Edit tour

Windows Analysis Report
QUOTATION#08670.exe

Overview

General Information

Sample name:	QUOTATION#08670.exe
Analysis ID:	1572925
MD5:	93bdfd46628601b04ea067e5f52187d7
SHA1:	4d2e420aa6a8289763b9c0a79fccb7e18ee02294
SHA256:	f2d566b1b667cf8ea8c35f2827f62e7430941e1fdd13019811768e3a942ec926
Tags:	AgentTeslaexeuser-lowmal3
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected UAC Bypass using CMSTP

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Contains functionality to log keystrokes (.Net Source)

Disables UAC (registry)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Installs a global keyboard hook

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file does not import any functions

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Powershell Defender Exclusion

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

QUOTATION#08670.exe (PID: 3476 cmdline: "C:\Users\user\Desktop\QUOTATION#08670.exe" MD5: 93BDFD46628601B04EA067E5F52187D7)

conhost.exe (PID: 1908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2056 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#08670.exe" -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6488 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 6708 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

CasPol.exe (PID: 4900 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe" MD5: 914F728C04D3EDDD5FBA59420E74E56B)

WerFault.exe (PID: 3608 cmdline: C:\Windows\system32\WerFault.exe -u -p 3476 -s 1468 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

newapp.exe (PID: 948 cmdline: "C:\Users\user\AppData\Roaming\newapp\newapp.exe" MD5: 914F728C04D3EDDD5FBA59420E74E56B)

conhost.exe (PID: 2580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

newapp.exe (PID: 5720 cmdline: "C:\Users\user\AppData\Roaming\newapp\newapp.exe" MD5: 914F728C04D3EDDD5FBA59420E74E56B)

conhost.exe (PID: 4328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 7080 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://ftp.ercolina-usa.com", "Username": "ben@ercolina-usa.com", "Password": "nXe0M~WkW&nJ"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.4621214709.0000000002D11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.4621214709.0000000002D11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.4621214709.0000000002D3C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2259784482.000001CF98408000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000005.00000002.4609800708.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.4609800708.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2260686823.000001CFA8351000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2260686823.000001CFA8351000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: QUOTATION#08670.exe PID: 3476	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: QUOTATION#08670.exe PID: 3476	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: QUOTATION#08670.exe PID: 3476	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: QUOTATION#08670.exe PID: 3476	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: CasPol.exe PID: 4900	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: CasPol.exe PID: 4900	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.QUOTATION#08670.exe.1cfa83cbf08.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.QUOTATION#08670.exe.1cfa83cbf08.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.QUOTATION#08670.exe.1cfa83cbf08.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33bdc:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33c4e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33cd8:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33d6a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33dd4:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33e46:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33edc:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33f6c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.QUOTATION#08670.exe.1cfa83cbf08.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x30dec:$s2: GetPrivateProfileString 0x30472:$s3: get_OSFullName 0x31b69:$s5: remove_Key 0x31d29:$s5: remove_Key 0x32ca1:$s6: FtpWebRequest 0x33bbe:$s7: logins 0x34130:$s7: logins 0x36e41:$s7: logins 0x36ef3:$s7: logins 0x389be:$s7: logins 0x37a8d:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.QUOTATION#08670.exe.1cfa838ecc0.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.QUOTATION#08670.exe.1cfa838ecc0.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.QUOTATION#08670.exe.1cfa838ecc0.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33bdc:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33c4e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33cd8:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33d6a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33dd4:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33e46:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33edc:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33f6c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.QUOTATION#08670.exe.1cfa838ecc0.1.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x30dec:$s2: GetPrivateProfileString 0x30472:$s3: get_OSFullName 0x31b69:$s5: remove_Key 0x31d29:$s5: remove_Key 0x32ca1:$s6: FtpWebRequest 0x33bbe:$s7: logins 0x34130:$s7: logins 0x36e41:$s7: logins 0x36ef3:$s7: logins 0x389be:$s7: logins 0x37a8d:$s9: 1.85 (Hash, version 2, native byte-order)
5.2.CasPol.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.CasPol.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
5.2.CasPol.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x359dc:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x35a4e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35ad8:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35b6a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35bd4:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x35c46:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x35cdc:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x35d6c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
5.2.CasPol.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x32bec:$s2: GetPrivateProfileString 0x32272:$s3: get_OSFullName 0x33969:$s5: remove_Key 0x33b29:$s5: remove_Key 0x34aa1:$s6: FtpWebRequest 0x359be:$s7: logins 0x35f30:$s7: logins 0x38c41:$s7: logins 0x38cf3:$s7: logins 0x3a7be:$s7: logins 0x3988d:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.QUOTATION#08670.exe.1cfa83cbf08.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.QUOTATION#08670.exe.1cfa83cbf08.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.QUOTATION#08670.exe.1cfa83cbf08.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x359dc:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x35a4e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35ad8:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35b6a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35bd4:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x35c46:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x35cdc:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x35d6c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.QUOTATION#08670.exe.1cfa83cbf08.0.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x32bec:$s2: GetPrivateProfileString 0x32272:$s3: get_OSFullName 0x33969:$s5: remove_Key 0x33b29:$s5: remove_Key 0x34aa1:$s6: FtpWebRequest 0x359be:$s7: logins 0x35f30:$s7: logins 0x38c41:$s7: logins 0x38cf3:$s7: logins 0x3a7be:$s7: logins 0x3988d:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.QUOTATION#08670.exe.1cfa838ecc0.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.QUOTATION#08670.exe.1cfa838ecc0.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.QUOTATION#08670.exe.1cfa838ecc0.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x359dc:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x72c24:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x35a4e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x72c96:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35ad8:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x72d20:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35b6a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x72db2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35bd4:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x72e1c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x35c46:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x72e8e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x35cdc:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x72f24:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x35d6c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x72fb4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.QUOTATION#08670.exe.1cfa838ecc0.1.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x32bec:$s2: GetPrivateProfileString 0x6fe34:$s2: GetPrivateProfileString 0x32272:$s3: get_OSFullName 0x6f4ba:$s3: get_OSFullName 0x33969:$s5: remove_Key 0x33b29:$s5: remove_Key 0x70bb1:$s5: remove_Key 0x70d71:$s5: remove_Key 0x34aa1:$s6: FtpWebRequest 0x71ce9:$s6: FtpWebRequest 0x359be:$s7: logins 0x35f30:$s7: logins 0x38c41:$s7: logins 0x38cf3:$s7: logins 0x3a7be:$s7: logins 0x72c06:$s7: logins 0x73178:$s7: logins 0x75e89:$s7: logins 0x75f3b:$s7: logins 0x77a06:$s7: logins 0x3988d:$s9: 1.85 (Hash, version 2, native byte-order)
Click to see the 15 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#08670.exe" -Force, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#08670.exe" -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\QUOTATION#08670.exe", ParentImage: C:\Users\user\Desktop\QUOTATION#08670.exe, ParentProcessId: 3476, ParentProcessName: QUOTATION#08670.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#08670.exe" -Force, ProcessId: 2056, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\newapp\newapp.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe, ProcessId: 4900, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\newapp

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#08670.exe" -Force, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#08670.exe" -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\QUOTATION#08670.exe", ParentImage: C:\Users\user\Desktop\QUOTATION#08670.exe, ParentProcessId: 3476, ParentProcessName: QUOTATION#08670.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#08670.exe" -Force, ProcessId: 2056, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7080, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.QUOTATION#08670.exe.1cfa83cbf08.0.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.ercolina-usa.com", "Username": "ben@ercolina-usa.com", "Password": "nXe0M~WkW&nJ"}

Multi AV Scanner detection for submitted file

Source: QUOTATION#08670.exe	ReversingLabs: Detection: 21%
Source: QUOTATION#08670.exe	Virustotal: Detection: 30%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: QUOTATION#08670.exe

Joe Sandbox ML: detected

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 00000000.00000002.2259784482.000001CF98408000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QUOTATION#08670.exe PID: 3476, type: MEMORYSTR

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.6:49715 version: TLS 1.2

Source: QUOTATION#08670.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdb source: QUOTATION#08670.exe, 00000000.00000002.2262874808.000001CFB0D23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdbYMZ source: QUOTATION#08670.exe, 00000000.00000002.2259070205.0000005985AF3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: Microsoft.CSharp.pdb P source: WER28F3.tmp.dmp.8.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: QUOTATION#08670.exe, 00000000.00000002.2262874808.000001CFB0D23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER28F3.tmp.dmp.8.dr
Source:	Binary string: C:\Users\user\Desktop\QUOTATION#08670.PDBYz source: QUOTATION#08670.exe, 00000000.00000002.2259070205.0000005985AF3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: Microsoft.CSharp.pdb source: WER28F3.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WER28F3.tmp.dmp.8.dr
Source:	Binary string: YpC:\Users\user\Desktop\QUOTATION#08670.PDB source: QUOTATION#08670.exe, 00000000.00000002.2259070205.0000005985AF3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.ni.pdb source: WER28F3.tmp.dmp.8.dr
Source:	Binary string: QUOTATION#08670.PDB source: QUOTATION#08670.exe, 00000000.00000002.2259070205.0000005985AF3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER28F3.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WER28F3.tmp.dmp.8.dr
Source:	Binary string: C:\Users\user\Desktop\QUOTATION#08670.PDB source: QUOTATION#08670.exe, 00000000.00000002.2259070205.0000005985AF3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb source: QUOTATION#08670.exe, 00000000.00000002.2259366070.000001CF969B9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: WER28F3.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdb source: WER28F3.tmp.dmp.8.dr
Source:	Binary string: \??\C:\Users\user\Desktop\QUOTATION#08670.PDB source: QUOTATION#08670.exe, 00000000.00000002.2262874808.000001CFB0D23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WER28F3.tmp.dmp.8.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: QUOTATION#08670.exe, 00000000.00000002.2259366070.000001CF96962000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: QUOTATION#08670.exe, 00000000.00000002.2262874808.000001CFB0D06000.00000004.00000020.00020000.00000000.sdmp, WER28F3.tmp.dmp.8.dr
Source:	Binary string: System.Core.pdb4 source: WER28F3.tmp.dmp.8.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: QUOTATION#08670.exe, 00000000.00000002.2262874808.000001CFB0D23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Core.pdb source: QUOTATION#08670.exe, 00000000.00000002.2262874808.000001CFB0D23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: YindoC:\Windows\System.Core.pdb source: QUOTATION#08670.exe, 00000000.00000002.2259070205.0000005985AF3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WER28F3.tmp.dmp.8.dr
Source:	Binary string: System.Dynamic.pdb source: WER28F3.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.pdb0 source: WER28F3.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.pdb source: WER28F3.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.pdb8 source: WER28F3.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdb source: WER28F3.tmp.dmp.8.dr
Source:	Binary string: \??\C:\Windows\dll\System.Core.pdb source: QUOTATION#08670.exe, 00000000.00000002.2262874808.000001CFB0D23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: caspol.pdb source: newapp.exe, 0000000B.00000000.2329669563.0000000000FF2000.00000002.00000001.01000000.00000009.sdmp, newapp.exe.5.dr
Source:	Binary string: System.Core.pdb source: QUOTATION#08670.exe, 00000000.00000002.2262874808.000001CFB0D06000.00000004.00000020.00020000.00000000.sdmp, WER28F3.tmp.dmp.8.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdbx source: QUOTATION#08670.exe, 00000000.00000002.2262874808.000001CFB0D23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Core.pdb) source: QUOTATION#08670.exe, 00000000.00000002.2262874808.000001CFB0D23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WER28F3.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER28F3.tmp.dmp.8.dr

Source: Joe Sandbox View	IP Address: 192.254.225.136 192.254.225.136
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ftp.ercolina-usa.com

Source: svchost.exe, 0000001B.00000002.4409046537.000001E07CE00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.27.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.27.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.27.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.27.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.27.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.27.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.27.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: CasPol.exe, 00000005.00000002.4621214709.0000000002DCB000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.4621214709.0000000002D3C000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.4621214709.0000000002DAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ercolina-usa.com
Source: edb.log.27.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: CasPol.exe, 00000005.00000002.4621214709.0000000002DCB000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.4621214709.0000000002D3C000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.4621214709.0000000002DAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ftp.ercolina-usa.com
Source: CasPol.exe, 00000005.00000002.4621214709.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.8.dr	String found in binary or memory: http://upx.sf.net
Source: QUOTATION#08670.exe, 00000000.00000002.2260686823.000001CFA8351000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.4609800708.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: QUOTATION#08670.exe, 00000000.00000002.2260686823.000001CFA8351000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.4621214709.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.4609800708.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: CasPol.exe, 00000005.00000002.4621214709.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: CasPol.exe, 00000005.00000002.4621214709.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: edb.log.27.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000001B.00000003.2760841753.000001E07CBC0000.00000004.00000800.00020000.00000000.sdmp, edb.log.27.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.6:49715 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.QUOTATION#08670.exe.1cfa83cbf08.0.raw.unpack, SKTzxzsJw.cs	.Net Code: KdRT1gFnIpl
Source: 0.2.QUOTATION#08670.exe.1cfa838ecc0.1.raw.unpack, SKTzxzsJw.cs	.Net Code: KdRT1gFnIpl

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.QUOTATION#08670.exe.1cfa83cbf08.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.QUOTATION#08670.exe.1cfa83cbf08.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.QUOTATION#08670.exe.1cfa838ecc0.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.QUOTATION#08670.exe.1cfa838ecc0.1.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 5.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.QUOTATION#08670.exe.1cfa83cbf08.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.QUOTATION#08670.exe.1cfa83cbf08.0.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.QUOTATION#08670.exe.1cfa838ecc0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.QUOTATION#08670.exe.1cfa838ecc0.1.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: QUOTATION#08670.exe

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Code function: 0_2_00007FFD3482B460	0_2_00007FFD3482B460
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Code function: 0_2_00007FFD34802168	0_2_00007FFD34802168
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Code function: 0_2_00007FFD348011D0	0_2_00007FFD348011D0
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Code function: 0_2_00007FFD3482B3E8	0_2_00007FFD3482B3E8
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Code function: 0_2_00007FFD34802F48	0_2_00007FFD34802F48
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Code function: 0_2_00007FFD34802F80	0_2_00007FFD34802F80
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Code function: 0_2_00007FFD348261CE	0_2_00007FFD348261CE
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Code function: 0_2_00007FFD3482B450	0_2_00007FFD3482B450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00DCE140	5_2_00DCE140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00DCE9FF	5_2_00DCE9FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00DCA948	5_2_00DCA948
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00DC4A68	5_2_00DC4A68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00DCADB0	5_2_00DCADB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00DC3E50	5_2_00DC3E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_00DC4198	5_2_00DC4198
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_06464784	5_2_06464784
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_06466A12	5_2_06466A12
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_06461B70	5_2_06461B70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_06461F28	5_2_06461F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_06465D42	5_2_06465D42
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_06465D48	5_2_06465D48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_06477E68	5_2_06477E68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_064766E0	5_2_064766E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_064756B0	5_2_064756B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_06473570	5_2_06473570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_0647C268	5_2_0647C268
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_0647B318	5_2_0647B318
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_06477788	5_2_06477788
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_0647E498	5_2_0647E498
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_06475DE8	5_2_06475DE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_06470040	5_2_06470040

Source: C:\Users\user\Desktop\QUOTATION#08670.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3476 -s 1468

Source: QUOTATION#08670.exe

Static PE information: No import functions for PE file found

Source: QUOTATION#08670.exe, 00000000.00000002.2260686823.000001CFA8351000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename4050351b-3b81-4030-83d1-4403e211abfe.exe4 vs QUOTATION#08670.exe
Source: QUOTATION#08670.exe, 00000000.00000002.2260686823.000001CFA8351000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAzidele4 vs QUOTATION#08670.exe
Source: QUOTATION#08670.exe, 00000000.00000002.2259366070.000001CF968FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs QUOTATION#08670.exe
Source: QUOTATION#08670.exe, 00000000.00000000.2138468056.000001CF96752000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameConsoleApplication2.exeH vs QUOTATION#08670.exe
Source: QUOTATION#08670.exe	Binary or memory string: OriginalFilenameConsoleApplication2.exeH vs QUOTATION#08670.exe

Source: 0.2.QUOTATION#08670.exe.1cfa83cbf08.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.QUOTATION#08670.exe.1cfa83cbf08.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.QUOTATION#08670.exe.1cfa838ecc0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.QUOTATION#08670.exe.1cfa838ecc0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 5.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.QUOTATION#08670.exe.1cfa83cbf08.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.QUOTATION#08670.exe.1cfa83cbf08.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.QUOTATION#08670.exe.1cfa838ecc0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.QUOTATION#08670.exe.1cfa838ecc0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload

Source: QUOTATION#08670.exe, -.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.QUOTATION#08670.exe.1cfa83cbf08.0.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.QUOTATION#08670.exe.1cfa83cbf08.0.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.QUOTATION#08670.exe.1cfa83cbf08.0.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.QUOTATION#08670.exe.1cfa83cbf08.0.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.QUOTATION#08670.exe.1cfa83cbf08.0.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.QUOTATION#08670.exe.1cfa83cbf08.0.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.QUOTATION#08670.exe.1cfa83cbf08.0.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.QUOTATION#08670.exe.1cfa83cbf08.0.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@14/19@2/3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

File created: C:\Users\user\AppData\Roaming\newapp

Jump to behavior

Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1908:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4328:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2580:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6488:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3476

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1othnnnn.rpl.ps1

Jump to behavior

Source: QUOTATION#08670.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: QUOTATION#08670.exe

Static file information: TRID: Win64 Executable Console Net Framework (206006/5) 48.58%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\QUOTATION#08670.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION#08670.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: QUOTATION#08670.exe	ReversingLabs: Detection: 21%
Source: QUOTATION#08670.exe	Virustotal: Detection: 30%

Source: C:\Users\user\Desktop\QUOTATION#08670.exe

File read: C:\Users\user\Desktop\QUOTATION#08670.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\QUOTATION#08670.exe "C:\Users\user\Desktop\QUOTATION#08670.exe"
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#08670.exe" -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3476 -s 1468
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknown	Process created: C:\Users\user\AppData\Roaming\newapp\newapp.exe "C:\Users\user\AppData\Roaming\newapp\newapp.exe"
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\newapp\newapp.exe "C:\Users\user\AppData\Roaming\newapp\newapp.exe"
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#08670.exe" -Force	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll

Source: C:\Users\user\Desktop\QUOTATION#08670.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION#08670.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: QUOTATION#08670.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: QUOTATION#08670.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdb source: QUOTATION#08670.exe, 00000000.00000002.2262874808.000001CFB0D23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdbYMZ source: QUOTATION#08670.exe, 00000000.00000002.2259070205.0000005985AF3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: Microsoft.CSharp.pdb P source: WER28F3.tmp.dmp.8.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: QUOTATION#08670.exe, 00000000.00000002.2262874808.000001CFB0D23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER28F3.tmp.dmp.8.dr
Source:	Binary string: C:\Users\user\Desktop\QUOTATION#08670.PDBYz source: QUOTATION#08670.exe, 00000000.00000002.2259070205.0000005985AF3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: Microsoft.CSharp.pdb source: WER28F3.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WER28F3.tmp.dmp.8.dr
Source:	Binary string: YpC:\Users\user\Desktop\QUOTATION#08670.PDB source: QUOTATION#08670.exe, 00000000.00000002.2259070205.0000005985AF3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.ni.pdb source: WER28F3.tmp.dmp.8.dr
Source:	Binary string: QUOTATION#08670.PDB source: QUOTATION#08670.exe, 00000000.00000002.2259070205.0000005985AF3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER28F3.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WER28F3.tmp.dmp.8.dr
Source:	Binary string: C:\Users\user\Desktop\QUOTATION#08670.PDB source: QUOTATION#08670.exe, 00000000.00000002.2259070205.0000005985AF3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb source: QUOTATION#08670.exe, 00000000.00000002.2259366070.000001CF969B9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: WER28F3.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdb source: WER28F3.tmp.dmp.8.dr
Source:	Binary string: \??\C:\Users\user\Desktop\QUOTATION#08670.PDB source: QUOTATION#08670.exe, 00000000.00000002.2262874808.000001CFB0D23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WER28F3.tmp.dmp.8.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: QUOTATION#08670.exe, 00000000.00000002.2259366070.000001CF96962000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: QUOTATION#08670.exe, 00000000.00000002.2262874808.000001CFB0D06000.00000004.00000020.00020000.00000000.sdmp, WER28F3.tmp.dmp.8.dr
Source:	Binary string: System.Core.pdb4 source: WER28F3.tmp.dmp.8.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: QUOTATION#08670.exe, 00000000.00000002.2262874808.000001CFB0D23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Core.pdb source: QUOTATION#08670.exe, 00000000.00000002.2262874808.000001CFB0D23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: YindoC:\Windows\System.Core.pdb source: QUOTATION#08670.exe, 00000000.00000002.2259070205.0000005985AF3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WER28F3.tmp.dmp.8.dr
Source:	Binary string: System.Dynamic.pdb source: WER28F3.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.pdb0 source: WER28F3.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.pdb source: WER28F3.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.pdb8 source: WER28F3.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdb source: WER28F3.tmp.dmp.8.dr
Source:	Binary string: \??\C:\Windows\dll\System.Core.pdb source: QUOTATION#08670.exe, 00000000.00000002.2262874808.000001CFB0D23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: caspol.pdb source: newapp.exe, 0000000B.00000000.2329669563.0000000000FF2000.00000002.00000001.01000000.00000009.sdmp, newapp.exe.5.dr
Source:	Binary string: System.Core.pdb source: QUOTATION#08670.exe, 00000000.00000002.2262874808.000001CFB0D06000.00000004.00000020.00020000.00000000.sdmp, WER28F3.tmp.dmp.8.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdbx source: QUOTATION#08670.exe, 00000000.00000002.2262874808.000001CFB0D23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Core.pdb) source: QUOTATION#08670.exe, 00000000.00000002.2262874808.000001CFB0D23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WER28F3.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER28F3.tmp.dmp.8.dr

Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Code function: 0_2_00007FFD3481F6BD push eax; ret	0_2_00007FFD3481F6E4
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Code function: 0_2_00007FFD348000BD pushad ; iretd	0_2_00007FFD348000C1
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Code function: 0_2_00007FFD34825DA2 push edx; iretd	0_2_00007FFD34825DA3
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Code function: 0_2_00007FFD3480595B pushfd ; retf	0_2_00007FFD34805991
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Code function: 0_2_00007FFD348059A5 push edx; retf	0_2_00007FFD348059DB
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Code function: 0_2_00007FFD34910618 push esp; retf 4810h	0_2_00007FFD34910762
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_06465350 pushfd ; ret	5_2_06465669
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_0646AF03 push es; ret	5_2_0646AF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_064668E2 push esp; retf	5_2_064668E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_064668E0 pushad ; retf	5_2_064668E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_06465662 pushfd ; ret	5_2_06465669

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

File created: C:\Users\user\AppData\Roaming\newapp\newapp.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run newapp			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run newapp			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

File opened: C:\Users\user\AppData\Roaming\newapp\newapp.exe:Zone.Identifier read attributes | delete

Jump to behavior

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: QUOTATION#08670.exe PID: 3476, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: QUOTATION#08670.exe, 00000000.00000002.2259784482.000001CF98408000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: QUOTATION#08670.exe, 00000000.00000002.2259784482.000001CF98408000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Memory allocated: 1CF96A90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Memory allocated: 1CFB0340000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: D90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 2CC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 4CC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Memory allocated: 1860000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Memory allocated: 33F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Memory allocated: 3180000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Memory allocated: B10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Memory allocated: 2760000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Memory allocated: 24A0000 memory reserve \| memory write watch

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599630	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599513	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599266	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599155	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599011	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598482	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598265	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 597938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 597814	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 597688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 597571	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 597455	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 597331	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 597204	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 597079	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596954	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596829	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596704	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596579	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596455	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596317	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596132	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596025	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 595907	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 595795	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 595484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 595375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 595266	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 595141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 595031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 594921	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 594811	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 594703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 594594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 594375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 594266	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 594141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 594016	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 593907	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 593782	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 593657	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 593543	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 593422	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6860	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2856	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Window / User API: threadDelayed 4103	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Window / User API: threadDelayed 5718	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5388	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -30437127721620741s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5844	Thread sleep count: 4103 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5844	Thread sleep count: 5718 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -599750s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -599630s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -599513s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -599391s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -599266s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -599155s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -599011s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -598610s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -598482s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -598375s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -598265s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -598156s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -598047s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -597938s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -597814s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -597688s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -597571s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -597455s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -597331s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -597204s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -597079s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -596954s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -596829s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -596704s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -596579s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -596455s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -596317s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -596132s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -596025s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -595907s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -595795s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -595610s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -595484s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -595375s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -595266s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -595141s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -595031s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -594921s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -594811s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -594703s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -594594s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -594485s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -594375s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -594266s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -594141s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -594016s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -593907s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -593782s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -593657s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -593543s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 6684	Thread sleep time: -593422s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe TID: 3816	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe TID: 5392	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 4232	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1132	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599630	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599513	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599266	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599155	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599011	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598482	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598265	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 597938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 597814	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 597688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 597571	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 597455	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 597331	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 597204	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 597079	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596954	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596829	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596704	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596579	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596455	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596317	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596132	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596025	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 595907	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 595795	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 595484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 595375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 595266	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 595141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 595031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 594921	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 594811	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 594703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 594594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 594375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 594266	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 594141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 594016	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 593907	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 593782	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 593657	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 593543	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 593422	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Thread delayed: delay time: 922337203685477

Source: Amcache.hve.8.dr	Binary or memory string: VMware
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.8.dr	Binary or memory string: VMware, Inc.
Source: QUOTATION#08670.exe, 00000000.00000002.2259784482.000001CF98408000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: svchost.exe, 0000001B.00000002.4408565698.000001E07B62B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.8.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.8.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: svchost.exe, 0000001B.00000002.4409167396.000001E07CE5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.8.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: QUOTATION#08670.exe, 00000000.00000002.2259784482.000001CF98408000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: QUOTATION#08670.exe, 00000000.00000002.2259784482.000001CF98408000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: Amcache.hve.8.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: QUOTATION#08670.exe, 00000000.00000002.2259784482.000001CF98408000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: QUOTATION#08670.exe, 00000000.00000002.2259784482.000001CF98408000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: Amcache.hve.8.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: CasPol.exe, 00000005.00000002.4626426253.0000000005CC0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.8.dr	Binary or memory string: vmci.sys
Source: QUOTATION#08670.exe, 00000000.00000002.2259784482.000001CF98408000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin`
Source: QUOTATION#08670.exe, 00000000.00000002.2259784482.000001CF98408000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: Amcache.hve.8.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: QUOTATION#08670.exe, 00000000.00000002.2259784482.000001CF98408000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: QUOTATION#08670.exe, 00000000.00000002.2259784482.000001CF98408000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Amcache.hve.8.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.8.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.8.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.8.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.8.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: QUOTATION#08670.exe, 00000000.00000002.2259784482.000001CF98408000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: QUOTATION#08670.exe, 00000000.00000002.2259784482.000001CF98408000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: Amcache.hve.8.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.8.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.8.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION#08670.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#08670.exe" -Force
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#08670.exe" -Force			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\QUOTATION#08670.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 440000	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 442000	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 8F6008	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#08670.exe" -Force			Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"			Jump to behavior

Source: CasPol.exe, 00000005.00000002.4621214709.0000000002DAF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR
Source: CasPol.exe, 00000005.00000002.4621214709.0000000002DAF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q><b>[ Program Manager]</b> (11/12/2024 07:55:25)<br>{Win}r{Win}TH
Source: CasPol.exe, 00000005.00000002.4621214709.0000000002DAF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: CasPol.exe, 00000005.00000002.4621214709.0000000002DAF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q3<b>[ Program Manager]</b> (11/12/2024 07:55:25)<br>
Source: CasPol.exe, 00000005.00000002.4621214709.0000000002DCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: <html>Time: 12/28/2024 18:32:36<br>User Name: user<br>Computer Name: 302494<br>OSFullName: Microsoft Windows 10 Pro<br>CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz<br>RAM: 8191.25 MB<br>IP Address: 8.46.123.175<br><hr><b>[ Program Manager]</b> (11/12/2024 07:55:25)<br>{Win}r{Win}r</html>
Source: CasPol.exe, 00000005.00000002.4621214709.0000000002DAF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q9<b>[ Program Manager]</b> (11/12/2024 07:55:25)<br>{Win}rTH
Source: CasPol.exe, 00000005.00000002.4621214709.0000000002DAF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q?<b>[ Program Manager]</b> (11/12/2024 07:55:25)<br>{Win}r{Win}rTH
Source: CasPol.exe, 00000005.00000002.4621214709.0000000002DAF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q8<b>[ Program Manager]</b> (11/12/2024 07:55:25)<br>{Win}TH

Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Queries volume information: C:\Users\user\Desktop\QUOTATION#08670.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#08670.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Queries volume information: C:\Users\user\AppData\Roaming\newapp\newapp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Queries volume information: C:\Users\user\AppData\Roaming\newapp\newapp.exe VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation

Source: C:\Users\user\Desktop\QUOTATION#08670.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disables UAC (registry)

Source: C:\Users\user\Desktop\QUOTATION#08670.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUA

Jump to behavior

Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.QUOTATION#08670.exe.1cfa83cbf08.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION#08670.exe.1cfa838ecc0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION#08670.exe.1cfa83cbf08.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION#08670.exe.1cfa838ecc0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.4621214709.0000000002D11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4621214709.0000000002D3C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4609800708.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2260686823.000001CFA8351000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QUOTATION#08670.exe PID: 3476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 4900, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.QUOTATION#08670.exe.1cfa83cbf08.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION#08670.exe.1cfa838ecc0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION#08670.exe.1cfa83cbf08.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION#08670.exe.1cfa838ecc0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.4621214709.0000000002D11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4609800708.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2260686823.000001CFA8351000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QUOTATION#08670.exe PID: 3476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 4900, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.QUOTATION#08670.exe.1cfa83cbf08.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION#08670.exe.1cfa838ecc0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION#08670.exe.1cfa83cbf08.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION#08670.exe.1cfa838ecc0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.4621214709.0000000002D11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4621214709.0000000002D3C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4609800708.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2260686823.000001CFA8351000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QUOTATION#08670.exe PID: 3476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 4900, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	21 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	212 Process Injection	1 Deobfuscate/Decode Files or Information	21 Input Capture	34 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	1 Obfuscated Files or Information	1 Credentials in Registry	241 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	2 Process Discovery	Distributed Component Object Model	21 Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Masquerading	LSA Secrets	161 Virtualization/Sandbox Evasion	SSH	1 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	161 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	212 Process Injection	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Hidden Files and Directories	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
QUOTATION#08670.exe	21%	ReversingLabs	Win64.Infostealer.Generic
QUOTATION#08670.exe	31%	Virustotal		Browse
QUOTATION#08670.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\newapp\newapp.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\newapp\newapp.exe	0%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
ercolina-usa.com	0%	Virustotal		Browse
ftp.ercolina-usa.com	3%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ercolina-usa.com	192.254.225.136	true	true	0%, Virustotal, Browse	unknown
api.ipify.org	172.67.74.152	true	false		high
ftp.ercolina-usa.com	unknown	unknown	true	3%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000001B.00000003.2760841753.000001E07CBC0000.00000004.00000800.00020000.00000000.sdmp, edb.log.27.dr	false	high
http://crl.ver)	svchost.exe, 0000001B.00000002.4409046537.000001E07CE00000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.ipify.org	QUOTATION#08670.exe, 00000000.00000002.2260686823.000001CFA8351000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.4621214709.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.4609800708.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
http://upx.sf.net	Amcache.hve.8.dr	false	high
https://g.live.com/odclientsettings/Prod1C:	edb.log.27.dr	false	high
https://account.dyn.com/	QUOTATION#08670.exe, 00000000.00000002.2260686823.000001CFA8351000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.4609800708.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
https://api.ipify.org/t	CasPol.exe, 00000005.00000002.4621214709.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	CasPol.exe, 00000005.00000002.4621214709.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://ftp.ercolina-usa.com	CasPol.exe, 00000005.00000002.4621214709.0000000002DCB000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.4621214709.0000000002D3C000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.4621214709.0000000002DAF000.00000004.00000800.00020000.00000000.sdmp	false	high
http://ercolina-usa.com	CasPol.exe, 00000005.00000002.4621214709.0000000002DCB000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.4621214709.0000000002D3C000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.4621214709.0000000002DAF000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
192.254.225.136	ercolina-usa.com	United States		46606	UNIFIEDLAYER-AS-1US	true
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1572925
Start date and time:	2024-12-11 09:25:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	QUOTATION#08670.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@14/19@2/3
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 74% Number of executed functions: 112 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WerFault.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173, 2.16.229.162, 20.190.147.1, 20.223.35.26, 13.107.246.63, 20.190.181.2, 172.202.163.200, 23.206.197.11, 20.74.47.205, 150.171.28.10, 23.206.197.51
Excluded domains from analysis (whitelisted): www.bing.com, onedsblobprdeus16.eastus.cloudapp.azure.com, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, tse1.mm.bing.net, g.bing.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, prod.fs.microsoft.com.akadns.net
Execution Graph export aborted for target newapp.exe, PID 5720 because it is empty
Execution Graph export aborted for target newapp.exe, PID 948 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:26:11	API Interceptor	9064484x Sleep call for process: CasPol.exe modified
03:26:13	API Interceptor	19x Sleep call for process: powershell.exe modified
03:26:16	API Interceptor	1x Sleep call for process: WerFault.exe modified
03:27:06	API Interceptor	3x Sleep call for process: svchost.exe modified
09:26:15	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run newapp C:\Users\user\AppData\Roaming\newapp\newapp.exe
09:26:23	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run newapp C:\Users\user\AppData\Roaming\newapp\newapp.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
192.254.225.136	SPECIFICATIONS.exe	Get hash	malicious	AgentTesla	Browse
	TECHNICAL SPECIFICATIONS.exe	Get hash	malicious	AgentTesla	Browse
	uLFOeGZaJS.exe	Get hash	malicious	AgentTesla	Browse
	RICHIESTA D'OFFERTA.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse
	QUOTATION#09678.exe	Get hash	malicious	AgentTesla	Browse
	PURCHASE SPCIFICIATIONS.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	LISTA DE COTIZACIONES.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	QUOTATION#5400.exe	Get hash	malicious	AgentTesla	Browse
	QUOTATION#2800-QUANTUM MACTOOLS.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	QUOTATION#2800-QUANTUM MACTOOLS.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
172.67.74.152	malware.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	api.ipify.org/
	Simple1.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Simple2.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	systemConfigChecker.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	systemConfigChecker.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Zc9eO57fgF.elf	Get hash	malicious	Unknown	Browse	api.ipify.org/
	67065b4c84713_Javiles.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	4F08j2Rmd9.bin	Get hash	malicious	Xmrig	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	INVOICE NO. USF23-24072 IGR23110.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	SPECIFICATIONS.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	EEMsLiXoiTzoaDd.scr	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	Statement 2024-11-29 (K07234).exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Employee_Letter.pdf	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	1mr7lpFIVI.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	jKDBppzWTb.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	enyi.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	proforma invoice.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	x.ps1	Get hash	malicious	PureLog Stealer, Quasar	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNIFIEDLAYER-AS-1US	https://zsuqwplt.cdrj.com.br/bfackjemFpbmFiLmFscmFobWFAZWphZGFoLmFlqmgtsj	Get hash	malicious	Unknown	Browse	192.185.214.196
	http://www.topbuildersolutions.net/clickthrough.aspx?rurl=https://search.app/?link=https://ZSUQWPLT.%63%64%72%6A%2E%63%6F%6D%2E%62%72%2FbfackjemFpbmFiLmFscmFobWFAZWphZGFoLmFlqmgtsj&eid=4070	Get hash	malicious	Unknown	Browse	192.185.214.196
	http://www.topbuildersolutions.net/clickthrough.aspx?rurl=https://search.app/?link=https://ARIQNEUB.cdrj.com.br%2Fxpkjxic2FidS5qb2huQGp1bWVpcmFoLmNvbQ==nishhe&eid=4070	Get hash	malicious	Unknown	Browse	192.185.214.196
	Hays eft_Receipt number N302143235953.htm	Get hash	malicious	Unknown	Browse	69.49.245.172
	EFT Remittance_(Deerequipment)CQDM.html	Get hash	malicious	Unknown	Browse	69.49.245.172
	https://vcsfi.kidsavancados.com/	Get hash	malicious	Captcha Phish	Browse	108.167.188.184
	FG Or#U00e7amento JAN 2025.pdf	Get hash	malicious	Unknown	Browse	108.167.132.213
	INVOICE NO. USF23-24072 IGR23110.exe	Get hash	malicious	AgentTesla	Browse	192.254.186.165
	SPECIFICATIONS.exe	Get hash	malicious	AgentTesla	Browse	192.254.225.136
	ExternalREMITTANCE ACH SCHEDULED 1210241424bec0c449d38092c0dbd844252d73 (24.0 KB).msg	Get hash	malicious	Unknown	Browse	69.49.245.172
CLOUDFLARENETUS	DEC 2024 RFQ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	LXS5itpTK7.exe	Get hash	malicious	Stealc	Browse	104.21.56.70
	https://advertising-case-id419348.d1yaxxd8bf42y5.amplifyapp.com/	Get hash	malicious	Unknown	Browse	104.26.5.15
	apDMcnqqWs.exe	Get hash	malicious	Unknown	Browse	162.159.138.232
	e8YDxjwJiT.exe	Get hash	malicious	Unknown	Browse	104.21.27.3
	TlNDyT2f5c.exe	Get hash	malicious	Unknown	Browse	104.21.27.3
	https://www.picotech.com/download/software/sr/PicoScope6_r6_14_69.exe	Get hash	malicious	Havoc	Browse	172.67.0.58
	Itaxyhi.exe	Get hash	malicious	Phemedrone Stealer	Browse	172.67.70.233
	SEejSLAS9f.exe	Get hash	malicious	Stealc	Browse	172.67.179.207
	CJE003889.exe	Get hash	malicious	FormBook	Browse	172.67.158.81

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	DEC 2024 RFQ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.74.152
	apDMcnqqWs.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	e8YDxjwJiT.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	TlNDyT2f5c.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	Itaxyhi.exe	Get hash	malicious	Phemedrone Stealer	Browse	172.67.74.152
	Aclatis tool.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	Aclatis tool.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	Confirm revised invoice to proceed with payment ASAP.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.74.152
	751ietQPnX.lnk	Get hash	malicious	RHADAMANTHYS	Browse	172.67.74.152

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\newapp\newapp.exe	Request for Quotation.pdf.exe	Get hash	malicious	XWorm	Browse
	RFQ_PO_UMQ736-ORDER#MATERIALS-LQKP0489.exe	Get hash	malicious	XWorm	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.2119.3372.exe	Get hash	malicious	XWorm	Browse
	PO_112234525626823775.js	Get hash	malicious	Lokibot	Browse
	PO_5545356763 7767634763.exe	Get hash	malicious	Unknown	Browse
	INV_35689.vbe	Get hash	malicious	AveMaria, UACMe	Browse
	2KEOzMcha8.lnk	Get hash	malicious	XWorm	Browse
	0097-CGM CIGIEMME S.p.A.exe	Get hash	malicious	AgentTesla	Browse
	Halkbank_Ekstre_2024061918_088957_785452.xlxs.exe	Get hash	malicious	AgentTesla	Browse
	09820292829102.exe	Get hash	malicious	AgentTesla	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.35901589905449205
Encrypted:	false
SSDEEP:	6:6xKdoaaD0JOCEfMuaaD0JOCEfMKQmDCexKdoaaD0JOCEfMuaaD0JOCEfMKQmDC:6aaD0JcaaD0JwQQHaaD0JcaaD0JwQQ
MD5:	C788EDB928436D0CE10A5BF198837D8A
SHA1:	F104B6AB797E0B16362BFB69F5000407CE6EFFD8
SHA-256:	E309925E38D727B91C5B0AD9FC86A778ECD0EBE80261F55E870AD6685B0CC0BD
SHA-512:	61F750C97F2E1EAF623486147F55B4BF39C34DF28DD124FA378973965A2AE0AAA967D71C88BE0D02E1B2D2B22E20199B9E817BE793A10C0CC9D12FE703E18CF2
Malicious:	false
Preview:	*.>...........k.....D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................................................k.............................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7304447629050714
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0y:9JZj5MiKNnNhoxuT
MD5:	C69178DF480B26C712A642B1B030882D
SHA1:	329A4DA3FCCCF444C2185F587A07AE4A33AD0EC3
SHA-256:	504030E0B6D1375CF72717F1E66A8C5FB2A85BCEC6A29BDB1407988F58FE9A31
SHA-512:	44F7B361984264F7D6B916C090EDF6FD989EBF75914C02D378D9A606A79CBDAA4B89707B75346C9298690E736142A8AB204E8904B440088CEE2D6C89490F9E81
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0xe633fadb, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.629190155363816
Encrypted:	false
SSDEEP:	1536:XSB2ESB2SSjlK/HZH03N9Jdt8gYkr3g16l2UPkLk+kDWyrufTRryrUOLUzCJ:Xaza9iJa+2UtmOQOL
MD5:	6488BC3868D9168FED09C66BAB8CF878
SHA1:	87F4455440E65EA259930553F3866D599F53EB35
SHA-256:	8CF0C861540F1AE0AA4B5D663230E2F78736CAD7E914D6F30CB9C74E07B7E85B
SHA-512:	8D6DC7868491351394FF24F0B7FBB0E35AEA3D7EDF9B2B8B4504E691C572355B2264979F46A9D08A0E7B57165F2B65A0D7CCFEBE051D21C5F199B4783EE226E9
Malicious:	false
Preview:	.3..... .......P.......X\...;...{......................0.j..........\|.......\|..h.g..........\|..0.j.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{...................................r.......\|....................X......\|...........................#......0.j.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07959283644269463
Encrypted:	false
SSDEEP:	3:seS/WetYeUSustuGtlfu3k7cpMUpuAll/B8x7cGtlAllHol///lZMPCyH:snzHJXGU7YMGl+cGXApo5
MD5:	352F57872AEC5BD2478D9DA0215894F8
SHA1:	3632CDF41B946E9D23A3902D0AF2FD26B64EF6AE
SHA-256:	45C3BA46B1347428EBF66FD83D58D381FDA6D1EE5FA0D17D15452BD9C2FF8C6F
SHA-512:	D9F95725DE209C8E23F76964C5F816849E7776A91EAC0ED8CF87D566289FA358BAAD23088C1B596171A855F90DD479B184165D70EDC37A872DB4CC8072D26442
Malicious:	false
Preview:	.d'{.....................................;...{.......\|.......\|...............\|.......\|..TG.A.....\|....................X......\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_QUOTATION#08670._ded9c2b02a112c627fa2bc189757858bd4a2e4_d27265d9_ca1fc45b-6ffd-4451-8c84-d2e0ed457cc6\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1541425124364988
Encrypted:	false
SSDEEP:	192:OsIjAdoG6on0M9odaWBBYtDGhzuiFpZ24lO8+w:OfqotDM9odamYWzuiFpY4lO8+
MD5:	033381F6ADFD20DC31957B2768F1A282
SHA1:	3C61A6CFB98B1513F3361235DB275333B1152AB9
SHA-256:	1E5F24D1032516FC81BC2BE34E3C8052292EB665FE8C1095E836F1C68C3752FD
SHA-512:	970C8E7B20CF0408C3050D703A6830800FB922CD7FD7D69513E187D572452253C33600CA9C1589B1EDA5C3F7C501C45A8614D47D77445FD8E7BC459C8CC6CF1F
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.3.7.9.1.6.8.3.9.9.4.9.7.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.8.3.7.9.1.7.1.4.1.5.1.4.4.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.a.1.f.c.4.5.b.-.6.f.f.d.-.4.4.5.1.-.8.c.8.4.-.d.2.e.0.e.d.4.5.7.c.c.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.1.9.b.4.6.0.f.-.c.c.e.5.-.4.b.6.8.-.a.c.5.3.-.6.c.9.1.2.0.e.a.6.8.9.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.Q.U.O.T.A.T.I.O.N.#.0.8.6.7.0...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.C.o.n.s.o.l.e.A.p.p.l.i.c.a.t.i.o.n.2...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.d.9.4.-.0.0.0.1.-.0.0.1.5.-.3.c.b.9.-.8.6.5.1.a.6.4.b.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.d.c.b.f.4.1.1.f.6.6.d.4.5.5.e.6.0.e.4.3.6.2.c.d.b.d.5.d.b.0.a.0.0.0.0.0.0.0.0.!.0.0.0.0.4.d.2.e.4.2.0.a.a.6.a.8.2.8.9.7.6.3.b.9.c.0.a.7.9.f.c.c.b.7.e.1.8.e.e.0.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER28F3.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Wed Dec 11 08:26:10 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	493857
Entropy (8bit):	3.329037324067248
Encrypted:	false
SSDEEP:	3072:PQfIevpvLYoAwtMv4fKcSoeXLTNQlY1CCqEFO3+vNxknV0:PzAFLYoAjOC57qv3Q7ke
MD5:	3E093F5425CA13F59BCE85F3C0A86720
SHA1:	01C07D24959004353C714831EF26911B390A58FE
SHA-256:	62C64216A896DB793BB29932A731C2577460F7949F647B3A67AFE5A090369FC2
SHA-512:	05FB75371FD16DA7B4C191B7838756209AC6F5E9B949672EAA95A96FEB10AB066768193469E05F78EFBDE6705DDBF5F984D2C4FEC574B782B4BB0689B96F11C4
Malicious:	false
Preview:	MDMP..a..... ........LYg............t...........H...........$....%.......3...&.......o..j...........l.......8...........T............9..AO...........Y...........[..............................................................................eJ......L\......Lw......................T............LYg.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3335.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8832
Entropy (8bit):	3.7129118260093117
Encrypted:	false
SSDEEP:	192:R6l7wVeJ3kO6Y2Dqmp9gmfZQkprV89bp0kfFDm:R6lXJUO6YGp9gmfaTpffs
MD5:	EA48EAB9DEC1C2656022BB7A0923CB38
SHA1:	B9BEC32F07B30ED9FEC4BA8A3E0329FD550D3562
SHA-256:	C5EA70E859101569D524CADC024706DB56D972F9E31F8EC5DAAF803DDA1A7AA4
SHA-512:	BEC8EF36A01707AF623B5E418DA101BC7956E32235077CC5FFA4DAD65A916428726840EB9F9CB02672FAE45F80B48E99781298A42882538C12E33B24C0309B58
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.4.7.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3375.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4847
Entropy (8bit):	4.539628516322753
Encrypted:	false
SSDEEP:	48:cvIwWl8zsjJg771I97ipWpW8VYRYm8M4JhrSExFkyq8vfSEiVEYxNz0Nud:uIjf9I7lY7VZJhr74Wf7gEgNz0Nud
MD5:	E50F3CFD1F561ECADE73C84C57F353FD
SHA1:	83E9048EA951CB7967556E4E733AA60F1B044A48
SHA-256:	DD3C7813633C61D7CB2397C266200F54F0489B209EEF92EDEF634FFCD9D7EA99
SHA-512:	8F77BB15C7EABC2D2C34E6416555BFDCB30C789FB48692AEA28FAD1F8646AFFB6B7550CF86684EA72B0CE4FFA9623677A3A88BC59EAC8B271B83C25C9D4519C8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="626368" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\newapp.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\newapp\newapp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulDsU/lL:NllUw0l
MD5:	40AD2DADD7C6A77A6CBDE5057E88E60A
SHA1:	CF25D4A536DA991F8D656DAAFB7D6A26239264EA
SHA-256:	8A1847256A0D388487F911FCE41E80E711DFF9CDCF09A7A3BB7465FB13867A66
SHA-512:	3EEA710C6BAD9A37B60902DC731F37B72E22C98CEBE95C56F8A0A88FD1A5C479D46953D2547F55F26438C1ABC164E3FF8849CA8B385F1B699CB156846CE146C3
Malicious:	false
Preview:	@...e...................................1............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1othnnnn.rpl.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_32ilg1sr.4n0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d0t2432c.whl.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tt0wu3gx.nko.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\newapp\newapp.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	108664
Entropy (8bit):	5.8959760602012965
Encrypted:	false
SSDEEP:	1536:QSF7vA1hRqHNxxMjlI3ZC+0CtOss6mdcQ6A4vhZ91RKGpQJN:nA1hYPMUs6mdclA4vhNRKG4N
MD5:	914F728C04D3EDDD5FBA59420E74E56B
SHA1:	8C68CA3F013C490161C0156EF359AF03594AE5E2
SHA-256:	7D3BDB5B7EE9685C7C18C0C3272DA2A593F6C5C326F1EA67F22AAE27C57BA1E6
SHA-512:	D7E49B361544BA22A0C66CF097E9D84DB4F3759FBCC20386251CAAC6DA80C591861C1468CB7A102EEE1A1F86C974086EBC61DE4027F9CD22AD06D63550400D6D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: Request for Quotation.pdf.exe, Detection: malicious, Browse Filename: RFQ_PO_UMQ736-ORDER#MATERIALS-LQKP0489.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win64.MalwareX-gen.2119.3372.exe, Detection: malicious, Browse Filename: PO_112234525626823775.js, Detection: malicious, Browse Filename: PO_5545356763 7767634763.exe, Detection: malicious, Browse Filename: INV_35689.vbe, Detection: malicious, Browse Filename: 2KEOzMcha8.lnk, Detection: malicious, Browse Filename: 0097-CGM CIGIEMME S.p.A.exe, Detection: malicious, Browse Filename: Halkbank_Ekstre_2024061918_088957_785452.xlxs.exe, Detection: malicious, Browse Filename: 09820292829102.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<.]..............0..X...........v... ........@.. ..............................O.....`.................................\v..O.......$............f..xB..........$u............................................... ............... ..H............text....V... ...X.................. ..`.rsrc...$............Z..............@..@.reloc...............d..............@..B.................v......H.......(...................xE..$t......................................2~P....o.....r...p(....VrK..p(....s.....P...*..0.._.......~....:O....>.....%.rm..p...A...s......su....%.r...p...A...s....rm..p.su....%.r...p...B...s......su....%.r...p...B...s....r...p.su....%.r...p...C...s......su....%.r...p...C...s....r...p.su....%.r...p...D...s......su....%.r...p...D...s....r...p.su....%.r...p...E...s......su....%..r...p...E...s....r...p.su....%..r...p...F...s......su....%..r...p...F

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.468940287709282
Encrypted:	false
SSDEEP:	6144:szZfpi6ceLPx9skLmb0f4ZWSP3aJG8nAgeiJRMMhA2zX4WABluuNNjDH5S:SZHt4ZWOKnMM6bFpXj4
MD5:	91A2E3054F3D8AD97DBF3782AD4C4CCF
SHA1:	3103421C51009F5FC79EF67453832B8A15D1E3C1
SHA-256:	26E52FA0CF50D48506FA4AC34CA88FF7ECFFA032EE02107856F3A8CA654F43ED
SHA-512:	D2FB0419D9EDDD64FB01BA142C330997EC518AE0D444481086DD05EEC5E3B3051E281565B3DD9F1AF5080AAF84FC8EE3F09AF5DC4EBABCDE83D2743F136935A1
Malicious:	false
Preview:	regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..S.K................................................................................................................................................................................................................................................................................................................................................g........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Roaming\newapp\newapp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	486
Entropy (8bit):	5.043661544202442
Encrypted:	false
SSDEEP:	12:z30d30C4BFNY8fNFquci7S1pE+DPOCN6+QOH5JyY:z3I3+DO4UE+Tz5JB
MD5:	323764DD20845C0EE00598E8EE35467C
SHA1:	7A3DC131CCF4B3A41893F83C553193267A7F654F
SHA-256:	7DEBA11FDF38735A63038192BF033BAE7F49E72E598F0AEFD3FC626477A31FEF
SHA-512:	BF353BCB64D65024C7E627788D32087C15EC5F8780AACF61D57BC22923F2283D0A5ED389CA644270013835EF26269F2E5EEE4ED610AC88254855DE80D67F3700
Malicious:	false
Preview:	Microsoft .NET Framework CasPol 4.8.4084.0..for Microsoft .NET Framework version 4.8.4084.0..Copyright (C) Microsoft Corporation. All rights reserved.....WARNING: The .NET Framework does not apply CAS policy by default. Any settings shown or modified by CasPol will only ..affect applications that opt into using CAS policy. ....Please see http://go.microsoft.com/fwlink/?LinkId=131738 for more information. ......ERROR: Not enough arguments....For usage information, use 'caspol -?'..

Static File Info

General

File type:	PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.996657860029066
TrID:	Win64 Executable Console Net Framework (206006/5) 48.58% Win64 Executable Console (202006/5) 47.64% Win64 Executable (generic) (12005/4) 2.83% Generic Win/DOS Executable (2004/3) 0.47% DOS Executable Generic (2002/1) 0.47%
File name:	QUOTATION#08670.exe
File size:	604'296 bytes
MD5:	93bdfd46628601b04ea067e5f52187d7
SHA1:	4d2e420aa6a8289763b9c0a79fccb7e18ee02294
SHA256:	f2d566b1b667cf8ea8c35f2827f62e7430941e1fdd13019811768e3a942ec926
SHA512:	1397ea8a0b29caa8497bc4efb4c20652980c2c76f617a2c235b925bb1ddd7c830f2b661feca5674b002479d230b78240455afa6a31c4854dba3229b903bb8f8c
SSDEEP:	12288:0ZgE2xCedYZjsPmHfw+KsbAMgqURZyaRbN7RjVI06fbXB12dzJJVNcxWq:0ZgEa7dYlsPm/msR1QfJI591ezJHNcH
TLSH:	66D4232DBBC84325E16CD7B2D4737C609459A8CF2C422B7B20C6D959C51E3A9079CFEA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...fWXg.........."...0.(................ ....@...... .......................`............`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67585766 [Tue Dec 10 14:59:50 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x5f6	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x1e28	0x2000	cbca7638eda5f70dee187f0246c4577b	False	0.604736328125	data	6.055618071226943	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x4000	0x5f6	0x600	5826f3aed3590dec1a7579511b38ce91	False	0.4205729166666667	data	4.182503871777562	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x40a0	0x36c	data			0.3972602739726027
RT_MANIFEST	0x440c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 11, 2024 09:26:08.867377043 CET	49715	443	192.168.2.6	172.67.74.152
Dec 11, 2024 09:26:08.867417097 CET	443	49715	172.67.74.152	192.168.2.6
Dec 11, 2024 09:26:08.868853092 CET	49715	443	192.168.2.6	172.67.74.152
Dec 11, 2024 09:26:08.921477079 CET	49715	443	192.168.2.6	172.67.74.152
Dec 11, 2024 09:26:08.921498060 CET	443	49715	172.67.74.152	192.168.2.6
Dec 11, 2024 09:26:10.142571926 CET	443	49715	172.67.74.152	192.168.2.6
Dec 11, 2024 09:26:10.142677069 CET	49715	443	192.168.2.6	172.67.74.152
Dec 11, 2024 09:26:10.170567989 CET	49715	443	192.168.2.6	172.67.74.152
Dec 11, 2024 09:26:10.170588017 CET	443	49715	172.67.74.152	192.168.2.6
Dec 11, 2024 09:26:10.170830011 CET	443	49715	172.67.74.152	192.168.2.6
Dec 11, 2024 09:26:10.364346027 CET	49715	443	192.168.2.6	172.67.74.152
Dec 11, 2024 09:26:10.846026897 CET	49715	443	192.168.2.6	172.67.74.152
Dec 11, 2024 09:26:10.891340017 CET	443	49715	172.67.74.152	192.168.2.6
Dec 11, 2024 09:26:11.178541899 CET	443	49715	172.67.74.152	192.168.2.6
Dec 11, 2024 09:26:11.178601980 CET	443	49715	172.67.74.152	192.168.2.6
Dec 11, 2024 09:26:11.178668022 CET	49715	443	192.168.2.6	172.67.74.152
Dec 11, 2024 09:26:11.218447924 CET	49715	443	192.168.2.6	172.67.74.152
Dec 11, 2024 09:26:13.215630054 CET	49718	21	192.168.2.6	192.254.225.136
Dec 11, 2024 09:26:13.336097002 CET	21	49718	192.254.225.136	192.168.2.6
Dec 11, 2024 09:26:13.336729050 CET	49718	21	192.168.2.6	192.254.225.136
Dec 11, 2024 09:26:13.363349915 CET	49718	21	192.168.2.6	192.254.225.136
Dec 11, 2024 09:26:13.484947920 CET	21	49718	192.254.225.136	192.168.2.6
Dec 11, 2024 09:26:13.488395929 CET	49718	21	192.168.2.6	192.254.225.136
Dec 11, 2024 09:26:13.713069916 CET	49719	21	192.168.2.6	192.254.225.136
Dec 11, 2024 09:26:13.833697081 CET	21	49719	192.254.225.136	192.168.2.6
Dec 11, 2024 09:26:13.833777905 CET	49719	21	192.168.2.6	192.254.225.136
Dec 11, 2024 09:26:13.833996058 CET	49719	21	192.168.2.6	192.254.225.136
Dec 11, 2024 09:26:13.835439920 CET	49720	21	192.168.2.6	192.254.225.136
Dec 11, 2024 09:26:13.954716921 CET	21	49719	192.254.225.136	192.168.2.6
Dec 11, 2024 09:26:13.954807043 CET	49719	21	192.168.2.6	192.254.225.136
Dec 11, 2024 09:26:13.955890894 CET	21	49720	192.254.225.136	192.168.2.6
Dec 11, 2024 09:26:13.955986023 CET	49720	21	192.168.2.6	192.254.225.136
Dec 11, 2024 09:26:13.956193924 CET	49720	21	192.168.2.6	192.254.225.136
Dec 11, 2024 09:26:13.957678080 CET	49721	21	192.168.2.6	192.254.225.136
Dec 11, 2024 09:26:14.077338934 CET	21	49720	192.254.225.136	192.168.2.6
Dec 11, 2024 09:26:14.077393055 CET	49720	21	192.168.2.6	192.254.225.136
Dec 11, 2024 09:26:14.078254938 CET	21	49721	192.254.225.136	192.168.2.6
Dec 11, 2024 09:26:14.078373909 CET	49721	21	192.168.2.6	192.254.225.136
Dec 11, 2024 09:26:14.078541994 CET	49721	21	192.168.2.6	192.254.225.136
Dec 11, 2024 09:26:14.199629068 CET	21	49721	192.254.225.136	192.168.2.6
Dec 11, 2024 09:26:14.200269938 CET	49721	21	192.168.2.6	192.254.225.136
Dec 11, 2024 09:27:56.049801111 CET	49984	21	192.168.2.6	192.254.225.136
Dec 11, 2024 09:27:56.170242071 CET	21	49984	192.254.225.136	192.168.2.6
Dec 11, 2024 09:27:56.170783997 CET	49984	21	192.168.2.6	192.254.225.136
Dec 11, 2024 09:27:56.174698114 CET	49984	21	192.168.2.6	192.254.225.136
Dec 11, 2024 09:27:56.295253038 CET	21	49984	192.254.225.136	192.168.2.6
Dec 11, 2024 09:27:56.297162056 CET	49984	21	192.168.2.6	192.254.225.136

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 11, 2024 09:26:08.722477913 CET	51989	53	192.168.2.6	1.1.1.1
Dec 11, 2024 09:26:08.861620903 CET	53	51989	1.1.1.1	192.168.2.6
Dec 11, 2024 09:26:12.346748114 CET	65277	53	192.168.2.6	1.1.1.1
Dec 11, 2024 09:26:13.181478024 CET	53	65277	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 11, 2024 09:26:08.722477913 CET	192.168.2.6	1.1.1.1	0x6d26	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:12.346748114 CET	192.168.2.6	1.1.1.1	0xbe14	Standard query (0)	ftp.ercolina-usa.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 11, 2024 09:26:08.861620903 CET	1.1.1.1	192.168.2.6	0x6d26	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:08.861620903 CET	1.1.1.1	192.168.2.6	0x6d26	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:08.861620903 CET	1.1.1.1	192.168.2.6	0x6d26	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:26:13.181478024 CET	1.1.1.1	192.168.2.6	0xbe14	No error (0)	ftp.ercolina-usa.com	ercolina-usa.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 11, 2024 09:26:13.181478024 CET	1.1.1.1	192.168.2.6	0xbe14	No error (0)	ercolina-usa.com		192.254.225.136	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49715	172.67.74.152	443	4900	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 08:26:10 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-12-11 08:26:11 UTC	425	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 08:26:11 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8f04169acf044245-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1573&min_rtt=1564&rtt_var=606&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2819&recv_bytes=769&delivery_rate=1778319&cwnd=187&unsent_bytes=0&cid=2e46955a71db2b49&ts=1044&x=0"
2024-12-11 08:26:11 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 37 35 Data Ascii: 8.46.123.175

Target ID:	0
Start time:	03:26:04
Start date:	11/12/2024
Path:	C:\Users\user\Desktop\QUOTATION#08670.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\QUOTATION#08670.exe"
Imagebase:	0x1cf96750000
File size:	604'296 bytes
MD5 hash:	93BDFD46628601B04EA067E5F52187D7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2259784482.000001CF98408000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2260686823.000001CFA8351000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2260686823.000001CFA8351000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:26:04
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:26:07
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#08670.exe" -Force
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:26:07
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:26:07
Start date:	11/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Imagebase:	0x6e0000
File size:	108'664 bytes
MD5 hash:	914F728C04D3EDDD5FBA59420E74E56B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.4621214709.0000000002D11000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.4621214709.0000000002D11000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.4621214709.0000000002D3C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.4609800708.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.4609800708.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	03:26:07
Start date:	11/12/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 3476 -s 1468
Imagebase:	0x7ff76ffa0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:26:14
Start date:	11/12/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff717f30000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:26:23
Start date:	11/12/2024
Path:	C:\Users\user\AppData\Roaming\newapp\newapp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\newapp\newapp.exe"
Imagebase:	0xff0000
File size:	108'664 bytes
MD5 hash:	914F728C04D3EDDD5FBA59420E74E56B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:26:23
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:26:31
Start date:	11/12/2024
Path:	C:\Users\user\AppData\Roaming\newapp\newapp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\newapp\newapp.exe"
Imagebase:	0x2e0000
File size:	108'664 bytes
MD5 hash:	914F728C04D3EDDD5FBA59420E74E56B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	03:26:31
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	03:27:06
Start date:	11/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD348011D0 Relevance: 7.4, Strings: 5, Instructions: 1179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

xo4, xrefs: 00007FFD3482A8E6
xo4, xrefs: 00007FFD3482A864
xo4, xrefs: 00007FFD3482A0E3
xo4, xrefs: 00007FFD3482A124
xo4, xrefs: 00007FFD3482A8A5

Memory Dump Source

Source File: 00000000.00000002.2265041646.00007FFD34800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34800000_QUOTATION#08670.jbxd

Similarity

API ID:
String ID: xo4$xo4$xo4$xo4$xo4
API String ID: 0-2346567174
Opcode ID: abc185d03921c65bad59da1ea281c6224515653cd8d5505f075bdb179221ba32
Instruction ID: b8b39dad56b0cef7c646c608952606b69b7782814b39cbb28495129a6cc8b000
Opcode Fuzzy Hash: abc185d03921c65bad59da1ea281c6224515653cd8d5505f075bdb179221ba32
Instruction Fuzzy Hash: 31720671B0DA4A4FEBA8DB1C48A56B977D2EF8A754F0401BED54DC3293DD28EC029781

Function 00007FFD34802168 Relevance: 4.8, Strings: 2, Instructions: 2258COMMON

Download Yara Rule

Strings

fL_H, xrefs: 00007FFD3481D65D
L, xrefs: 00007FFD3481E066

Memory Dump Source

Source File: 00000000.00000002.2265041646.00007FFD34800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34800000_QUOTATION#08670.jbxd

Similarity

API ID:
String ID: L$fL_H
API String ID: 0-3757094450
Opcode ID: 0f51a1090109f28bdfe0a1415f439b35e22d93dad64cd96fe647877c78338c9d
Instruction ID: b175c841d5ca003c3813b40a5dbb31779eb230d71e274265dce83602f5be49a1
Opcode Fuzzy Hash: 0f51a1090109f28bdfe0a1415f439b35e22d93dad64cd96fe647877c78338c9d
Instruction Fuzzy Hash: FAE2C531B1C90A4FEBA8DB1C94A5A7473D1EFAA314B1401BBD54EC72A2DD29FC42D781

Function 00007FFD34802F80 Relevance: 2.1, Strings: 1, Instructions: 844
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(, xrefs: 00007FFD34832515

Memory Dump Source

Source File: 00000000.00000002.2265041646.00007FFD34800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34800000_QUOTATION#08670.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 0558accd8d6ca9c0835d2ed54d5182d4974924e8b719fb954e6e538194bb2ab4
Instruction ID: 86a87858e19d632533612bd8445a87b935d6efa6ec4204acc26c2471a35fccc9
Opcode Fuzzy Hash: 0558accd8d6ca9c0835d2ed54d5182d4974924e8b719fb954e6e538194bb2ab4
Instruction Fuzzy Hash: EE429134B1CA498FDBA8DB18C4A5AB973D1FF99300F14467EE54EC7292CE38E8819741

Function 00007FFD34802F48 Relevance: 1.2, Instructions: 1198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2265041646.00007FFD34800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34800000_QUOTATION#08670.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 355655785eabf6095afa3d8a489691403e4e50f4f4a9e40daa0b60789c3623d2
Instruction ID: a07767f47e885ec127d178781f57104f2d8c6874ce712b9fe7bc0f0cac2cf026
Opcode Fuzzy Hash: 355655785eabf6095afa3d8a489691403e4e50f4f4a9e40daa0b60789c3623d2
Instruction Fuzzy Hash: 3482A035B18E0A4FEBA8DB1884B567573D1FF9A344B1442B9D58EC7386DE28EC429780

Function 00007FFD3482B460 Relevance: .9, Instructions: 862COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2265041646.00007FFD34800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34800000_QUOTATION#08670.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e23a0140cc74d6bc559c1a75c89647c6b439ee74198c9fbd94e8d5d0e428078e
Instruction ID: 3094e44bc8c25657c791b9a8be5239aca15d7488f5b4470da393e1bf0319eb0f
Opcode Fuzzy Hash: e23a0140cc74d6bc559c1a75c89647c6b439ee74198c9fbd94e8d5d0e428078e
Instruction Fuzzy Hash: F2428231718E064FDBA8EB18C4A1A75B3E1FFA9344B1445BDD44EC7686CE39F8868784

Function 00007FFD3482B3E8 Relevance: .7, Instructions: 742COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2265041646.00007FFD34800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34800000_QUOTATION#08670.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f50dfa40591d6a39c5c92f2b0ebb5a95ef147ad2ea9ba9ba947dca7c1313cd0
Instruction ID: e041c5823864fc004942cf68175bbc7ca12e06c8131d316f9e59bca52f4b77f6
Opcode Fuzzy Hash: 4f50dfa40591d6a39c5c92f2b0ebb5a95ef147ad2ea9ba9ba947dca7c1313cd0
Instruction Fuzzy Hash: B2422C30A18A0A8FEBA8DB18C4A4BB973E1FF59344F1041B9D54ED7291DE39F885DB41

Function 00007FFD34800CC9 Relevance: 1.6, APIs: 1, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 00007FFD34800D7F

Memory Dump Source

Source File: 00000000.00000002.2265041646.00007FFD34800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34800000_QUOTATION#08670.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: 0c039df62e2b4bce1aad636c7344191e7ee08f782945efcae36c63c434d31b45
Instruction ID: 9d63abda4c9e5313f30160c46e5c823b6b0a7ff16c273a04e3295ce04ce81cab
Opcode Fuzzy Hash: 0c039df62e2b4bce1aad636c7344191e7ee08f782945efcae36c63c434d31b45
Instruction Fuzzy Hash: 9431C73090C7889FD729DBA8D855BFABBF0EF16321F04426ED089C31A2DA64A445CB51

Function 00007FFD34910618 Relevance: 1.4, Strings: 1, Instructions: 197COMMON

Download Yara Rule

Strings

A, xrefs: 00007FFD34910686

Memory Dump Source

Source File: 00000000.00000002.2265549447.00007FFD34910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34910000_QUOTATION#08670.jbxd

Similarity

API ID:
String ID: A
API String ID: 0-3554254475
Opcode ID: 51943353c5f858b171e5bd454eb353a53f8f1aedef8fe9b3215515ef0bf8b656
Instruction ID: 73b7ad86e3f771ee221c6c9e34c02fe803d2be21c788a70ab5840b5d4cdd28be
Opcode Fuzzy Hash: 51943353c5f858b171e5bd454eb353a53f8f1aedef8fe9b3215515ef0bf8b656
Instruction Fuzzy Hash: A8516E3050D6898FDB56DB28CCA4AB47BE0FF5A304F1505EDD04ACB5CACE6EA846C791

Function 00007FFD34911630 Relevance: .4, Instructions: 390COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2265549447.00007FFD34910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34910000_QUOTATION#08670.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca9193d99fab4d213b9735c585f53db914c748ce1d3fcc0eb6be18b5b9042939
Instruction ID: 71211f6c7d06ba8dbc0184bd0df8a04a429b0851c404f4cb394b5c77736e3449
Opcode Fuzzy Hash: ca9193d99fab4d213b9735c585f53db914c748ce1d3fcc0eb6be18b5b9042939
Instruction Fuzzy Hash: 2FC11732A0E7C55FD756DB3888A61A47FE0EF5B210B0901FFC199CB1A7DA1D6806D362

Function 00007FFD34910060 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2265549447.00007FFD34910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34910000_QUOTATION#08670.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f9e7d801a7f70a14da96c330cc48463d9bab977a704e9d912bf0756c9e8dc1f
Instruction ID: 836cc368ed49fe6cef33ca694c8deb45b4af71976c4a9f2f57d2b015c1b2f5cb
Opcode Fuzzy Hash: 8f9e7d801a7f70a14da96c330cc48463d9bab977a704e9d912bf0756c9e8dc1f
Instruction Fuzzy Hash: 85317412B0DE8A0FEB9A9A2C28A01B477D2DF9A220B4901FFD54CC31DBDD0E9C42C350

Function 00007FFD349103A3 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2265549447.00007FFD34910000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34910000_QUOTATION#08670.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdf38173ad493cf452cebe8e64a646c4180de1ee3e805fea3a73e3ece80e8bd8
Instruction ID: bbde1a3516a7bdce4150a101c07105408a511d247cf57d93bedff1d77fbbfce1
Opcode Fuzzy Hash: fdf38173ad493cf452cebe8e64a646c4180de1ee3e805fea3a73e3ece80e8bd8
Instruction Fuzzy Hash: E5F0A73271CE4C4FD79CDA1CA855139B7D2EBD913674583BFE08EC3166DA269C428304

Non-executed Functions

Function 00007FFD3482B450 Relevance: .6, Instructions: 577COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2265041646.00007FFD34800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34800000_QUOTATION#08670.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8a051cafcec651b852382ec6b7180ac1cd5a40f42a24219b9e296214354b7df
Instruction ID: 0e97cf7a8c846deb823598bae7f9a748da3f7c2ea828fd247819fe62d4046b76
Opcode Fuzzy Hash: f8a051cafcec651b852382ec6b7180ac1cd5a40f42a24219b9e296214354b7df
Instruction Fuzzy Hash: 72F11727B0C9662AF731B7ACB4A51EE7B94DF81375B080277D68CDA083D91878C683D4

Function 00007FFD348261CE Relevance: .4, Instructions: 430COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2265041646.00007FFD34800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34800000_QUOTATION#08670.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0211efbaee8ac1a53f229e3897a1a478a0406514ffbb453af0b0a7671c3dc7c
Instruction ID: 3d35870d87b422fe9e457fc1e7256baed99f9be352ca0657e8c0d3b17159eef7
Opcode Fuzzy Hash: b0211efbaee8ac1a53f229e3897a1a478a0406514ffbb453af0b0a7671c3dc7c
Instruction Fuzzy Hash: 08D1C521B1CE4A4BEB58AB1894A227973D1FF99344F40427DE14ED72D3DE2CF8429781

Analysis Process: CasPol.exePID: 4900, Parent PID: 3476COMMON

Execution Graph

Execution Coverage:	13.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	193
Total number of Limit Nodes:	19

Executed Functions

Function 064766E0 Relevance: .8, Instructions: 821COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37ae5474656e308099d3f76e5aa3038f17b7fb4bff111114f802c8ba46da51f5
Instruction ID: 4b4b297c1288ed6de4825b332a300dde703775b5914eac1d8e5c0178058854de
Opcode Fuzzy Hash: 37ae5474656e308099d3f76e5aa3038f17b7fb4bff111114f802c8ba46da51f5
Instruction Fuzzy Hash: E1629C30B002058FDB65EB68D594AEEBBB3EF85310F55846AE406AB351DB35ED42CB90

Function 0647B318 Relevance: .8, Instructions: 768COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2354186587ea808852e638192935b38435d5f2970df5c49e79d29021f6e5c671
Instruction ID: 5077f2f84d7324dece090713dc2361dba7cf0eefa80ce2bde9ef173008896e77
Opcode Fuzzy Hash: 2354186587ea808852e638192935b38435d5f2970df5c49e79d29021f6e5c671
Instruction Fuzzy Hash: 03525E30E102098FEF65DFA8D4807EEBBA2EB85310F64852BE405EB355DA35DD85CB91

Function 0647C268 Relevance: .6, Instructions: 648COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04b9252f256bdb7bdd9d615bad9bc2c345b9f9d12cf20083379a19b4fea07b0a
Instruction ID: 307065c8860b4dc12d8c4ca04712804eaaea6e9aebdd0a4e51702e37911c7e88
Opcode Fuzzy Hash: 04b9252f256bdb7bdd9d615bad9bc2c345b9f9d12cf20083379a19b4fea07b0a
Instruction Fuzzy Hash: AD326035B10205DFDB65EB68D890BEEBBB2FB88310F14852AE505EB355DB35EC418B90

Function 064756B0 Relevance: .6, Instructions: 600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34afd39323efa02372026ae9901b397dd43f5a9bec3941976f9667bebc0ca800
Instruction ID: b930dc87ceec10b80ffa477bfd91e402289ea83e532eae1f4bdaf1cb21543e69
Opcode Fuzzy Hash: 34afd39323efa02372026ae9901b397dd43f5a9bec3941976f9667bebc0ca800
Instruction Fuzzy Hash: BB22C075F002158BDF69DB64D8846EEBBB2EB84320F25842AE819DF385CE35DC45CB90

Function 06473570 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc65e0dff94c1f7b60b5f35957548cb76cdce3b7f8940da387aeb42d3efe6a96
Instruction ID: 76c1f98628e40126ac50443a37627be56a9c32cfc0767467ac53601084ace5ce
Opcode Fuzzy Hash: bc65e0dff94c1f7b60b5f35957548cb76cdce3b7f8940da387aeb42d3efe6a96
Instruction Fuzzy Hash: 11323E31E1061ACFCB25EF75C85059DB7B2FFD9300F6196AAD409A7214EF31AA85CB90

Function 06477E68 Relevance: .5, Instructions: 476COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1adca8cf6dda2305a8c71ce36bbb858328f4a871e9cd096388593cba544d91e1
Instruction ID: 3503ba5e7d28a1bda359d907e050036f0f48a2b2140104f42506b396c4d58f39
Opcode Fuzzy Hash: 1adca8cf6dda2305a8c71ce36bbb858328f4a871e9cd096388593cba544d91e1
Instruction Fuzzy Hash: 4402AD31B00216CFDB69DB64D8946EEBBA2FF84310F14856AE415EB385DB75ED42CB80

Function 0646A0D1 Relevance: 6.1, APIs: 4, Instructions: 137
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0646A15E
GetCurrentThread.KERNEL32 ref: 0646A19B
GetCurrentProcess.KERNEL32 ref: 0646A1D8
GetCurrentThreadId.KERNEL32 ref: 0646A231

Memory Dump Source

Source File: 00000005.00000002.4627122360.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6460000_CasPol.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 4e211595fde5f8a4918f09b9aa949dc0f1efd2b48f72f661f36c3b95ef608b5d
Instruction ID: cb0807c776c9fc34656c5bf804a9a36fa11f0c9fd8840b73de0816865e3d49a2
Opcode Fuzzy Hash: 4e211595fde5f8a4918f09b9aa949dc0f1efd2b48f72f661f36c3b95ef608b5d
Instruction Fuzzy Hash: 705157B09007498FDB54CFAAD948BDEBFF1BF88314F24805AE409B7251DB749984CB66

Function 0646A0E0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0646A15E
GetCurrentThread.KERNEL32 ref: 0646A19B
GetCurrentProcess.KERNEL32 ref: 0646A1D8
GetCurrentThreadId.KERNEL32 ref: 0646A231

Memory Dump Source

Source File: 00000005.00000002.4627122360.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6460000_CasPol.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 526713542851aa1e7680b42e9d5229fd719f7b300e024dafacba4a8c3fd2463d
Instruction ID: 00616379f9e02d8cb90543a9adf0e62b339cdfa5c71016af89b5eeb1bb922be4
Opcode Fuzzy Hash: 526713542851aa1e7680b42e9d5229fd719f7b300e024dafacba4a8c3fd2463d
Instruction Fuzzy Hash: 935145B09007498FDB44CFAAD948B9EBFF1AF88314F24845AE409A7351DB749984CB66

Function 00DCEFB8 Relevance: 1.6, APIs: 1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.4620553542.0000000000DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_dc0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebd9a9274958b9f8ac5bdab2bca95e9f7b8a46701d9e5e1b634cccae49553d12
Instruction ID: 9c6b97edd7c8778d7d1cad902687c2f868453bf3a0cc6d81b7ff807a62a58126
Opcode Fuzzy Hash: ebd9a9274958b9f8ac5bdab2bca95e9f7b8a46701d9e5e1b634cccae49553d12
Instruction Fuzzy Hash: A6410572D043958FCB05CFA9D8047EDBBF1AF89310F1986AAD408EB651DB749845CBA1

Function 0646672C Relevance: 1.6, APIs: 1, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0646684A

Memory Dump Source

Source File: 00000005.00000002.4627122360.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6460000_CasPol.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: d15e300cebfca79f08955d8a91ac783ddcacf5eb019529533af931e5f87a6b9e
Instruction ID: 945bde0b5497ad3ca229086ad5ad2d4ed55a005214bbcc4a1a685b6b7518a7af
Opcode Fuzzy Hash: d15e300cebfca79f08955d8a91ac783ddcacf5eb019529533af931e5f87a6b9e
Instruction Fuzzy Hash: 4651C3B1D00349DFDB14CFAAC884ADEBFB5BF49310F25852AE819AB210D771A845CF91

Function 06466738 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0646684A

Memory Dump Source

Source File: 00000005.00000002.4627122360.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6460000_CasPol.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 99e4a6e47fae43db5e08d1258965182f5d0509ac95d81da412b9c30abac997a1
Instruction ID: a959f6d90fada4191b5953cdaf57234c3a281ea805a4409d4ebd55f76ac39ff3
Opcode Fuzzy Hash: 99e4a6e47fae43db5e08d1258965182f5d0509ac95d81da412b9c30abac997a1
Instruction Fuzzy Hash: 7141B0B1D10349DFDF14CFAAC884ADEBBB5BF48310F25852AE819AB210D775A845CF91

Function 0646A0AC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 0646B679

Memory Dump Source

Source File: 00000005.00000002.4627122360.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6460000_CasPol.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 4295df056d65ed8ddc783425304b87efbe5d076f8b168f2e1b793a950606dce5
Instruction ID: 25a94213e90b6530dd45ccf699eccb84a022c03cbdbbbe23d4be84679d6b0041
Opcode Fuzzy Hash: 4295df056d65ed8ddc783425304b87efbe5d076f8b168f2e1b793a950606dce5
Instruction Fuzzy Hash: E2414AB4900305CFDB54CF5AC848BAABBF5FF88314F24C459E519AB321D774A851CBA2

Function 0646BEFC Relevance: 1.6, APIs: 1, Instructions: 76
comclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleGetClipboard.OLE32(?), ref: 0646BF90

Memory Dump Source

Source File: 00000005.00000002.4627122360.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6460000_CasPol.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: f2cac133139553f49e93c7712fc45068701802530d14da7d25662faafdb77451
Instruction ID: 2e69da48535d74246570c79dbce9084cb2e80cdcad5f2d8b7c59efdbe1220cb1
Opcode Fuzzy Hash: f2cac133139553f49e93c7712fc45068701802530d14da7d25662faafdb77451
Instruction Fuzzy Hash: A53112B4D01248DFDB54CF9AC984BDEBBF5FB48704F24801AE404AB290DBB5A845CFA1

Function 0646BF08 Relevance: 1.6, APIs: 1, Instructions: 71
comclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleGetClipboard.OLE32(?), ref: 0646BF90

Memory Dump Source

Source File: 00000005.00000002.4627122360.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6460000_CasPol.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 4e9707c12826e1de209ea1d34406a7946280f87ea7421e3e47f2bde682572065
Instruction ID: 459e5f5dfa263fc8a2373630f946922282e50ec8756a4bb5c631989265ae78c3
Opcode Fuzzy Hash: 4e9707c12826e1de209ea1d34406a7946280f87ea7421e3e47f2bde682572065
Instruction Fuzzy Hash: D131E0B0D01249DFDB54CF9AC984B9EBBF5FB48714F24801AE404AB390DBB5A845CFA1

Function 0646BD60 Relevance: 1.6, APIs: 1, Instructions: 69
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 0646BE15

Memory Dump Source

Source File: 00000005.00000002.4627122360.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6460000_CasPol.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 3f2e0942130bc7264c2b76bdc3a4b2f400f0c73ad3e6c1ca7ca0f12415912153
Instruction ID: df7e6e4d81708f230e0406f9d31b7511e7f8f65a45c90254dafca4ccaa93ed72
Opcode Fuzzy Hash: 3f2e0942130bc7264c2b76bdc3a4b2f400f0c73ad3e6c1ca7ca0f12415912153
Instruction Fuzzy Hash: 36217A719003888FCB61DBAAC54579BBFF4EF48718F24449AE549E7241C3B9A458CBA2

Function 0646A320 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0646A3AF

Memory Dump Source

Source File: 00000005.00000002.4627122360.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6460000_CasPol.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6f6bb2f24ccc8fb9d04c0d3c6febb47097e3b24fa54eba650dc3994a59d7619d
Instruction ID: 85c1508b724c6811b110c165f6dc8d9b29ecf179ddde3fc46e0f99095caef053
Opcode Fuzzy Hash: 6f6bb2f24ccc8fb9d04c0d3c6febb47097e3b24fa54eba650dc3994a59d7619d
Instruction Fuzzy Hash: 912105B5900248DFDB10CFAAD984ADEBFF4FB48310F14801AE915A3310D374A954CFA1

