6648.MFC42(00000000,?,00000000,000000FF), ref: 00408378
#926.MFC42(00411C30,00411C30,00000000,00000000,?,00000000,000000FF), ref: 0040838C
#924.MFC42(00411C30,00000000,00411C30,00411C30,00411C30,00000000,00000000,?), ref: 004083A1
#6779.MFC42(00000000,?,00411C30,00000000,00411C30,00411C30,00411C30,00000000,00000000,?), ref: 004083B1
#800.MFC42(00000000,?,00411C30,00000000,00411C30,00411C30,00411C30,00000000,00000000,?), ref: 004083BF
#800.MFC42(00000000,?,00411C30,00000000,00411C30,00411C30,00411C30,00000000,00000000,?), ref: 004083CD
#6663.MFC42(00411C30,00411C31), ref: 004083E5
#6663.MFC42(00411C30,00000000,00411C30,00000000,00000000,?,?,?,?,?,00008000,?,?,?,00000000), ref: 00408400
#6663.MFC42(00411C30,00000000,00411C30,00000000,00411C30,00000000,00000000,?,?,?,?,?,00008000,?,?,?), ref: 00408419
#6663.MFC42(00411C30,00000001,00411C30,00000000,00411C30,00000000,00411C30,00000000,00000000,?,?,?,?,?,00008000,?), ref: 0040842F
#4278.MFC42(00411C30,00000000,-00000001,00411C30,00000001,00411C30,00000000,00411C30,00000000,00411C30,00000000,00000000,?,?,?), ref: 00408448
#858.MFC42(00000000,00411C30), ref: 00408457
#800.MFC42(00000000,00411C30), ref: 00408465
#2915.MFC42(00000100,00000100,00000000,00411C30), ref: 0040847A
GetEnvironmentVariableA.KERNEL32(00000000,00000000,00000100,00000100,00000000,00411C30), ref: 00408481
#5572.MFC42(000000FF), ref: 0040848F
#2764.MFC42(00000000,000000FF), ref: 0040849C
#6648.MFC42(00000000,?,00000000,000000FF), ref: 004084AC
#926.MFC42(00411C30,00411C30,00000000,00000000,?,00000000,000000FF), ref: 004084C0
#924.MFC42(00000001,00000000,00411C30,00411C30,00411C30,00000000,00000000,?,00000000), ref: 004084D5
#6779.MFC42(00000000,?,00000001,00000000,00411C30,00411C30,00411C30,00000000,00000000,?,00000000), ref: 004084E5
#800.MFC42(00000000,?,00000001,00000000,00411C30,00411C30,00411C30,00000000,00000000,?,00000000), ref: 004084F3
#800.MFC42(00000000,?,00000001,00000000,00411C30,00411C30,00411C30,00000000,00000000,?,00000000), ref: 00408501
#6663.MFC42(00411C30,00411C31), ref: 00408519
#6663.MFC42(00411C30,00000000,00411C30,00000000,00411C30,00000000,00000000,?,?,?,?,?,00008000,?,?,?), ref: 00408534
#6663.MFC42(00411C30,00000000,00411C30,00000000,00411C30,00000000,00411C30,00000000,00000000,?,?,?,?,?,00008000,?), ref: 0040854D
#6663.MFC42(00411C30,00000001,00411C30,00000000,00411C30,00000000,00411C30,00000000,00411C30,00000000,00000000,?,?,?,?,?), ref: 00408563
#4278.MFC42(00000000,00000000,-00000001,00411C30,00000001,00411C30,00000000,00411C30,00000000,00411C30,00000000,00411C30,00000000,00000000,?,?), ref: 0040857C
#858.MFC42(00000000,00000000,00000000,-00000001), ref: 0040858B
#800.MFC42(00000000,00000000,00000000,-00000001), ref: 00408599
#2915.MFC42(00000100,00000100,00000000,00000000,00000000,-00000001), ref: 004085AE
GetEnvironmentVariableA.KERNEL32(00000000,00000000,00000100,00000100,00000000,00000000,00000000,-00000001), ref: 004085B5
#5572.MFC42(000000FF), ref: 004085C3
#2764.MFC42(00000000,000000FF), ref: 004085D0
#6648.MFC42(00000000,?,00000000,000000FF), ref: 004085E0
#926.MFC42(00411C30,00411C30,00000000,00000000,?,00000000,000000FF), ref: 004085F4
#924.MFC42(00411C30,00000000,00411C30,00411C30,00411C30,00000000,00000000,?), ref: 00408609
#6779.MFC42(00000000,?,00411C30,00000000,00411C30,00411C30,00411C30,00000000,00000000,?), ref: 00408619
#800.MFC42(00000000,?,00411C30,00000000,00411C30,00411C30,00411C30,00000000,00000000,?), ref: 00408627
#800.MFC42(00000000,?,00411C30,00000000,00411C30,00411C30,00411C30,00000000,00000000,?), ref: 00408635
#6663.MFC42(00411C30,00411C31), ref: 0040864D
#6663.MFC42(00411C30,00000000,00411C30,00000000,00411C30,00000000,00411C30,00000000,00000000,?,?,?,?,?,00008000,?), ref: 00408668
#6663.MFC42(00411C30,00000000,00411C30,00000000,00411C30,00000000,00411C30,00000000,00411C30,00000000,00000000,?,?,?,?,?), ref: 00408681
#6663.MFC42(00411C30,00000001,00411C30,00000000,00411C30,00000000,00411C30,00000000,00411C30,00000000,00411C30,00000000,00000000,?,?,?), ref: 00408697
#4278.MFC42(00411C30,00411C30,-00000001,00411C30,00000001,00411C30,00000000,00411C30,00000000,00411C30,00000000,00411C30,00000000,00411C30,00000000,00000000), ref: 004086B0
#858.MFC42(00000000,00411C30,00411C30,-00000001,00411C30,00000001), ref: 004086BF
#800.MFC42(00000000,00411C30,00411C30,-00000001,00411C30,00000001), ref: 004086CD
#2915.MFC42(00000100,00000100,00000000,00411C30,00411C30,-00000001,00411C30,00000001), ref: 004086E2
GetEnvironmentVariableA.KERNEL32(00000000,00000000,00000100,00000100,00000000,00411C30,00411C30,-00000001,00411C30,00000001), ref: 004086E9
#5572.MFC42(000000FF), ref: 004086F7
#2764.MFC42(00000000,000000FF), ref: 00408704
#6648.MFC42(00000000,?,00000000,000000FF), ref: 00408714
#926.MFC42(00411C30,00411C30,00000000,00000000,?,00000000,000000FF), ref: 00408728
#924.MFC42(00411C30,00000000,00411C30,00411C30,00411C30,00000000,00000000,?), ref: 0040873D
#6779.MFC42(00000000,?,00411C30,00000000,00411C30,00411C30,00411C30,00000000,00000000,?), ref: 0040874D
#800.MFC42(00000000,?,00411C30,00000000,00411C30,00411C30,00411C30,00000000,00000000,?), ref: 0040875B
#800.MFC42(00000000,?,00411C30,00000000,00411C30,00411C30,00411C30,00000000,00000000,?), ref: 00408769
#6663.MFC42(00411C30,00411C31), ref: 00408781
#800.MFC42(00411C30,00411C31), ref: 0040879B

Memory Dump Source

Source File: 00000004.00000002.2060336862.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2060320544.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060355682.000000000040B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060371598.0000000000411000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060386418.0000000000412000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_runasspc.jbxd

Similarity

API ID: #6663$#800$#2764#2915#4278#5572#6648#6779#858#924#926EnvironmentVariable$#540
String ID:
API String ID: 2291264435-0
Opcode ID: 8f626a75e6804749f18367f8a89c89d37ff833e24c0bfaed2a4b273821c21bf4
Instruction ID: 35290dd43057ce11dd0bcaf391a2d58f338d49f1c43caa3067d1b2a47494e39d
Opcode Fuzzy Hash: 8f626a75e6804749f18367f8a89c89d37ff833e24c0bfaed2a4b273821c21bf4
Instruction Fuzzy Hash: BBE1BB71208344AFD700EF65CA81E6F77D8AF99758F000A2EF5D5632D2EF7899088766

Function 00404ED0 Relevance: 37.6, APIs: 25, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#540.MFC42(?,?,?,00000000,00409AB5,000000FF,00401394,?), ref: 00404EF9
#540.MFC42(?,?,?,00000000,00409AB5,000000FF,00401394,?), ref: 00404F06
#540.MFC42(?,?,?,00000000,00409AB5,000000FF,00401394,?), ref: 00404F13
#540.MFC42(?,?,?,00000000,00409AB5,000000FF,00401394,?), ref: 00404F20
#540.MFC42(?,?,?,00000000,00409AB5,000000FF,00401394,?), ref: 00404F2D
#540.MFC42(?,?,?,00000000,00409AB5,000000FF,00401394,?), ref: 00404F3A
#540.MFC42(?,?,?,00000000,00409AB5,000000FF,00401394,?), ref: 00404F47
#540.MFC42(?,?,?,00000000,00409AB5,000000FF,00401394,?), ref: 00404F54
#540.MFC42(?,?,?,00000000,00409AB5,000000FF,00401394,?), ref: 00404F61
#540.MFC42(?,?,?,00000000,00409AB5,000000FF,00401394,?), ref: 00404F6E
#540.MFC42(?,?,?,00000000,00409AB5,000000FF,00401394,?), ref: 00404F7B
#540.MFC42(?,?,?,00000000,00409AB5,000000FF,00401394,?), ref: 00404F88
#540.MFC42(?,?,?,00000000,00409AB5,000000FF,00401394,?), ref: 00404F97
#540.MFC42(?,?,?,00000000,00409AB5,000000FF,00401394,?), ref: 00404FA4
#540.MFC42(?,?,?,00000000,00409AB5,000000FF,00401394,?), ref: 00404FB1
#540.MFC42(?,?,?,00000000,00409AB5,000000FF,00401394,?), ref: 00404FBE
#540.MFC42(?,?,?,00000000,00409AB5,000000FF,00401394,?), ref: 00404FCB
#540.MFC42(?,?,?,00000000,00409AB5,000000FF,00401394,?), ref: 00404FD8
#540.MFC42(?,?,?,00000000,00409AB5,000000FF,00401394,?), ref: 00404FE5
#540.MFC42(?,?,?,00000000,00409AB5,000000FF,00401394,?), ref: 00404FF2
#540.MFC42(?,?,?,00000000,00409AB5,000000FF,00401394,?), ref: 00404FFF
#540.MFC42(?,?,?,00000000,00409AB5,000000FF,00401394,?), ref: 0040500C
#540.MFC42(?,?,?,00000000,00409AB5,000000FF,00401394,?), ref: 00405019
#858.MFC42(?,?,?,?,00000000,00409AB5,000000FF,00401394,?), ref: 00405030
#800.MFC42(?,?,?,?,00000000,00409AB5,000000FF,00401394,?), ref: 0040504F

Memory Dump Source

Source File: 00000004.00000002.2060336862.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2060320544.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060355682.000000000040B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060371598.0000000000411000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060386418.0000000000412000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_runasspc.jbxd

Similarity

API ID: #540$#800#858
String ID:
API String ID: 4193629919-0
Opcode ID: 2603281cbe406f3112f1e66ceee0501dedaf871c4669dbe02b12fa71a5a9781e
Instruction ID: 705caeccdf15bfd911376f1347196fac011df722ccdd70ba73290209ad53df97
Opcode Fuzzy Hash: 2603281cbe406f3112f1e66ceee0501dedaf871c4669dbe02b12fa71a5a9781e
Instruction Fuzzy Hash: B2414D3401EB85CEF314EB25C25575ABBE4AF65748F48081EE8C6226C2DF78A60CC677

Function 004012E0 Relevance: 36.8, APIs: 16, Strings: 5, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#4710.MFC42 ref: 004012FE
#3092.MFC42(000003EA), ref: 0040130A
#6199.MFC42(********* RUNASSPC **************,000003EA), ref: 00401318
#6199.MFC42(FOR PRIVATE USE. Commercial use license at: www.robotronic.de/orderEn.php,********* RUNASSPC **************,000003EA), ref: 00401324
#3092.MFC42(000003E9,FOR PRIVATE USE. Commercial use license at: www.robotronic.de/orderEn.php,********* RUNASSPC **************,000003EA), ref: 00401330
_mbscmp.MSVCRT ref: 00401348
#6199.MFC42(?), ref: 00401357
_mbscmp.MSVCRT ref: 00401369
#860.MFC42(crypt.spc), ref: 00401379
#535.MFC42(?), ref: 00401386
#6199.MFC42(?,?), ref: 004013B2
#860.MFC42(00411C60,?,?), ref: 004013C0
#860.MFC42(00411C60,00411C60,?,?), ref: 004013CE

Strings

crypt.spc, xrefs: 00401372
********* RUNASSPC **************, xrefs: 0040130F
FOR PRIVATE USE. Commercial use license at: www.robotronic.de/orderEn.php, xrefs: 0040131D
Cryptfile ERROR: , xrefs: 004013DA
callDirectWithoutCryptfile, xrefs: 00401340

Memory Dump Source

Source File: 00000004.00000002.2060336862.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2060320544.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060355682.000000000040B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060371598.0000000000411000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060386418.0000000000412000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_runasspc.jbxd

Similarity

API ID: #6199$#860$#3092_mbscmp$#4710#535
String ID: ********* RUNASSPC **************$Cryptfile ERROR: $FOR PRIVATE USE. Commercial use license at: www.robotronic.de/orderEn.php$callDirectWithoutCryptfile$crypt.spc
API String ID: 5592086-1008838813
Opcode ID: 62bc2e54c5fa159ebe406e21b709e0e821378aca13311402415602045015ea94
Instruction ID: 6da1ad6cf6863b465f216f3d79776a8b4ba845f173436e415558ab50383e7b9a
Opcode Fuzzy Hash: 62bc2e54c5fa159ebe406e21b709e0e821378aca13311402415602045015ea94
Instruction Fuzzy Hash: 5631E7302483409BD614EB25CA86BAE77B4EB85704F20453FF9C5A32D1DE7C584887AA

Function 00404B70 Relevance: 34.6, APIs: 23, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#535.MFC42(?,?,6C8BA320,?,?,004098A2,000000FF,0040497A,?), ref: 00404BA5
#535.MFC42(?,?,?,6C8BA320,?,?,004098A2,000000FF,0040497A,?), ref: 00404BB9
#535.MFC42(?,?,?,?,6C8BA320,?,?,004098A2,000000FF,0040497A,?), ref: 00404BCA
#535.MFC42(00000000,?,?,?,?,6C8BA320,?,?,004098A2,000000FF,0040497A,?), ref: 00404BDB
#535.MFC42(?,00000000,?,?,?,?,6C8BA320,?,?,004098A2,000000FF,0040497A,?), ref: 00404BEC
#535.MFC42(?,?,00000000,?,?,?,?,6C8BA320,?,?,004098A2,000000FF,0040497A,?), ref: 00404BFD
#535.MFC42(?,?,?,00000000,?,?,?,?,6C8BA320,?,?,004098A2,000000FF,0040497A,?), ref: 00404C0E
#535.MFC42(?,?,?,?,00000000,?,?,?,?,6C8BA320,?,?,004098A2,000000FF,0040497A,?), ref: 00404C1F
#535.MFC42(?,?,?,?,?,00000000,?,?,?,?,6C8BA320,?,?,004098A2,000000FF,0040497A), ref: 00404C30
#535.MFC42(?,?,?,?,?,?,00000000,?,?,?,?,6C8BA320,?,?,004098A2,000000FF), ref: 00404C41
#535.MFC42(?,?,?,?,?,?,?,00000000,?,?,?,?,6C8BA320,?,?,004098A2), ref: 00404C52
#535.MFC42(00408F05,?,?,?,?,?,?,?,00000000,?,?,?,?,6C8BA320,?,?), ref: 00404C63
#535.MFC42(000000FF,00408F05,?,?,?,?,?,?,?,00000000,?,?,?,?,6C8BA320), ref: 00404C74
#535.MFC42(004097A5,000000FF,00408F05,?,?,?,?,?,?,?,00000000,?,?,?,?,6C8BA320), ref: 00404C85
#535.MFC42(00000000,004097A5,000000FF,00408F05,?,?,?,?,?,?,?,00000000,?,?,?,?), ref: 00404C96
#535.MFC42(?,00000000,004097A5,000000FF,00408F05,?,?,?,?,?,?,?,00000000,?,?,?), ref: 00404CA7
#535.MFC42(?,?,00000000,004097A5,000000FF,00408F05,?,?,?,?,?,?,?,00000000,?,?), ref: 00404CB8
#535.MFC42(?,?,?,00000000,004097A5,000000FF,00408F05,?,?,?,?,?,?,?,00000000,?), ref: 00404CC9
#535.MFC42(?,?,?,?,00000000,004097A5,000000FF,00408F05,?,?,?,?,?,?,?,00000000), ref: 00404CDA
#535.MFC42(?,?,?,?,?,00000000,004097A5,000000FF,00408F05,?,?,?,?,?,?,?), ref: 00404CEB
#535.MFC42(?,?,?,?,?,?,00000000,004097A5,000000FF,00408F05,?,?,?,?,?,?), ref: 00404CFC
#535.MFC42(?,?,?,?,?,?,?,00000000,004097A5,000000FF,00408F05,?,?,?,?,?), ref: 00404D0D
#535.MFC42(?,?,?,?,?,?,?,?,00000000,004097A5,000000FF,00408F05,?,?,?,?), ref: 00404D1E

Memory Dump Source

Source File: 00000004.00000002.2060336862.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2060320544.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060355682.000000000040B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060371598.0000000000411000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060386418.0000000000412000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_runasspc.jbxd

Similarity

API ID: #535
String ID:
API String ID: 331045284-0
Opcode ID: 6095b3803738ff7bd68a3eb7f04316fc6ae85086346a9ec0959d59b7d1851cf9
Instruction ID: 601eeb1b36584abf2ff66922b3f5e0315953d04961f1674a9ff7aa0aef536c69
Opcode Fuzzy Hash: 6095b3803738ff7bd68a3eb7f04316fc6ae85086346a9ec0959d59b7d1851cf9
Instruction Fuzzy Hash: 43513E71009B46DEE358DB25D580B96BBF4BF64348F04491EA4C653992EBB4B24CCBF2

Function 00404D60 Relevance: 34.6, APIs: 23, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#540.MFC42(6C8BA320,?,00000000,004099A2,000000FF,004034CE), ref: 00404D80
#540.MFC42(6C8BA320,?), ref: 00404D90
#540.MFC42(6C8BA320,?), ref: 00404D9D
#540.MFC42(6C8BA320,?), ref: 00404DAA
#540.MFC42(6C8BA320,?), ref: 00404DB7
#540.MFC42(6C8BA320,?), ref: 00404DC4
#540.MFC42(6C8BA320,?), ref: 00404DD1
#540.MFC42(6C8BA320,?), ref: 00404DDE
#540.MFC42(6C8BA320,?), ref: 00404DEB
#540.MFC42(6C8BA320,?), ref: 00404DF8
#540.MFC42(6C8BA320,?), ref: 00404E05
#540.MFC42(6C8BA320,?), ref: 00404E12
#540.MFC42(6C8BA320,?), ref: 00404E1F
#540.MFC42(6C8BA320,?), ref: 00404E2C
#540.MFC42(6C8BA320,?), ref: 00404E39
#540.MFC42(6C8BA320,?), ref: 00404E46
#540.MFC42(6C8BA320,?), ref: 00404E53
#540.MFC42(6C8BA320,?), ref: 00404E60
#540.MFC42(6C8BA320,?), ref: 00404E6D
#540.MFC42(6C8BA320,?), ref: 00404E7A
#540.MFC42(6C8BA320,?), ref: 00404E87
#540.MFC42(6C8BA320,?), ref: 00404E94
#540.MFC42(6C8BA320,?), ref: 00404EA1

Memory Dump Source

Source File: 00000004.00000002.2060336862.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2060320544.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060355682.000000000040B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060371598.0000000000411000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060386418.0000000000412000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_runasspc.jbxd

Similarity

API ID: #540
String ID:
API String ID: 747650028-0
Opcode ID: 45e3470830ccedf70ef064cb9f773fd58eb24f26bb327727a99213d96dfb9bf2
Instruction ID: 3871879c23c7efe2ed1416739e36e42631d84b3175c48087f061e93dbe32b42c
Opcode Fuzzy Hash: 45e3470830ccedf70ef064cb9f773fd58eb24f26bb327727a99213d96dfb9bf2
Instruction Fuzzy Hash: B6412530059BC5CAF314EB65C25575ABBE4AF65308F480E2DE8D6126C2DBB8A20CC676

Function 00405070 Relevance: 34.6, APIs: 23, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#800.MFC42(6C8BA320,?,00000000,00409BB2,000000FF,00404A22), ref: 0040509E
#800.MFC42(6C8BA320,?,00000000,00409BB2,000000FF,00404A22), ref: 004050AB
#800.MFC42(6C8BA320,?,00000000,00409BB2,000000FF,00404A22), ref: 004050B8
#800.MFC42(6C8BA320,?,00000000,00409BB2,000000FF,00404A22), ref: 004050C5
#800.MFC42(6C8BA320,?,00000000,00409BB2,000000FF,00404A22), ref: 004050D2
#800.MFC42(6C8BA320,?,00000000,00409BB2,000000FF,00404A22), ref: 004050DF
#800.MFC42(6C8BA320,?,00000000,00409BB2,000000FF,00404A22), ref: 004050EC
#800.MFC42(6C8BA320,?,00000000,00409BB2,000000FF,00404A22), ref: 004050F9
#800.MFC42(6C8BA320,?,00000000,00409BB2,000000FF,00404A22), ref: 00405106
#800.MFC42(6C8BA320,?,00000000,00409BB2,000000FF,00404A22), ref: 00405113
#800.MFC42(6C8BA320,?,00000000,00409BB2,000000FF,00404A22), ref: 00405120
#800.MFC42(6C8BA320,?,00000000,00409BB2,000000FF,00404A22), ref: 0040512D
#800.MFC42(6C8BA320,?,00000000,00409BB2,000000FF,00404A22), ref: 0040513A
#800.MFC42(6C8BA320,?,00000000,00409BB2,000000FF,00404A22), ref: 00405147
#800.MFC42(6C8BA320,?,00000000,00409BB2,000000FF,00404A22), ref: 00405154
#800.MFC42(6C8BA320,?,00000000,00409BB2,000000FF,00404A22), ref: 00405161
#800.MFC42(6C8BA320,?,00000000,00409BB2,000000FF,00404A22), ref: 0040516E
#800.MFC42(6C8BA320,?,00000000,00409BB2,000000FF,00404A22), ref: 0040517B
#800.MFC42(6C8BA320,?,00000000,00409BB2,000000FF,00404A22), ref: 00405188
#800.MFC42(6C8BA320,?,00000000,00409BB2,000000FF,00404A22), ref: 00405195
#800.MFC42(6C8BA320,?,00000000,00409BB2,000000FF,00404A22), ref: 004051A2
#800.MFC42(6C8BA320,?,00000000,00409BB2,000000FF,00404A22), ref: 004051AF
#800.MFC42(6C8BA320,?,00000000,00409BB2,000000FF,00404A22), ref: 004051BF

Memory Dump Source

Source File: 00000004.00000002.2060336862.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2060320544.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060355682.000000000040B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060371598.0000000000411000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060386418.0000000000412000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_runasspc.jbxd

Similarity

API ID: #800
String ID:
API String ID: 1076129211-0
Opcode ID: 7f793b68a468f1cd52d678222789412c3637855f9102d45c58442dba8dccb525
Instruction ID: 8216c5d0d9ded216e5c3292fc870c671df634ba7449befffa7b1ae31152ebc23
Opcode Fuzzy Hash: 7f793b68a468f1cd52d678222789412c3637855f9102d45c58442dba8dccb525
Instruction Fuzzy Hash: F741263100D7D1CAE314EB25C191B5ABBE0BF66308F440E1DA8D6126C2DBB8A20CC6B7

Function 00407A90 Relevance: 25.6, APIs: 17, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#540.MFC42(00000000,?,763404F0,?,763404F0,?), ref: 00407AB2
#6662.MFC42(0000002E,00000000,00000000,?,763404F0,?,763404F0,?), ref: 00407AC5
#6662.MFC42(00000020,00000000,0000002E,00000000,00000000,?,763404F0,?,763404F0,?), ref: 00407ACF
#4277.MFC42(00000000,00000000,00000020,00000000,0000002E,00000000,00000000,?,763404F0,?,763404F0,?), ref: 00407AE3
#858.MFC42(00000000,00000000), ref: 00407AF1
#800.MFC42(00000000,00000000), ref: 00407AFE
#4129.MFC42(00000000,00000000,00000000,00000000), ref: 00407B0B
#858.MFC42(00000000,00000000,00000000,00000000,00000000), ref: 00407B18
#800.MFC42(00000000,00000000,00000000,00000000,00000000), ref: 00407B25
#5683.MFC42(0000005C,00000020,00000000,0000002E,00000000,00000000,?,763404F0,?,763404F0,?), ref: 00407B2E
#4129.MFC42(00000000,00000001,0000005C,00000020,00000000,0000002E,00000000,00000000,?,763404F0,?,763404F0,?), ref: 00407B43
#858.MFC42(00000000,00000000,00000001), ref: 00407B51
#800.MFC42(00000000,00000000,00000001), ref: 00407B5E
#4277.MFC42(00000000,00000001,00000000,00000000,00000001), ref: 00407B6B
#858.MFC42(00000000,00000000,00000001,00000000,00000000,00000001), ref: 00407B78
#800.MFC42(00000000,00000000,00000001,00000000,00000000,00000001), ref: 00407B85
#800.MFC42(0000005C), ref: 00407B96

Memory Dump Source

Source File: 00000004.00000002.2060336862.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2060320544.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060355682.000000000040B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060371598.0000000000411000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060386418.0000000000412000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_runasspc.jbxd

Similarity

API ID: #800$#858$#4129#4277#6662$#540#5683
String ID:
API String ID: 61239756-0
Opcode ID: 7b20debd6cc334e9cb581dc9269d34bd86068b8946fed9410a8d5f989e32b9a1
Instruction ID: 744d983c1e1d42b22649f42b393dbec7a6aeb2da1f53b3180750c0c69a5ce31b
Opcode Fuzzy Hash: 7b20debd6cc334e9cb581dc9269d34bd86068b8946fed9410a8d5f989e32b9a1
Instruction Fuzzy Hash: 7131A4711093809AD305EB29C951A5F77E8AF99718F440B2EF4D5632C1DF3C9909C77A

Function 004087C0 Relevance: 16.6, APIs: 11, Instructions: 118
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,08000000,00000000,?,00000020,00000000,00000008), ref: 00408852
GetFileSize.KERNEL32(00000000,00000000,?,00000020,00000000,00000008), ref: 00408864
#536.MFC42(00000020,00000000,?,00000020,00000000,00000008), ref: 00408873
#2915.MFC42(00000000,00000000,?,00000000,00000020,00000000,?,00000020,00000000,00000008), ref: 0040888D
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000020,00000000,?,00000020,00000000,00000008), ref: 00408894
CloseHandle.KERNEL32(00000000,?,00000020,00000000,00000008), ref: 0040889B
#5572.MFC42(?,?,00000020,00000000,00000008), ref: 004088A6
#800.MFC42(?,?,00000020,00000000,00000008), ref: 004088BD
#800.MFC42(?,00000020,00000000,00000008), ref: 004088D0
#800.MFC42(?,?,00000020,00000000,00000008), ref: 0040890E
#800.MFC42(?,?,00000020,00000000,00000008), ref: 00408921

Memory Dump Source

Source File: 00000004.00000002.2060336862.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2060320544.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060355682.000000000040B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060371598.0000000000411000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060386418.0000000000412000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_runasspc.jbxd

Similarity

API ID: #800$File$#2915#536#5572CloseCreateHandleReadSize
String ID:
API String ID: 1688483687-0
Opcode ID: ec56a31d9066793c546ac67297f0c5d263686ce4c55d9d6e55accd87e8dbae34
Instruction ID: 85eb2ca32fe83dffe473e753c81bb2223308d922ea907c39846903ccb5b8300b
Opcode Fuzzy Hash: ec56a31d9066793c546ac67297f0c5d263686ce4c55d9d6e55accd87e8dbae34
Instruction Fuzzy Hash: D241B2722446409BE330EB25CD41BAFB6D4DBD5710F50893EF5D9A72C1DE3858098BAA

Function 004011E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

#324.MFC42(00000069,00000000,6C8BA320,?,00000000,00408FC3,000000FF,0040482A,00000000), ref: 00401204
#540.MFC42(00000069,00000000,6C8BA320,?,00000000), ref: 00401214
#540.MFC42(00000069,00000000,6C8BA320,?,00000000), ref: 00401221

Strings

*H@, xrefs: 00401226

Memory Dump Source

Source File: 00000004.00000002.2060336862.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2060320544.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060355682.000000000040B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060371598.0000000000411000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2060386418.0000000000412000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_runasspc.jbxd

Similarity

API ID: #540$#324
String ID: *H@
API String ID: 2753626916-2229771961
Opcode ID: ee42e73ff08a494e43ac01cd40389a1b2f795427ac5910f0f8ad3fee146e8886
Instruction ID: a5a109d97bdffec6aea5cc0079446195dfdd51488e321a5ad603735e49381207
Opcode Fuzzy Hash: ee42e73ff08a494e43ac01cd40389a1b2f795427ac5910f0f8ad3fee146e8886
Instruction Fuzzy Hash: 87F03471148B91EBE314DF09CA01B56B7E8FB54B20F004A2EF49593BC1CBB895088BA6

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ocs.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\A3BE.tmp\OcsAgentSetup.exe

C:\Users\user\AppData\Local\Temp\A3BE.tmp\runasspc.exe

C:\Users\user\AppData\Local\Temp\A3BE.tmp\start.bat

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: ocs.exePID: 3200, Parent PID: 1028

Windows Analysis Report
ocs.exe

Function 00405EB2 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 39
libraryloaderCOMMON

Function 00406960 Relevance: 7.6, APIs: 5, Instructions: 128
memoryfileCOMMON

Function 00401000 Relevance: 74.2, APIs: 16, Strings: 26, Instructions: 666
memoryCOMMON

Function 00406060 Relevance: 7.6, APIs: 5, Instructions: 100
filememoryCOMMON

Function 00402779 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59
sleepCOMMON

Function 00406330 Relevance: 6.1, APIs: 4, Instructions: 105
COMMON

Function 004015F4 Relevance: 6.0, APIs: 4, Instructions: 25
memoryCOMMON

Function 00401BAC Relevance: 6.0, APIs: 4, Instructions: 15
memoryCOMMON

Function 00406170 Relevance: 4.6, APIs: 3, Instructions: 72
filememoryCOMMON

Function 00405F13 Relevance: 4.5, APIs: 3, Instructions: 38
stringCOMMON

Function 00401BF4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 95
COMMON

Function 00407470 Relevance: 3.0, APIs: 2, Instructions: 18
memoryCOMMON

Function 00403694 Relevance: 3.0, APIs: 2, Instructions: 4
COMMON

Function 00407750 Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMON

Function 004030A0 Relevance: 1.5, APIs: 1, Instructions: 26
memoryCOMMON