Windows Analysis Report
FNGAutoBackup.exe

Overview

General Information

Sample name:	FNGAutoBackup.exe
Analysis ID:	1566425
MD5:	6c9cbe507b5f4bb46755ba2c17ed584c
SHA1:	3a5c068d810f6849fcb2153b09edb815d856a7ba
SHA256:	96a0dced371043bcfb6eeca6097b4f1017435c32a35689b2058f56bc9238600d
Tags:	exemalicioususer-TheRavenFile
Infos:

Detection

Score:	3
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Signatures

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Classification

Signatures

Uses 32bit PE files

Source: FNGAutoBackup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: FNGAutoBackup.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Data.pdbH source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: System.ServiceProcess.ni.pdbRSDSwg source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: System.Data.pdb source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: System.Xml.ni.pdb source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: mscorlib.pdb source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: System.ni.pdbRSDS source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: System.ServiceProcess.pdb source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: mscorlib.pdbX source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: System.Core.pdbRSDSC source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: mscorlib.ni.pdb source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: System.Core.pdb source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: System.ServiceProcess.ni.pdb source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: System.Data.ni.pdb source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: System.Data.ni.pdbRSDSC source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: System.pdbMZ source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: System.Xml.pdb source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: System.ni.pdb source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: System.pdb source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: System.Core.ni.pdb source: WERE8D3.tmp.dmp.4.dr

Source: Amcache.hve.4.dr

String found in binary or memory: http://upx.sf.net

One or more processes crash

Source: C:\Users\user\Desktop\FNGAutoBackup.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7284 -s 804

Uses 32bit PE files

Source: FNGAutoBackup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: clean3.winEXE@2/5@0/0

Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7284
Source: C:\Users\user\Desktop\FNGAutoBackup.exe	Mutant created: NULL

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\60e77417-0ae5-43a9-9ed2-654de19648c5

Jump to behavior

Source: FNGAutoBackup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: FNGAutoBackup.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\FNGAutoBackup.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\FNGAutoBackup.exe

File read: C:\Users\user\Desktop\FNGAutoBackup.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\FNGAutoBackup.exe "C:\Users\user\Desktop\FNGAutoBackup.exe"
Source: C:\Users\user\Desktop\FNGAutoBackup.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7284 -s 804

Source: C:\Users\user\Desktop\FNGAutoBackup.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\FNGAutoBackup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FNGAutoBackup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\FNGAutoBackup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\FNGAutoBackup.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\FNGAutoBackup.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\FNGAutoBackup.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior

Source: C:\Users\user\Desktop\FNGAutoBackup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\FNGAutoBackup.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: FNGAutoBackup.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: FNGAutoBackup.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Data.pdbH source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: System.ServiceProcess.ni.pdbRSDSwg source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: System.Data.pdb source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: System.Xml.ni.pdb source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: mscorlib.pdb source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: System.ni.pdbRSDS source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: System.ServiceProcess.pdb source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: mscorlib.pdbX source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: System.Core.pdbRSDSC source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: mscorlib.ni.pdb source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: System.Core.pdb source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: System.ServiceProcess.ni.pdb source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: System.Data.ni.pdb source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: System.Data.ni.pdbRSDSC source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: System.pdbMZ source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: System.Xml.pdb source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: System.ni.pdb source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: System.pdb source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WERE8D3.tmp.dmp.4.dr
Source:	Binary string: System.Core.ni.pdb source: WERE8D3.tmp.dmp.4.dr

Source: C:\Users\user\Desktop\FNGAutoBackup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FNGAutoBackup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FNGAutoBackup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FNGAutoBackup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FNGAutoBackup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FNGAutoBackup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FNGAutoBackup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FNGAutoBackup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FNGAutoBackup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FNGAutoBackup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FNGAutoBackup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FNGAutoBackup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FNGAutoBackup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FNGAutoBackup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FNGAutoBackup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FNGAutoBackup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FNGAutoBackup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FNGAutoBackup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FNGAutoBackup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FNGAutoBackup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FNGAutoBackup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FNGAutoBackup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FNGAutoBackup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FNGAutoBackup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\Desktop\FNGAutoBackup.exe	Memory allocated: 17905810000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\FNGAutoBackup.exe	Memory allocated: 1791DA00000 memory reserve \| memory write watch			Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware-42 27 c7 3b 45 a3 e4 a4-61 bc 19 7c 28 5c 10 19
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\FNGAutoBackup.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\FNGAutoBackup.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\FNGAutoBackup.exe

Memory allocated: page read and write | page guard

Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\FNGAutoBackup.exe	Queries volume information: C:\Users\user\Desktop\FNGAutoBackup.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\FNGAutoBackup.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation			Jump to behavior

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Contacted Domains

Name	IP	Active
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true

ID:	1566425
Product:	CloudBasic
Start time:	07:39:06
Start date:	02.12.2024
Sample:	FNGAutoBackup.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	6c9cbe507b5f4bb46755ba2c17ed584c
SHA1:	3a5c068d810f6849fcb2153b09edb815d856a7ba
SHA256:	96a0dced371043bcfb6eeca6097b4f1017435c32a35689b2058f56bc9238600d
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_FNGAutoBackup.ex_1c6818e205888b582bff204e21bebcbf7cd69_806afe30_72ed49fa-e902-4481-947f-fa55e06985bd\Report.wer	Unicode text, UTF-16, little-endian text, with CRLF line terminators	5D4B923765BB7CCE33DCFDFAB3F7C987	52EEADBDD9848134B5D182DCAACAF0B983569B9C	CA3209DA104611D757902FFDE528730C62BE297823F5B943061D696A67027F2F
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE8D3.tmp.dmp	Mini DuMP crash report, 16 streams, Mon Dec 2 06:39:57 2024, 0x1205a4 type	3D36062C9C8CE202579DDE0B219DBF14	DDCCE8A54C0464CF46E35249EB997584AC206BD6	066CC6BB3BBA52DF136BBCC48CE2E77713A6B44933B06CF2C34F12E98B4185FB
C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA2C.tmp.WERInternalMetadata.xml	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators	07965E11566BDBEE519B869EC5950A55	8FE450C19E4B440DD537BFFB85E5BE831093B673	5E115A4C4A87CE7EA21FD1E06B6DD3B836D8F31C579D43FDB6542B35646F2D21
C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA7B.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	2E35056C7B42B6007B3175CA97C11B42	EDFF8F202B22F59FAF5685236BAB46B73D9A52FF	7FF9E1AFADB900063C4BEB4C5D9FC6DB5877831390715D848FA369EE30EA59CF
C:\Windows\appcompat\Programs\Amcache.hve	MS Windows registry file, NT/2000 or above	4F31F33135B366B88CD3FF809DE31938	6D2596CA676D204ACFB563BF1A8401660005C683	0387902D3808BE7633D2A2E35EC5F8DE28BA4E6FA690138314B58C7B27BA2BD9

Windows Analysis Report
FNGAutoBackup.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report FNGAutoBackup.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report
FNGAutoBackup.exe