Function 0646A328 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0646A3AF

Memory Dump Source

Source File: 00000005.00000002.4627122360.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6460000_CasPol.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 77b2a358971f617fad3c9372c4490def179d9d5b1fc18fd74783e0a19657d471
Instruction ID: 9e79066709955f06f65be998f90290f800d76f0cb9f4a79f0adaebd2da385044
Opcode Fuzzy Hash: 77b2a358971f617fad3c9372c4490def179d9d5b1fc18fd74783e0a19657d471
Instruction Fuzzy Hash: B121E3B5900249DFDB10CF9AD984ADEBBF4FB48320F14841AE918A3310D374A954CFA1

Function 0646DCCB Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 0646DD4B

Memory Dump Source

Source File: 00000005.00000002.4627122360.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6460000_CasPol.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 2b5eef1987fe889e382223a1cbd1cf7f6993c16be7dcecae0ea3a8c303c84756
Instruction ID: b67fcc638dfba3fac13b82d424ed36e13edcbedb1cf39635d8f3a26c870ee733
Opcode Fuzzy Hash: 2b5eef1987fe889e382223a1cbd1cf7f6993c16be7dcecae0ea3a8c303c84756
Instruction Fuzzy Hash: EB2134B1D00249DFDB54DF9AC844BDEBBF4BF88310F10841AE419A7250C774A944CFA1

Function 00DC8038 Relevance: 1.6, APIs: 1, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(00000000), ref: 00DC80B0

Memory Dump Source

Source File: 00000005.00000002.4620553542.0000000000DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_dc0000_CasPol.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 4ad79e49939eb67408b8a5593b085acd2249882d27a4b0153647417b613226d6
Instruction ID: 91db3b1910a845803b6800c11c28fbb338ca43d2585f833b39192a729cd0be3e
Opcode Fuzzy Hash: 4ad79e49939eb67408b8a5593b085acd2249882d27a4b0153647417b613226d6
Instruction Fuzzy Hash: 332147B2C0061ADFCB10CF9AC440B9EFBB4FF48720F148229D918A7240D778A944CFA1

Function 00DC7790 Relevance: 1.6, APIs: 1, Instructions: 59
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(00000000), ref: 00DC80B0

Memory Dump Source

Source File: 00000005.00000002.4620553542.0000000000DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_dc0000_CasPol.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: d7d1ca30c3f73962edfa7b41d8e5159ad4ee81b545da5419a14636d12324bae3
Instruction ID: af6e719da8b7e2fe826aed32f8865992f1c3d4eea58d494f783c52ff3e0811af
Opcode Fuzzy Hash: d7d1ca30c3f73962edfa7b41d8e5159ad4ee81b545da5419a14636d12324bae3
Instruction Fuzzy Hash: B72115B1C0065A9BDB24CF9AC544BAEFBB4BB48720F148129D918B7240D778A954CFA5

Function 0646DCD0 Relevance: 1.6, APIs: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 0646DD4B

Memory Dump Source

Source File: 00000005.00000002.4627122360.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6460000_CasPol.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 263908f99f31c915bcdfdb8fb6c6807caafd5229f654a2d5aadbd0ab86a36b9e
Instruction ID: f6616b3419cd5aba4dd6b8911a61899b7ac8e90b2b9ba500dbf7383321d52bca
Opcode Fuzzy Hash: 263908f99f31c915bcdfdb8fb6c6807caafd5229f654a2d5aadbd0ab86a36b9e
Instruction Fuzzy Hash: 242102B1D00249CFDB54DF9AC844BAEBBF5AF88320F10842AE419A7250C775A944CFA1

Function 00DCF0A0 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?), ref: 00DCF107

Memory Dump Source

Source File: 00000005.00000002.4620553542.0000000000DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_dc0000_CasPol.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 718d0f84ba8961f60249954f36c49ef7c933daf86f992e61805036f57309cee4
Instruction ID: 56cc709d0ebaef9225d150617c763914c7090f55b186e5c77008e8bb2aa68295
Opcode Fuzzy Hash: 718d0f84ba8961f60249954f36c49ef7c933daf86f992e61805036f57309cee4
Instruction Fuzzy Hash: 301103B1C0065ADBCB10CF9AC444BDEFBB4AF48720F14812AD918A7240D378A954CFA1

Function 06465688 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 064656F6

Memory Dump Source

Source File: 00000005.00000002.4627122360.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6460000_CasPol.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 81b4a2693046d71f3e885633d5f3e5b759a55fc10970f868b2c230df63a39ab0
Instruction ID: be0da4e8af7d079b82d1348c1db903df004c9912d8c65c81cf51662a42b18e2d
Opcode Fuzzy Hash: 81b4a2693046d71f3e885633d5f3e5b759a55fc10970f868b2c230df63a39ab0
Instruction Fuzzy Hash: 9311F0B5C007498FCB14CF9AD844ADEFBF5EB89224F10845AE829A7210D375A545CFA2

Function 06463A60 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 064656F6

Memory Dump Source

Source File: 00000005.00000002.4627122360.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6460000_CasPol.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 156204a11c29f4624a48ced6da6b9b4264152d0ae33440943b72795ae3e50820
Instruction ID: e094e1965746fa8c75e4f04ad1f608ae37e4a4aedeaa704a9f8cdd8b2ef55f4b
Opcode Fuzzy Hash: 156204a11c29f4624a48ced6da6b9b4264152d0ae33440943b72795ae3e50820
Instruction Fuzzy Hash: 301102B5C00749CFDB14DF9AC444B9EFBF4EB88224F10845AE829B7210D379A545CFA5

Function 0646BDB9 Relevance: 1.5, APIs: 1, Instructions: 47comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0646BE15

Memory Dump Source

Source File: 00000005.00000002.4627122360.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6460000_CasPol.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: bf98cb11ca9777c3b32cda42678e4181c16e2d7ce7fa06c3e51a29a44947cc30
Instruction ID: fc4e33fe4bd9ce9baffad3007b1dbe80501aad07ff2e747fa64aaca8e8a8a0f7
Opcode Fuzzy Hash: bf98cb11ca9777c3b32cda42678e4181c16e2d7ce7fa06c3e51a29a44947cc30
Instruction Fuzzy Hash: F91122B5800249CFCB20CFAAD844BCEFFF4EB48224F24845AE518A7200C375A944CFA5

Function 0646B8F0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,0646B8CD), ref: 0646B957

Memory Dump Source

Source File: 00000005.00000002.4627122360.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6460000_CasPol.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: dac2efd20afec77b005d5ab89be26d1044849c1370d6fe8b40d100aa65b577f6
Instruction ID: 998a0ec418583f41f4071dbded45686263994b20d81a119b58a08639efef6657
Opcode Fuzzy Hash: dac2efd20afec77b005d5ab89be26d1044849c1370d6fe8b40d100aa65b577f6
Instruction Fuzzy Hash: D61103B5800249CFDB10CF9AD944BDEFBF4EB49724F20841AE529A7350C775A944CFA5

Function 0646B314 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0646BE15

Memory Dump Source

Source File: 00000005.00000002.4627122360.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6460000_CasPol.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 52c3dc318ccdbf3447590f88844c819eecda3c1a5c6a54e8e228b0ca4231587b
Instruction ID: 01908284aabb8b61714f08a4b6588ae9c1c4593eb06812842dd91f0a239e3187
Opcode Fuzzy Hash: 52c3dc318ccdbf3447590f88844c819eecda3c1a5c6a54e8e228b0ca4231587b
Instruction Fuzzy Hash: DD1103B1800349CFDB60DF9AC544B9EBBF4EB48324F20845AE519A7300D375A954CFA5

Function 0646B0DC Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,0646B8CD), ref: 0646B957

Memory Dump Source

Source File: 00000005.00000002.4627122360.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6460000_CasPol.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 7c82d96c3c71bc0c0ac8d7dff2453c257b89176da4ee4a04730c5af422873e3e
Instruction ID: 1fc5b75d29747b8c068d34e2fc8b62f99ae6f51ee5c26a89ae76efa4536331c9
Opcode Fuzzy Hash: 7c82d96c3c71bc0c0ac8d7dff2453c257b89176da4ee4a04730c5af422873e3e
Instruction Fuzzy Hash: 631122B1800349CFDB50CF9AC444B9EBBF4EB48724F20845AE929A7210D7B4A944CFA5

Function 0647D038 Relevance: .8, Instructions: 800COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa12df8f77641dcbe14633d6f411c90cbfbd75a6b2431de91613852aa8b77260
Instruction ID: 415262769b3410577458721fdb9baa27af368d1cd17e4400f0c15b3353eb0d8b
Opcode Fuzzy Hash: fa12df8f77641dcbe14633d6f411c90cbfbd75a6b2431de91613852aa8b77260
Instruction Fuzzy Hash: EB624C30A10206CFDB59EB68D580A9EBBB2FF84310F649A69D005DB359DF75ED46CB80

Function 0647ADB0 Relevance: .4, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8546f136df2f701d5b061e4a52438c87efacbe6c7149177a2d583e3e9699325
Instruction ID: 6cc46702ea525cc75b4393754ec23e6c0542f6bd7be5f006b2c91f4355fe9cd0
Opcode Fuzzy Hash: a8546f136df2f701d5b061e4a52438c87efacbe6c7149177a2d583e3e9699325
Instruction Fuzzy Hash: D7E16E30E1020ACFDB69DF69D4946EEBBB2EF85300F24852AE405EB345DB759D46CB90

Function 0647B307 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9c2a39acc0d55cf3e18f8cc36d76e6fd17a7e2bdcd1c83e63af6fc13a992b4a
Instruction ID: b4c4828cc19afc097e62817030e49dde3581a0f97fa49183f6e2f3fef9cac95f
Opcode Fuzzy Hash: e9c2a39acc0d55cf3e18f8cc36d76e6fd17a7e2bdcd1c83e63af6fc13a992b4a
Instruction Fuzzy Hash: B8A19530F101099BEF65DEACD8907EFBBA6EB89310F608426E505D7392CE35DD819792

Function 0647B72A Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a547ccb28d0d835173608be17d0ab3a99d9d7c7d5f4d5eaa233f006b29964635
Instruction ID: e6c68447084ee123afb4f8feeabb93538b80c1b17923097afe530b30aa4d4776
Opcode Fuzzy Hash: a547ccb28d0d835173608be17d0ab3a99d9d7c7d5f4d5eaa233f006b29964635
Instruction Fuzzy Hash: B8A10870E1020A8BEFA6DE58C4807EEB7B1EB89310F648927E415EB355DB35DC85CB91

Function 06479238 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 940220ff0de5ae9ff08ce24700dd89537ae091d57c90ba99b080a81effb88fa9
Instruction ID: b337f1227b4b1bf16ae2f3786eb69f9859ca1fe64c5b2f31be5137f74e51a3f6
Opcode Fuzzy Hash: 940220ff0de5ae9ff08ce24700dd89537ae091d57c90ba99b080a81effb88fa9
Instruction Fuzzy Hash: A7912130F1021A8FDB69EB75D9507AE77F2EFC4200F10856AD80AEB345EE719D468B91

Function 064762E0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01e9584f0c594b2c043ce90aaaa8f85c839bb4a52ae9c3e6b7172a5db02fe40e
Instruction ID: 0824184c29514b80c35a09956f55d543557bc30d54b655e3166a56752f1e2152
Opcode Fuzzy Hash: 01e9584f0c594b2c043ce90aaaa8f85c839bb4a52ae9c3e6b7172a5db02fe40e
Instruction Fuzzy Hash: 0F61E271F104114FDF559A6DC844A9FBADBAFC4220F25403AD80ADB3A4DEB9ED028795

Function 064743A8 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b17d0f30a6a304d3f73e8d09dfcdc6e3aab9b9b1ba2964a14f6f3b4c633eb500
Instruction ID: 01b059c1949a6a94b4414953fe4c702dfe8965a693558b3a513e227e6c01074f
Opcode Fuzzy Hash: b17d0f30a6a304d3f73e8d09dfcdc6e3aab9b9b1ba2964a14f6f3b4c633eb500
Instruction Fuzzy Hash: E2817F34B002058FDF59DFA8D4547AEBBF2AF88310F10852AD40AEB785EB75DD428B91

Function 064743B8 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b08dc3b0f18e3f7d2e4fff9258f2524d6fcf64107ee9a7292adf321e758ac41b
Instruction ID: 9b36cc3d8dc31027321924515c10bfb77b4f775fbf7a995e552634022f4b0ba1
Opcode Fuzzy Hash: b08dc3b0f18e3f7d2e4fff9258f2524d6fcf64107ee9a7292adf321e758ac41b
Instruction Fuzzy Hash: 19815D34B002098FDF59DFA8D4547AEBBF2AF88310F10852AD40AEB385DB75DD468B91

Function 064746C8 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca094ad86026cca5125c41b48cb3b609e385321b1d60caa2fa3c14dbb503d32a
Instruction ID: ea9193ebc4111f5fd3d12e22c2218cd0c381ea9373726a5848d0729655a8c771
Opcode Fuzzy Hash: ca094ad86026cca5125c41b48cb3b609e385321b1d60caa2fa3c14dbb503d32a
Instruction Fuzzy Hash: 90914C30E10619CBDB51DF68C890BDDB7B1FF89310F20869AD549AB355DB70AA85CB90

Function 064746E0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e602951e59ec2d71b6aa3d6a96de38116dd41a4080ded9dc4fcc1a07059d4ee5
Instruction ID: f127e163d5180ea4fa051afdb27a656cfe8c143ac05d9e6dc97fa5b24ee77ecc
Opcode Fuzzy Hash: e602951e59ec2d71b6aa3d6a96de38116dd41a4080ded9dc4fcc1a07059d4ee5
Instruction Fuzzy Hash: 84913C30E10619CBDF60DF68C890BDDB7B1FF89310F20859AD549AB345DB71AA858F90

Function 0647F010 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11f1fa954847f23f745b7a4b4b856e328d0e999b0a499b0b591d498e8978fe27
Instruction ID: 9b77d46e5b169a7bf27b3aa6adfe35a942e803ed1b6045059de5c91c998ec6bb
Opcode Fuzzy Hash: 11f1fa954847f23f745b7a4b4b856e328d0e999b0a499b0b591d498e8978fe27
Instruction Fuzzy Hash: AB715B30A002488FDB94DBA9C980ADEBBF6FF88300F64852AD405EB355DB31ED46CB50

Function 0647F020 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77ed12131e8f8a49cf856fd4e08ffaf6f1fbd7453e1523cee0e08ae8425790cc
Instruction ID: bb7c5e9effba4e757c9e1838a1dc2343d423145777ea71be6e0eea9883577497
Opcode Fuzzy Hash: 77ed12131e8f8a49cf856fd4e08ffaf6f1fbd7453e1523cee0e08ae8425790cc
Instruction Fuzzy Hash: 7F715A30A002499FDB94DBA9C980ADEBBF6FF88300F14852AE405EB355DB31ED46CB50

Function 06474C78 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 943ec5c899ac2ea101e597a4e5d303cd9f212b56b4ab6aff430d29ed9b577abd
Instruction ID: 1a1b5b51e99a68fc81e639381a292fb08b4814d629b46773d3027289d73e1cb9
Opcode Fuzzy Hash: 943ec5c899ac2ea101e597a4e5d303cd9f212b56b4ab6aff430d29ed9b577abd
Instruction Fuzzy Hash: 46617E30F002199FEB559BA8C8547EEBBF6EF88310F20842AE109EB395DF755D459B90

Function 0647FCA0 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff928f34492107f02d5350836d7b46454c42adebc3c3095935b44f44961e2c97
Instruction ID: 71378875f9aff5f05f38eeb90b9a1a24eead5113a4e6275f6539fc8412c52a0c
Opcode Fuzzy Hash: ff928f34492107f02d5350836d7b46454c42adebc3c3095935b44f44961e2c97
Instruction Fuzzy Hash: 4451D031E01109DFDB94EBB8E8447EEBBB2EF84311F20886AE506D7351DB359849CB90

Function 0647FA50 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9b46be6d0201c1a7f36ab678525b54b4bc9841458210eae53a02d0f8d6ecd72
Instruction ID: 2621b8ff8f9378407061c2af7da5133eab434cc4e36a7887ff5f24ecac91fe80
Opcode Fuzzy Hash: b9b46be6d0201c1a7f36ab678525b54b4bc9841458210eae53a02d0f8d6ecd72
Instruction Fuzzy Hash: 77519530F201159BEFE5A6BCD854BAF3A5AE7C9310F20452AE50AC77D6CE79CC4543A1

Function 0647FA60 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa81c90b0fce9744707087903c7e697d427b863372977a831c7d0a475e59592b
Instruction ID: 0883bed71359bf908d1e5c94748d131c8fc93166c400bcf9453e8c19a56c775c
Opcode Fuzzy Hash: fa81c90b0fce9744707087903c7e697d427b863372977a831c7d0a475e59592b
Instruction Fuzzy Hash: 73518230F201049BEFE5A6B8D854BAF3A5AE7C9310F20452AE50AC73D6CE79DC4543A1

Function 06479228 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cab44a5a1695095c4e81d4c14f747ded66d64769b1f45159c631d09469d2551e
Instruction ID: d98d1a4f14a7fabf8d300ea2bff7785585b2cc03beea33be9458b23541ffc5ac
Opcode Fuzzy Hash: cab44a5a1695095c4e81d4c14f747ded66d64769b1f45159c631d09469d2551e
Instruction Fuzzy Hash: 85513F34B011058FEB65EB74D950BAE77F6AF98210F10886AD81AEB385DE319D428B91

Function 06474C69 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d59d735de44b76db611047656a6d91be7e346bbb61024ec4fc46d11c3b1b8c17
Instruction ID: 2bf605063bb584807cf109c0701d791d68df48b1e30e2844501dc543b33b9d52
Opcode Fuzzy Hash: d59d735de44b76db611047656a6d91be7e346bbb61024ec4fc46d11c3b1b8c17
Instruction Fuzzy Hash: 04518130F102499FEB559BA5C814BEEBBF6FF88310F20852AE105AB395DE758C059B90

Function 06475530 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f451a0617e9449a1c3e25bcc203fc92772e814c40a92600f277be500821ed6d1
Instruction ID: 4ca6c45847a38ccc7c6632f7061d00b5ffc3242555a6a89d1300321d1bdc692d
Opcode Fuzzy Hash: f451a0617e9449a1c3e25bcc203fc92772e814c40a92600f277be500821ed6d1
Instruction Fuzzy Hash: 8A414171E006099FDF75CE99D880AAFF7F6EB94310F10492AD11ADB654DB30E9458B90

Function 0647DBC0 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6c301a6be6fcd3b9aaa88bcf8e2af9915014a02fcae04affc7b887e92c665ce
Instruction ID: a47b0449e0f4d66fd08f8c63451addefdf63af76836c9118dbcd0a664a29392d
Opcode Fuzzy Hash: a6c301a6be6fcd3b9aaa88bcf8e2af9915014a02fcae04affc7b887e92c665ce
Instruction Fuzzy Hash: 3D415C30E20609DFDB559FA5D8857AEBBB2FF85300F24452AD406E7340DBB1A946CB90

Function 0647DBAD Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6aff653a4e4d2bcf65c1fe1b33ec2ac91d1fe513b8bd98e8512d0fe5f7f9afe
Instruction ID: aba984f9b1302a7bb2e57bda272c289a8189a718ead173ead1825071da3ac8a5
Opcode Fuzzy Hash: f6aff653a4e4d2bcf65c1fe1b33ec2ac91d1fe513b8bd98e8512d0fe5f7f9afe
Instruction Fuzzy Hash: 57414C70E102459FDB56DFB5D9817EEBBB2EF85300F24492AE406E7340EB71A946CB90

Function 064721C5 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d637eba8cde564996cdb7e2e113e0bbdbdb37938a4fafbec29a4e011a66169ee
Instruction ID: 4bc6be7927467db009dfd2b180313ac45d3187b468e78b9f48b6ad22512c52b1
Opcode Fuzzy Hash: d637eba8cde564996cdb7e2e113e0bbdbdb37938a4fafbec29a4e011a66169ee
Instruction Fuzzy Hash: 8931ED30B002068FDB5AAB74D9547EF7BA2FF89210F60492AC402DB391DE75DE02CB90

Function 064756A0 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d2856ddef3dd54b91a6c1add2cc78f5616d947737ee3ea41267109801521ff7
Instruction ID: c3dc2151aefb5879d57c6a06e1e5cb0b9d485679e2776d433b6b92046224b0b6
Opcode Fuzzy Hash: 7d2856ddef3dd54b91a6c1add2cc78f5616d947737ee3ea41267109801521ff7
Instruction Fuzzy Hash: 9831B070E102058FDF6A9A68C5806EFBBB1EB45320F668927E459DF341CA34DD41CB91

Function 064721D8 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6235ca5873668d362950f6b69e30d763f5aee28b4924abb667e7b5f0eedbdb5e
Instruction ID: b379d832b7c042ebf79da9a6a8549b0144ee290dde7ecf94fe45798cf638fc91
Opcode Fuzzy Hash: 6235ca5873668d362950f6b69e30d763f5aee28b4924abb667e7b5f0eedbdb5e
Instruction Fuzzy Hash: B431CB30B002059FDB5AAB78D8147AF7BA2BFC9610F24492ED406DB381DE71DE02CB90

Function 0647DA61 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b3bca9eca098938a149e3a6b119d212038d73ea307cbe91aa7554624baceb70
Instruction ID: 32fcb8e1bde28ff5bb2d7e43d3fd76c47f4c992bd8684393ea9e05a40bfe2ee9
Opcode Fuzzy Hash: 0b3bca9eca098938a149e3a6b119d212038d73ea307cbe91aa7554624baceb70
Instruction Fuzzy Hash: 22317230E2060ADBDB59DF64D4806DEBBB2FF85314F14892AE405EB344DBB0A9468B80

Function 06472089 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f39dda096899cfc40b455fe9878e4f9337e52ed4211c741703fc5902c033276
Instruction ID: 277f8be1efbe8fa61566e4190fa8a6efebdc5fedabbe62f550920be6d32c2de9
Opcode Fuzzy Hash: 5f39dda096899cfc40b455fe9878e4f9337e52ed4211c741703fc5902c033276
Instruction Fuzzy Hash: E7317E31E102459BDB59CF64D8956DFBBB6FF89300F10852AE906E7341EBB1AD42CB90

Function 06473508 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 562025dde620ddff2c25959cdb04eee04dff518873f01ffee6689f4f03cf827c
Instruction ID: 695ca7ea95a5b5782b62a6ab13739afaffc42af5e972a39d78e16c920c92de2d
Opcode Fuzzy Hash: 562025dde620ddff2c25959cdb04eee04dff518873f01ffee6689f4f03cf827c
Instruction Fuzzy Hash: 5731E4329083548FDB46EF78D8522DEBFB1EF86210F1489AAC156EB341EA35C945CB91

Function 06476560 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9f4cfd576ee5755a63d80984145040efb41e85dc388d60a5b3a5ebc04ac5de1
Instruction ID: a65115aecfd9ec514c94644bd195015c332114b60d19c43fecbd0b28e4b96215
Opcode Fuzzy Hash: a9f4cfd576ee5755a63d80984145040efb41e85dc388d60a5b3a5ebc04ac5de1
Instruction Fuzzy Hash: B7315AB1E016199FCB40CFA9D9817DEFBB5BF49310F11856AE908E7241E374AA50CBA0

Function 06472098 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18c182d7acabdc9528abe785facb41bbf337a92ac976b8fa95ee575d1493bb79
Instruction ID: 6698583c8425606263038cd90349e34ab8f45df0ea30e1eb1ee49d8b77cc7600
Opcode Fuzzy Hash: 18c182d7acabdc9528abe785facb41bbf337a92ac976b8fa95ee575d1493bb79
Instruction Fuzzy Hash: 83314D31E106459BDB59DF64D8946DFBBB2FF89300F10851AE906E7340EBB1AD42CB50

Function 06473FB0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a77b20bc4ba88011b330132cb50c90e39a77571a50b5fe19fce7638b9152fd1
Instruction ID: ca2d5aa85dc96ec5ee4f73270ec779f6e3791eb6a9712b5afa2fb88506142007
Opcode Fuzzy Hash: 3a77b20bc4ba88011b330132cb50c90e39a77571a50b5fe19fce7638b9152fd1
Instruction Fuzzy Hash: B7216876F11206DFDB12CFB8D881BEEBBF5AB58210F158026E909E7745E736D9018B90

Function 06473FC0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1a31b394d463c7022f1f35ce8dba22db5bf57c897d7dcfa652f8c04525d648e
Instruction ID: 16ab218d90ff698fed8a994d5097b95e40c7975f25f8f095c4589b2e720d82dd
Opcode Fuzzy Hash: a1a31b394d463c7022f1f35ce8dba22db5bf57c897d7dcfa652f8c04525d648e
Instruction Fuzzy Hash: F9215A75E102169FDB61DF69D880AAEBBF5BB58250F108026E909E7345E732D901CB90

Function 00CCD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4618312353.0000000000CCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ccd000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e71e232b27502a9a5dff602f2a2bff60a7b5db4c26df2930c68dce796b3a38a9
Instruction ID: b5c3e83412d077f8281046f2a09e7371c404c3036a85b6b5f848a5b1e1fbe3b8
Opcode Fuzzy Hash: e71e232b27502a9a5dff602f2a2bff60a7b5db4c26df2930c68dce796b3a38a9
Instruction Fuzzy Hash: EF21D075504244EFDB14DF18D9C0F26BBA5EB84314F24C5BDD90A4A292C77AD846CA62

Function 00CCD118 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4618312353.0000000000CCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ccd000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38933c2fe4d7d001fd435a9d488a218971be70068f09947ae775b92c26cee2dc
Instruction ID: 9f94002ee94e471a5747aa621ad09d82feeac3dd9b7373bc296fd66a01ebb600
Opcode Fuzzy Hash: 38933c2fe4d7d001fd435a9d488a218971be70068f09947ae775b92c26cee2dc
Instruction Fuzzy Hash: 282104B1604344EFDB04DF14D9C0F2ABBA5FB84328F28C57DE90A4B251C336D846CA61

Function 00CCD005 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4618312353.0000000000CCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ccd000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6434390368b853b5538915b0d6ed45383c75e79b8c09a526c8375d8df0b2aaf
Instruction ID: 57059f09b076a4d7725754841adcfff860fd07cf28f5c5f3851b9a7c8d61ee4e
Opcode Fuzzy Hash: e6434390368b853b5538915b0d6ed45383c75e79b8c09a526c8375d8df0b2aaf
Instruction Fuzzy Hash: 19214B7150D3C09FC703CB24D990B11BF71AB46214F2985EBD8898F2A7C23A980ACB62

Function 06476E00 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0243d6809120633a023591cb7f2bc6acd185a45ee9908d39ad6c1477d7e116e9
Instruction ID: a96d8ab59884e9c7591e6525688bcf577fffee34a36683c61cb1841799737c12
Opcode Fuzzy Hash: 0243d6809120633a023591cb7f2bc6acd185a45ee9908d39ad6c1477d7e116e9
Instruction Fuzzy Hash: F721AF30B101199FDF58EA69E9507EEBBB7EF84310F55842AE405E7340DB31AD418B94

Function 06474308 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e45f37a40bef28178393869b6015f5456809c9cae770551a63f7ee7a9e91d47
Instruction ID: 16e7b725d3212c31d3f65b458d326528dfaba17a9806e6dbddfe5bb468a2755a
Opcode Fuzzy Hash: 6e45f37a40bef28178393869b6015f5456809c9cae770551a63f7ee7a9e91d47
Instruction Fuzzy Hash: 3B01D435B102104FDBA6967CA8157FFBBDADBC5611F10892BE10EC7B45ED2ADC024391

Function 0647A3EA Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3f6b662483138678b8d5818ef211d69908232d82252bbbb8ffa03ccd839ef99
Instruction ID: 58f7ccbc9770d83f097d98106d8e5ab62d8dc287063c519e10e5223fbe8e234a
Opcode Fuzzy Hash: c3f6b662483138678b8d5818ef211d69908232d82252bbbb8ffa03ccd839ef99
Instruction Fuzzy Hash: 3601D2317141204FDB66A638A85579FBBD9DB96720F00842AF14ACB342DE16DC839781

Function 064740D0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc7472645e93e22ed7fc2d9c9132db8dff75053fe8ca939f2147f3302214f6dc
Instruction ID: 8436ac1ff62311fc55d8c0785688bc5ee125c08000a2f75ee4186ca4648ec581
Opcode Fuzzy Hash: dc7472645e93e22ed7fc2d9c9132db8dff75053fe8ca939f2147f3302214f6dc
Instruction Fuzzy Hash: 69118236B151258FDB55EA68C8146EF77FAEBC9220F018076D506E7340DE659C0287D0

Function 064740BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2199d4fa2dd96dadfc349bd8719f57da7880102e9e1562bb96b0fb1371464633
Instruction ID: 6ed8845693f4adc0aecb72f1fe6d5263e4d191d092cf8a842cc67d9de0afa36b
Opcode Fuzzy Hash: 2199d4fa2dd96dadfc349bd8719f57da7880102e9e1562bb96b0fb1371464633
Instruction Fuzzy Hash: A201F536F061214BEF65AA78CC143EF3BAF9BC9220F018176D406E7344DA228C0643E1

Function 0647F28F Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26d6b08d9bde2d65b7fd1f30843fb22acc3ac285c477e42482b89d66fb3f47ad
Instruction ID: 9f23242d5f60f4c4f7bdc420c76d22687304d7074eddce4e57586cbe22dcabec
Opcode Fuzzy Hash: 26d6b08d9bde2d65b7fd1f30843fb22acc3ac285c477e42482b89d66fb3f47ad
Instruction Fuzzy Hash: 6001F23AB145514FDBAA957CA4617EF7BD6DBC9220F10482BF90ACB341EE25CD064391

Function 0647315C Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a624d0e2c9ff2794748e697e4b99d5c3919109395fe673c6d3cbd17b02e46477
Instruction ID: e1cc8550b0d0b43d353c795142489643baab135f4418e325ad8d6a0064b9bfa3
Opcode Fuzzy Hash: a624d0e2c9ff2794748e697e4b99d5c3919109395fe673c6d3cbd17b02e46477
Instruction Fuzzy Hash: 0221C2B1D01259EFDB40DF9AD984ADEFFB4FB48714F10812AE918B7200D374A954CBA5

Function 06473D88 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 233f6cbb5ae3b850831d4cdab7f0a76c6074d2e55a87e0db99f9aae9f3ca6d1d
Instruction ID: c5e3c9049bd28abe44c8fa2764c8654d0bc40efb46b636ae31120cafab226262
Opcode Fuzzy Hash: 233f6cbb5ae3b850831d4cdab7f0a76c6074d2e55a87e0db99f9aae9f3ca6d1d
Instruction Fuzzy Hash: 4521F2B5C00219DFCB00CF99D984ADEFBB4FB48320F10851AE918B7600D374A954CBA4

Function 00CCD113 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4618312353.0000000000CCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ccd000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d995b00d00e55cd09380dc6b4dc9fcb0e4c86312f1f46f4d8748a8c7f78b6f4c
Instruction ID: c84d14c7c87f5006bdaf73adcf0fdee6d2a7597839ce2ad27d6ff75374e15fd9
Opcode Fuzzy Hash: d995b00d00e55cd09380dc6b4dc9fcb0e4c86312f1f46f4d8748a8c7f78b6f4c
Instruction Fuzzy Hash: 6B119DB5504284DFCB05CF10D9C4B19BFB2FB84328F28C6ADD84A4B666C33AD94ACB51

Function 06474318 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb7fbc0fd89185cd3874ae113bf28514f94c62a860fd68f311cdfb882d6d5860
Instruction ID: 11532d48a69abcd1b8866c83644f798ad494aa0d00326d21348d6931e9269f08
Opcode Fuzzy Hash: cb7fbc0fd89185cd3874ae113bf28514f94c62a860fd68f311cdfb882d6d5860
Instruction Fuzzy Hash: 9A01F431B101114BEBA9957C94157BFBBDADBC9710F10883EE10EC7744ED66EC024381

Function 0647F2A0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9666ff62d76be5d96fca16409afed602b646315f88e844ecd7e30837bc3a7d4f
Instruction ID: e08e156882fc03508b707b53e164d27fec87e853102f36c1c458236c6a4234ec
Opcode Fuzzy Hash: 9666ff62d76be5d96fca16409afed602b646315f88e844ecd7e30837bc3a7d4f
Instruction Fuzzy Hash: 4501A435B105114FDBA9957C9454BAF7BDADBC9720F10843AF50EC7340EE66DC064395

Function 0647A3F8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fcc3dd658ae0524e96081f8c881e751ce6a587bc35bfd82706be95f80b4d2c9
Instruction ID: 32c76a82108bf70f3b40cf0cfc0c4f226cba9e9b64980bce5e8121e2811e8f45
Opcode Fuzzy Hash: 5fcc3dd658ae0524e96081f8c881e751ce6a587bc35bfd82706be95f80b4d2c9
Instruction Fuzzy Hash: 6D018131B100204FDB65EA3CD45479FB7D9DB85710F10842AE50EC7345EE22EC425781

Function 06474B61 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1142391cec36721d75e2ee9c4fde8ae839714709b0e43d91c147dbdad83175f
Instruction ID: d484eacd2e95c09bf93ba349ef90dba24313738ee608049a165a9fb33a1332b9
Opcode Fuzzy Hash: f1142391cec36721d75e2ee9c4fde8ae839714709b0e43d91c147dbdad83175f
Instruction Fuzzy Hash: 2BF0DA30A24119EFDB14DF94E899BEEBBB2FF48700F20411AE402A7290CB706D01DBC0

Function 06476570 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4627166772.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6470000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60989437eb31f36a88b24c626a9401e03f262ae62647aa4789d74cd00d0c7935
Instruction ID: 346e303901a70eb7f4c84063be3c708d0f4b3819d5648b4fafe708c863c4dd21
Opcode Fuzzy Hash: 60989437eb31f36a88b24c626a9401e03f262ae62647aa4789d74cd00d0c7935
Instruction Fuzzy Hash: D3E0C270E10208ABDF60CEB4E94579F73AEE705204F2188A6D408CB302E532DA01A780

Analysis Process: newapp.exePID: 948, Parent PID: 4004COMMON

Executed Functions

Function 01860D60 Relevance: 1.4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

P, xrefs: 01860D92

Memory Dump Source

Source File: 0000000B.00000002.2333358355.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1860000_newapp.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: c0834f195f31559e66ab14b141dbb1d50a420f078b9d99c35c683f6c1c925ea4
Instruction ID: 44450bc6132b478971dc10c05ae18d07577c740a255d833ec51cb700b4da6d35
Opcode Fuzzy Hash: c0834f195f31559e66ab14b141dbb1d50a420f078b9d99c35c683f6c1c925ea4
Instruction Fuzzy Hash: C051B671B002199FDB15DB68C850A5EBBF6FF85700F15866AE012EB391DB71ED46C780

Function 01860D50 Relevance: 1.4, Strings: 1, Instructions: 138COMMON

Download Yara Rule

Strings

P, xrefs: 01860D92

Memory Dump Source

Source File: 0000000B.00000002.2333358355.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1860000_newapp.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: e194b94ce23da9425ed7c81faec10cc9b94d763deb3ab50afa12292831aec8b3
Instruction ID: c06cf25e8f2316b0d8aa72368f2a9d0d5dde514a0374c2f6a794c7fc24135692
Opcode Fuzzy Hash: e194b94ce23da9425ed7c81faec10cc9b94d763deb3ab50afa12292831aec8b3
Instruction Fuzzy Hash: 17417070B006199FDB15DB68C850A6EB7F6FF88700F148669E412EB391DB71AD46CB84

Function 01861510 Relevance: 1.1, Instructions: 1147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2333358355.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1860000_newapp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25040707d2d08d6ef22dd0c571e16a59250c1c7291b04dd6b816937abed901ee
Instruction ID: d31fa613a34342e72c9380433c4650c720ccaa0021583311eac492affe8ccd53
Opcode Fuzzy Hash: 25040707d2d08d6ef22dd0c571e16a59250c1c7291b04dd6b816937abed901ee
Instruction Fuzzy Hash: 05C158356001159FCB15DF68D59CE29BBBAFF88310F4AC498E40ADB6A2CB34EE41CB41

Function 01860FE0 Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2333358355.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1860000_newapp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7162866619ab32e7b6b1174a26cd899177196ea72d21706a3b15560288d4c227
Instruction ID: 62507b7b2696a5bc156ff9e73c144a03eb990d050a1e87b35fb739b1e67bc74b
Opcode Fuzzy Hash: 7162866619ab32e7b6b1174a26cd899177196ea72d21706a3b15560288d4c227
Instruction Fuzzy Hash: 9851F631A093859FCB069B78D85866E7FB9EFC6310F0580EAE445DB293DA349D06C792

Function 018606E4 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2333358355.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1860000_newapp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aec24b82982d2ad8c5d275c19204ab87f1d95df10f08333892fefb0085ba881e
Instruction ID: 5910a06ce3232b298d87d850ce95e35156ef8effd03d341d7b7fbf1a23b91d09
Opcode Fuzzy Hash: aec24b82982d2ad8c5d275c19204ab87f1d95df10f08333892fefb0085ba881e
Instruction Fuzzy Hash: B7319070A04349DFE70ACFB9D805A6ABFB6EBCD300F14D0AAC80897366DA795D45DB11

Function 01860B08 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2333358355.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1860000_newapp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d301bcd2a094b0c046b740a4b4f37c6ca57f6d15a1b4f47f6c3975c8dcd2b315
Instruction ID: d5c320d707c4b77e8c37a479896a3a3a74c8faa99695cbf8b723e48fa3156987
Opcode Fuzzy Hash: d301bcd2a094b0c046b740a4b4f37c6ca57f6d15a1b4f47f6c3975c8dcd2b315
Instruction Fuzzy Hash: AC417674B10208DFCB14DF74E498A6EBBB6FF8C710F208569F4069B264DB30A946CB44

Function 018609F0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2333358355.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1860000_newapp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 293dece6d541f8b06519f90b7e4107414cb9c431e21eb1ded462e03111209a3d
Instruction ID: 0f65277bfd92f26fb0402972bd83915f6be47c951c89339dcd6cb7545e6b453b
Opcode Fuzzy Hash: 293dece6d541f8b06519f90b7e4107414cb9c431e21eb1ded462e03111209a3d
Instruction Fuzzy Hash: CF2149753406118FCB49EB39C49892D7BF6AF8A72171505A8E506CF3B2DE36DC42CB91

Function 01860EF8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2333358355.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1860000_newapp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d67b673d3889556f7a4515cb9ee4fe08ef41e7df2fca5bce8cf39d14bdbc598b
Instruction ID: da1ec4def8c9ca8337ee6bdccf6e8ad964b57f5d1ecbc33a6fecc154db053dfa
Opcode Fuzzy Hash: d67b673d3889556f7a4515cb9ee4fe08ef41e7df2fca5bce8cf39d14bdbc598b
Instruction Fuzzy Hash: A221D130605206CFD7159B78D85462ABBE9FF85310F14C9AAE446CB3A5DB71DC86CB84

Function 01860848 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2333358355.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1860000_newapp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37af7ddb3960da95bb512996d2e9cc988b6c517616973331f2eca5f6a1dd002d
Instruction ID: 30ecd7fc9e27d281a65233118dbc9565e3b8782e2c7857873603e967bc66d5bc
Opcode Fuzzy Hash: 37af7ddb3960da95bb512996d2e9cc988b6c517616973331f2eca5f6a1dd002d
Instruction Fuzzy Hash: 59214D70A00209DFE709DFAAE945A6ABFB6EBCC300F14D0A9880C57365DA7969459B01

Function 01860969 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2333358355.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1860000_newapp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f4c6eda2ab8e01051bc47f366f02e4a7697853db0e97a5b0d700410ef36fedf
Instruction ID: 1ff4453cd77821e2d6b284d9596b9c81343da2a1bcccd973aa27c8782ddea456
Opcode Fuzzy Hash: 2f4c6eda2ab8e01051bc47f366f02e4a7697853db0e97a5b0d700410ef36fedf
Instruction Fuzzy Hash: 40017C76A05209EFCB54DFB8D8085BE7BBAFF49321B14C16AE51AC3251DB319A018F94

Function 01860C73 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2333358355.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1860000_newapp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e8aac36de3378ab56c7cfe918803c7ebaf1b2eb91ddbb060f848d6ff2851da
Instruction ID: a6fe94f831140eb922404de71050692c438dbd59a52198f321dda00d217e9fe9
Opcode Fuzzy Hash: f7e8aac36de3378ab56c7cfe918803c7ebaf1b2eb91ddbb060f848d6ff2851da
Instruction Fuzzy Hash: AF11E034E01208DFEB18DFA5E198A6DBBB2AF88711F208428E402D7265DE749904CF08

Function 01860978 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2333358355.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1860000_newapp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38fbaf81b701c9acf6ab0209ae5adef237cb560b6660baba15916791ce6d5345
Instruction ID: f0de09e950e148c3f4bd82a5bbbd2776c20aa9918fafe26eab5ab0080ac8d9ef
Opcode Fuzzy Hash: 38fbaf81b701c9acf6ab0209ae5adef237cb560b6660baba15916791ce6d5345
Instruction Fuzzy Hash: A7014671A01208DFCB68EFB8E40957E7BB9FB48321B14C56AE41AD3284DB349A00CF80

Analysis Process: newapp.exePID: 5720, Parent PID: 4004COMMON

Executed Functions

Function 00B10D60 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

P, xrefs: 00B10D92

Memory Dump Source

Source File: 0000000D.00000002.2415589293.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b10000_newapp.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: fb3fbf92c029e86e752d69b506fc09e89f460162b7288e0db45b47ca7d22b8ed
Instruction ID: f38d7d372262a25de0fedae37a85e767ec5d01e83b4fcae5215c7eca398d432c
Opcode Fuzzy Hash: fb3fbf92c029e86e752d69b506fc09e89f460162b7288e0db45b47ca7d22b8ed
Instruction Fuzzy Hash: 0C71A131B002059FDB15EB74C8546AEBBF5FF89300F2586AAD4159B392DB71AC86CB80

Function 00B10D50 Relevance: 1.4, Strings: 1, Instructions: 135COMMON

Download Yara Rule

Strings

P, xrefs: 00B10D92

Memory Dump Source

Source File: 0000000D.00000002.2415589293.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b10000_newapp.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: 8fa43ee1cc29ec759fd732f408ec386f730e74d7257918e837af54ef47ff16af
Instruction ID: bc366208282f0e970e153369903e3f4849137fedcf494f13ec81f86b454f15ea
Opcode Fuzzy Hash: 8fa43ee1cc29ec759fd732f408ec386f730e74d7257918e837af54ef47ff16af
Instruction Fuzzy Hash: F9418E71F102099FDB14DB65D450B9EB7F2FF88700F648669E406AB391DB71AD86CB80

Function 00B11510 Relevance: 1.1, Instructions: 1147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2415589293.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b10000_newapp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed0a1c2829783caef707cbcb00856835384e8067591c8ca47f60d150bca1e271
Instruction ID: 7fd5bcd6e3ad1941f02079930ee91960fe52905affb55ab639a62954131c58e0
Opcode Fuzzy Hash: ed0a1c2829783caef707cbcb00856835384e8067591c8ca47f60d150bca1e271
Instruction Fuzzy Hash: C6C13035A002118FDB44EF68D5A8E9D77F2BF88300F97C898D5169B262DB74ED82CB44

Function 00B10FE0 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2415589293.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b10000_newapp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ab42ff5c465471cba786a6c57af083dac2ceb4c107537300f607d7f7fd7d112
Instruction ID: 916987b12e6b446317e4984cccd38097b2c59e5d99019fc0bab81fec5ae12968
Opcode Fuzzy Hash: 5ab42ff5c465471cba786a6c57af083dac2ceb4c107537300f607d7f7fd7d112
Instruction Fuzzy Hash: AA511635A043948FC706DB78D824AAE7FB5EF85300B4684EAE544CB263CB349C46CB91

Function 00B106E4 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2415589293.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b10000_newapp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38e8e881266b454d8eba7f7107246dc2aed220fef0c0fe0e8494dafebf736cc2
Instruction ID: 6c2530f806f192306533116cf488a62e0a24ece33112e33c32886b0428a6c356
Opcode Fuzzy Hash: 38e8e881266b454d8eba7f7107246dc2aed220fef0c0fe0e8494dafebf736cc2
Instruction Fuzzy Hash: 98316F74A04344DFE70ADFBAE965B59BFB2ABCD300F14C0A9C4089726BDB781946DB01

Function 00B10B08 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2415589293.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b10000_newapp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d83552995d87380fa64f2ba94d2fc540150cd4aaba65153493e20804a87dec76
Instruction ID: 862e074efe98bd8de1a32bb285b8e06e1e3ca2984f8328218dc252721223cf09
Opcode Fuzzy Hash: d83552995d87380fa64f2ba94d2fc540150cd4aaba65153493e20804a87dec76
Instruction Fuzzy Hash: 4E415E34B10204DFDB14EFB5E898AAEBBB2FF8C700B218559E406D7365DB749886CB44

Function 00B109F0 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2415589293.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b10000_newapp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12f76e9db550788a1f768881faa26fdc1ac7002de169e9aadfe4194b1adafd48
Instruction ID: 6b685281500b1f3f5064915d207ea6088d7ca20b5922f89194ac2f5e724c912d
Opcode Fuzzy Hash: 12f76e9db550788a1f768881faa26fdc1ac7002de169e9aadfe4194b1adafd48
Instruction Fuzzy Hash: 9C2108353012118FC759AB39C4A896D7BF6EF8A71535605A8E506CF372DE36DC42CB90

Function 00B10EF0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2415589293.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b10000_newapp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c59b2d2b5bb591aaa0e32783baba87bdebd45895f422e78813a5e1eeda66152
Instruction ID: 5953b88131bf21bbc6a54519099e2c5804537621a57169af06ec9f901cbf4b02
Opcode Fuzzy Hash: 1c59b2d2b5bb591aaa0e32783baba87bdebd45895f422e78813a5e1eeda66152
Instruction Fuzzy Hash: 9D21A530600212CFDB29EB74986576ABBE5EFC8310B14C5A9E415CB366DB71DC87CB44

Function 00B10848 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2415589293.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b10000_newapp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82090769cd69b57117bc1096bbb2b893c204df62a73e7a3be1788adb7eb79ea1
Instruction ID: 2a780514641c03b1d6c60afcaf446a6d6693e01ec9c6e5163d15736403faba45
Opcode Fuzzy Hash: 82090769cd69b57117bc1096bbb2b893c204df62a73e7a3be1788adb7eb79ea1
Instruction Fuzzy Hash: 55214B74A00344DBE709EFBAE965B59BFA7ABCC300F14C069D4089336AEF781946DB00

Function 00B10EF8 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2415589293.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b10000_newapp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2446eb0c673b5386ba2d31be7ad94cc56702b913cd65987993af7f928f5918a4
Instruction ID: 187444ff5a993d588074070dd6b5e78b2aeb768036d86838d6d32cb1fa8363b3
Opcode Fuzzy Hash: 2446eb0c673b5386ba2d31be7ad94cc56702b913cd65987993af7f928f5918a4
Instruction Fuzzy Hash: C511B130600212CBDB29EB75D86576AB7E5EBC8310B24C5AAE4158B365DB71DC86CB84

Function 00B10C73 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2415589293.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b10000_newapp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13d475367948bb151ffd4cf69124af4018915990a68a10f53e3662da3c338773
Instruction ID: ea26f0e4c8ba582608a3d2bca67a2c9980d4d24724b8d24aedd77a91fb3578a3
Opcode Fuzzy Hash: 13d475367948bb151ffd4cf69124af4018915990a68a10f53e3662da3c338773
Instruction Fuzzy Hash: 57117234E01209EFDB18EBB1E598B9DBBB2AF88611F208469E41297261DE749885CF44

Function 00B1096A Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2415589293.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b10000_newapp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 676ec6f5858cb1d0742b788070a731f0abe331a33c8d16e7dcb57a67b1910df5
Instruction ID: 7daa9ba5cdb0990a8e4fa966a4a41a31723605de3e345f80ff765c52f1deadab
Opcode Fuzzy Hash: 676ec6f5858cb1d0742b788070a731f0abe331a33c8d16e7dcb57a67b1910df5
Instruction Fuzzy Hash: ED01A235D00204CFC744EFB8E8299AD7FB4FF09311B2685AAE416C32A1DB709845CF80

Function 00B10978 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2415589293.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b10000_newapp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 770bac98a49eb78791bc80ef526f7ce03606a191c9450e53ed89df7b05548ced
Instruction ID: 19370a4330cfc30f26c956900a2e9313cc86c2e97e14fb5dac96686a53a687d8
Opcode Fuzzy Hash: 770bac98a49eb78791bc80ef526f7ce03606a191c9450e53ed89df7b05548ced
Instruction Fuzzy Hash: 1F018131900214CFCB44EFB8E8289AE7BB5FB48311B22856AE416D32A1DF749D41CF84

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report QUOTATION#08670.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_QUOTATION#08670._ded9c2b02a112c627fa2bc189757858bd4a2e4_d27265d9_ca1fc45b-6ffd-4451-8c84-d2e0ed457cc6\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER28F3.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3335.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3375.tmp.xml

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\newapp.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1othnnnn.rpl.ps1

Windows Analysis Report
QUOTATION#08670.exe

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre