Windows Analysis Report
Sage.Eb.UniSign.Windows.exe

ID:	1560045
Product:	CloudBasic
Start time:	10:45:48
Start date:	21.11.2024
Sample:	Sage.Eb.UniSign.Windows.exe
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	74a7aec99ca57c42ce99e3de83aef658
SHA1:	ba13b7f129e96fa9bdc1c13f8b05d107289fac37
SHA256:	e3f6aa0c441bb40ccb6b1c91ea8c9b4c4031be8584b39c6b2ae8a65035754ab1
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.98%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Sage.Eb.UniSign._a8dc996360e27a186e21d34387658fe9deb15b6e_1b1e0b3a_84ca524c-8023-4351-a0a9-eb435429f075\Report.wer	Unicode text, UTF-16, little-endian text, with CRLF line terminators	A22485B94808AF5988D63889B1C914E9	9BF73AFD3731A4AFB212A3E2F9EE8003D4114330	A4EC52DFB7F3BD1AD5D5863A799F80A5F43C635C27EA41F45AF016EC540DCB86
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5C54.tmp.dmp	Mini DuMP crash report, 15 streams, Thu Nov 21 09:46:23 2024, 0x1205a4 type	DD5A91D08ED6032AF4F8119F7B8CB5BA	BAB16CC7E865305660D57F366B8ECE44D29385AB	C8E3FFC4F4DA192CAC6242DAAC56BFD3EBCB59BA8479A88BE7465BC089754148
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5D30.tmp.WERInternalMetadata.xml	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators	A1F748E3EE3AC95CD304DCF8971DE4BA	1AD4A32FD61A0DC37CA014C17E2B01BD944A17FE	104EE6D73ECBA3C6760398356E55805D14A5158493A409DDFBC79CE558599E30
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5D5F.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	ECE4DAE772F06572C5F6FD788F9520D9	63A22AE901F13B14D134F92A595B7FA063A152C7	470FB05ECF48536E895B78C93BD3198B93F0A991210394FA10923164E5BEACD3
C:\Windows\appcompat\Programs\Amcache.hve	MS Windows registry file, NT/2000 or above	A436884B064AEE9BB586BA79F5B0B9B2	C911B189D63BBF19CF3BB6F0F49EA4D5F2DEC27A	965933B7461CCA95E7153936AE0C9F164C5BF0B14DA8B51C69CF21E6E88347FB
\Device\ConDrv	ASCII text, with CRLF, LF line terminators	525285019E3C5F2AB0AA750DFA50530D	4A2F962FEECFDF3C4D0BB7B8F63A3DFD5A9308FD	EEB21D8D7CF86FB145DF89166AE896F94E551DE673257514E533A2ADFAD9663C

Compliance

Source: Sage.Eb.UniSign.Windows.exe

Static PE information: certificate valid

Source: Sage.Eb.UniSign.Windows.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Sage.Eb.UniSign.Windows.pdb source: WER5C54.tmp.dmp.5.dr
Source:	Binary string: O nPC:\Windows\Sage.Eb.UniSign.Windows.pdb source: Sage.Eb.UniSign.Windows.exe, 00000000.00000002.1447558340.0000000001338000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: WER5C54.tmp.dmp.5.dr
Source:	Binary string: System.ni.pdbRSDSw source: WER5C54.tmp.dmp.5.dr
Source:	Binary string: mscorlib.ni.pdb source: WER5C54.tmp.dmp.5.dr
Source:	Binary string: \??\C:\Windows\symbols\exe\Sage.Eb.UniSign.Windows.pdb source: Sage.Eb.UniSign.Windows.exe, 00000000.00000002.1447999928.00000000016D5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Sage.Eb.UniSign.Windows.pdb source: Sage.Eb.UniSign.Windows.exe, 00000000.00000002.1447999928.00000000016D5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER5C54.tmp.dmp.5.dr
Source:	Binary string: System.Configuration.ni.pdb source: WER5C54.tmp.dmp.5.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER5C54.tmp.dmp.5.dr
Source:	Binary string: System.Configuration.pdb source: WER5C54.tmp.dmp.5.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER5C54.tmp.dmp.5.dr
Source:	Binary string: System.ni.pdb source: WER5C54.tmp.dmp.5.dr
Source:	Binary string: System.pdb source: WER5C54.tmp.dmp.5.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER5C54.tmp.dmp.5.dr
Source:	Binary string: Sage.Eb.UniSign.Windows.pdbL0 source: WER5C54.tmp.dmp.5.dr
Source:	Binary string: C:\Builds\eIDSign\Ebanking\eIDSign.4.0.0\eIDSign\Current\Src\NativeServices\NSUniSignWindows\obj\Release\Sage.Eb.UniSign.Windows.pdb source: Sage.Eb.UniSign.Windows.exe
Source:	Binary string: \??\C:\Windows\exe\Sage.Eb.UniSign.Windows.pdbk source: Sage.Eb.UniSign.Windows.exe, 00000000.00000002.1447999928.00000000016D5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdb source: WER5C54.tmp.dmp.5.dr

Networking

Source: Sage.Eb.UniSign.Windows.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Sage.Eb.UniSign.Windows.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Sage.Eb.UniSign.Windows.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Sage.Eb.UniSign.Windows.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Sage.Eb.UniSign.Windows.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Sage.Eb.UniSign.Windows.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Sage.Eb.UniSign.Windows.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: Sage.Eb.UniSign.Windows.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: Sage.Eb.UniSign.Windows.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: Sage.Eb.UniSign.Windows.exe	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: Sage.Eb.UniSign.Windows.exe	String found in binary or memory: http://s2.symcb.com0
Source: Sage.Eb.UniSign.Windows.exe	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: Sage.Eb.UniSign.Windows.exe	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: Sage.Eb.UniSign.Windows.exe	String found in binary or memory: http://sv.symcd.com0&
Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net
Source: Sage.Eb.UniSign.Windows.exe	String found in binary or memory: http://www.symauth.com/cps0(
Source: Sage.Eb.UniSign.Windows.exe	String found in binary or memory: http://www.symauth.com/rpa00
Source: Sage.Eb.UniSign.Windows.exe	String found in binary or memory: https://d.symcb.com/cps0%
Source: Sage.Eb.UniSign.Windows.exe	String found in binary or memory: https://d.symcb.com/rpa0

System Summary

Source: C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 872

Source: Sage.Eb.UniSign.Windows.exe, 00000000.00000002.1447999928.000000000169E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameclr.dllT vs Sage.Eb.UniSign.Windows.exe

Source: Sage.Eb.UniSign.Windows.exe, Ms.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: Sage.Eb.UniSign.Windows.exe, Ms.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: Sage.Eb.UniSign.Windows.exe, Ms.cs	Security API names: System.IO.DirectoryInfo.GetAccessControl()
Source: Sage.Eb.UniSign.Windows.exe, Ms.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: Sage.Eb.UniSign.Windows.exe, UniSignEventSource.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: Sage.Eb.UniSign.Windows.exe, Program.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: Sage.Eb.UniSign.Windows.exe, Program.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: Sage.Eb.UniSign.Windows.exe, NSUniSignService.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: Sage.Eb.UniSign.Windows.exe, JsonRestDevice.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: clean3.winEXE@3/6@0/0

Source: C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1412:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2004

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\fa07e67b-2e27-4f17-b6d6-72e3bf8818cd

Jump to behavior

Source: Sage.Eb.UniSign.Windows.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Sage.Eb.UniSign.Windows.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.98%

Source: C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Sage.Eb.UniSign.Windows.exe	String found in binary or memory: https[Add or Update NameSpace Reservation for uri: 1Delete SSL Certificate: QCN=SageeIDSignCA,O=UniSign,OU=SageFrance}ReCreate SSL Certificate: CN=127.0.0.1,O=UniSign,OU=SageFranceyCreate SSL Certificate: CN=127.0.0.1,O=UniSign,OU=SageFrance[Add or Update SSL Certificate for: 127.0.0.1:=Add prefix for Http Listener: 1Authentication Schemes: -Start Http Listener...json
Source: Sage.Eb.UniSign.Windows.exe	String found in binary or memory: firefox-addin
Source: Sage.Eb.UniSign.Windows.exe	String found in binary or memory: ?yThe caller does not have the rights to perform the operationASessionLogon: New user connected9SessionLogon: Not admin role1Start setting firefox/ie)test "firefox-addin"

Source: C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe

File read: C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe "C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe"
Source: C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 872

Source: C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe	Section loaded: mscoree.dll			Jump to behavior
Source: C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe	Section loaded: vcruntime140_clr0400.dll			Jump to behavior
Source: C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe	Section loaded: ucrtbase_clr0400.dll			Jump to behavior

Source: C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Sage.Eb.UniSign.Windows.exe

Static PE information: certificate valid

Source: Sage.Eb.UniSign.Windows.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Sage.Eb.UniSign.Windows.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Sage.Eb.UniSign.Windows.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: Sage.Eb.UniSign.Windows.pdb source: WER5C54.tmp.dmp.5.dr
Source:	Binary string: O nPC:\Windows\Sage.Eb.UniSign.Windows.pdb source: Sage.Eb.UniSign.Windows.exe, 00000000.00000002.1447558340.0000000001338000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: WER5C54.tmp.dmp.5.dr
Source:	Binary string: System.ni.pdbRSDSw source: WER5C54.tmp.dmp.5.dr
Source:	Binary string: mscorlib.ni.pdb source: WER5C54.tmp.dmp.5.dr
Source:	Binary string: \??\C:\Windows\symbols\exe\Sage.Eb.UniSign.Windows.pdb source: Sage.Eb.UniSign.Windows.exe, 00000000.00000002.1447999928.00000000016D5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Sage.Eb.UniSign.Windows.pdb source: Sage.Eb.UniSign.Windows.exe, 00000000.00000002.1447999928.00000000016D5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER5C54.tmp.dmp.5.dr
Source:	Binary string: System.Configuration.ni.pdb source: WER5C54.tmp.dmp.5.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER5C54.tmp.dmp.5.dr
Source:	Binary string: System.Configuration.pdb source: WER5C54.tmp.dmp.5.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER5C54.tmp.dmp.5.dr
Source:	Binary string: System.ni.pdb source: WER5C54.tmp.dmp.5.dr
Source:	Binary string: System.pdb source: WER5C54.tmp.dmp.5.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER5C54.tmp.dmp.5.dr
Source:	Binary string: Sage.Eb.UniSign.Windows.pdbL0 source: WER5C54.tmp.dmp.5.dr
Source:	Binary string: C:\Builds\eIDSign\Ebanking\eIDSign.4.0.0\eIDSign\Current\Src\NativeServices\NSUniSignWindows\obj\Release\Sage.Eb.UniSign.Windows.pdb source: Sage.Eb.UniSign.Windows.exe
Source:	Binary string: \??\C:\Windows\exe\Sage.Eb.UniSign.Windows.pdbk source: Sage.Eb.UniSign.Windows.exe, 00000000.00000002.1447999928.00000000016D5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdb source: WER5C54.tmp.dmp.5.dr

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe	Memory allocated: 1610000 memory reserve | memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe	Memory allocated: 33A0000 memory reserve | memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe	Memory allocated: 53A0000 memory reserve | memory write watch			Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: VMware-42 27 bb 56 ad d4 0b d4-0e 05 59 d1 5b 59 ef ed
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Anti Debugging

Source: C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe

Memory allocated: page read and write | page guard

Jump to behavior

Language, Device and Operating System Detection

Source: C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe

Queries volume information: C:\Users\user\Desktop\Sage.Eb.UniSign.Windows.exe VolumeInformation

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe