Edit tour

Windows Analysis Report
nSORtPkIOR.msi

Overview

General Information

Sample name:	nSORtPkIOR.msi renamed because original name is a hash value
Original sample name:	cdfcffceff42c4134d2e41f0bde414abe7a4b7e0480c8f4294ebca0b4ab9af24.msi
Analysis ID:	1573189
MD5:	5b4e1ae1818b630dae4535ec96807462
SHA1:	d1ad62a4b640fef1835a4d4dd54bfb4d6ddaaffc
SHA256:	cdfcffceff42c4134d2e41f0bde414abe7a4b7e0480c8f4294ebca0b4ab9af24
Tags:	193-188-22-40msiuser-JAMESWT_MHT
Infos:

Detection

DanaBot

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Suricata IDS alerts for network traffic

Yara detected DanaBot stealer dll

AI detected suspicious sample

May use the Tor software to hide its network traffic

PE file has a writeable .text section

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Writes a notice file (html or txt) to demand a ransom

Binary contains a suspicious time stamp

Checks for available system drives (often done to infect USB drives)

Contains long sleeps (>= 3 min)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Internet Provider seen in connection with other malware

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the installation date of Windows

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

msiexec.exe (PID: 7832 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\nSORtPkIOR.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 7896 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

PDapp.exe (PID: 8124 cmdline: "C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe" MD5: 8C91EACFF0F53860ECFC5FD67168927B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DanaBot	Proofpoints describes DanaBot as the latest example of malware focused on persistence and stealing useful information that can later be monetized rather than demanding an immediate ransom from victims. The social engineering in the low-volume DanaBot campaigns we have observed so far has been well-crafted, again pointing to a renewed focus on quality over quantity in email-based threats. DanaBots modular nature enables it to download additional components, increasing the flexibility and robust stealing and remote monitoring capabilities of this banker.	SCULLY SPIDER	https://asec.ahnlab.com/en/30445/ https://asert.arbornetworks.com/danabots-travels-a-global-perspective/ https://assets.virustotal.com/reports/2021trends.pdf https://blog.lexfo.fr/danabot-malware.html https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/	https://malpedia.caad.fkie.fraunhofer.de/details/win.danabot

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000003.1598650148.000000000634A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000003.1598650148.000000000634A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
00000004.00000003.2218101798.00000000068D3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000003.2218101798.00000000068D3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
00000004.00000003.1599548259.00000000068D0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000003.1599548259.00000000068D0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
00000004.00000003.1588397878.0000000005826000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000003.1588397878.0000000005826000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
00000004.00000003.2238596294.0000000006914000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000003.2238596294.0000000006914000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
00000004.00000003.1597628514.0000000006347000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000003.1597628514.0000000006347000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
00000004.00000003.2216719709.00000000068D0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000003.2216719709.00000000068D0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
00000004.00000003.2239231619.0000000006347000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000003.2239231619.0000000006347000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
00000004.00000003.1594751310.0000000005827000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000003.1594751310.0000000005827000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
00000004.00000003.1602077865.0000000006342000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000003.1602077865.0000000006342000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
00000004.00000003.2238031943.0000000006344000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000003.2238031943.0000000006344000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
00000004.00000003.1593103115.0000000005294000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000003.1593103115.0000000005294000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
00000004.00000003.2221320021.000000000634A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000003.2221320021.000000000634A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
00000004.00000003.1596300179.000000000582C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000003.1596300179.000000000582C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
00000004.00000003.1598188675.00000000068D4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000003.1598188675.00000000068D4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
00000004.00000003.2216023924.000000000634A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000003.2216023924.000000000634A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
00000004.00000003.1589224792.0000000005DB5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000003.1589224792.0000000005DB5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
00000004.00000003.2217552974.0000000006346000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000003.2217552974.0000000006346000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
Process Memory Space: PDapp.exe PID: 8124	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PDapp.exe PID: 8124	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
Click to see the 33 entries

Suricata Signatures

ET MALWARE Danabot Key Exchange Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-11T16:20:27.630706+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.11	49979	193.188.22.40	443	TCP
2024-12-11T16:20:28.702574+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.11	49980	193.188.22.41	443	TCP
2024-12-11T16:20:29.760002+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.11	49981	89.116.191.177	443	TCP
2024-12-11T16:20:30.852430+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.11	49982	213.210.13.4	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Yara detected DanaBot stealer dll

Source: Yara match	File source: 00000004.00000003.1598650148.000000000634A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2218101798.00000000068D3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1599548259.00000000068D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1588397878.0000000005826000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2238596294.0000000006914000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1597628514.0000000006347000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2216719709.00000000068D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2239231619.0000000006347000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1594751310.0000000005827000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1602077865.0000000006342000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2238031943.0000000006344000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1593103115.0000000005294000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2221320021.000000000634A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1596300179.000000000582C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1598188675.00000000068D4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2216023924.000000000634A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1589224792.0000000005DB5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2217552974.0000000006346000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PDapp.exe PID: 8124, type: MEMORYSTR

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\console\License,3.txt	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\console\License,1.txt	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\console\License,2.txt	Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe

File opened: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\Microsoft.VC90.CRT\MSVCR90.dll

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.11:49979 -> 193.188.22.40:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.11:49981 -> 89.116.191.177:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.11:49982 -> 213.210.13.4:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.11:49980 -> 193.188.22.41:443

Source: global traffic

TCP traffic: 192.168.2.11:49899 -> 8.8.8.8:53

Source: Joe Sandbox View	ASN Name: LRTC-ASLT LRTC-ASLT
Source: Joe Sandbox View	ASN Name: EDGEtaGCIComGB EDGEtaGCIComGB
Source: Joe Sandbox View	ASN Name: LIVECOMM-ASRespublikanskayastr3k6RU LIVECOMM-ASRespublikanskayastr3k6RU

Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.40
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.40
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.40
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.40
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.41
Source: unknown	TCP traffic detected without corresponding DNS query: 89.116.191.177
Source: unknown	TCP traffic detected without corresponding DNS query: 89.116.191.177
Source: unknown	TCP traffic detected without corresponding DNS query: 89.116.191.177
Source: unknown	TCP traffic detected without corresponding DNS query: 89.116.191.177
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.40
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.40
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.40
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.40
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.41
Source: unknown	TCP traffic detected without corresponding DNS query: 89.116.191.177
Source: unknown	TCP traffic detected without corresponding DNS query: 89.116.191.177
Source: unknown	TCP traffic detected without corresponding DNS query: 89.116.191.177
Source: unknown	TCP traffic detected without corresponding DNS query: 89.116.191.177
Source: unknown	TCP traffic detected without corresponding DNS query: 89.116.191.177
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.40
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.40
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.40
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.40
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.188.22.41
Source: unknown	TCP traffic detected without corresponding DNS query: 89.116.191.177
Source: unknown	TCP traffic detected without corresponding DNS query: 89.116.191.177
Source: unknown	TCP traffic detected without corresponding DNS query: 89.116.191.177
Source: unknown	TCP traffic detected without corresponding DNS query: 89.116.191.177

Source: PDapp.exe, 00000004.00000003.1599548259.00000000068D0000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2218101798.00000000068D3000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2216023924.000000000634A000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1598650148.000000000634A000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2238596294.0000000006914000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2216719709.00000000068D0000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2239231619.0000000006347000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2238031943.0000000006344000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1588397878.0000000005826000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1597628514.0000000006347000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2217552974.0000000006346000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1598188675.00000000068D4000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1602077865.0000000006342000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1593103115.0000000005294000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1594751310.0000000005827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: PDapp.exe, 00000004.00000003.1599548259.00000000068D0000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2218101798.00000000068D3000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2216023924.000000000634A000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1598650148.000000000634A000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2238596294.0000000006914000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2216719709.00000000068D0000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2239231619.0000000006347000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2238031943.0000000006344000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1588397878.0000000005826000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1597628514.0000000006347000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2217552974.0000000006346000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1598188675.00000000068D4000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1602077865.0000000006342000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1593103115.0000000005294000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1594751310.0000000005827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: PDapp.exe, 00000004.00000003.1599548259.00000000068D0000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2218101798.00000000068D3000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2216023924.000000000634A000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1598650148.000000000634A000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2238596294.0000000006914000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2216719709.00000000068D0000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2239231619.0000000006347000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2238031943.0000000006344000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1588397878.0000000005826000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1597628514.0000000006347000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2217552974.0000000006346000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1598188675.00000000068D4000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1602077865.0000000006342000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1593103115.0000000005294000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1594751310.0000000005827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: PDapp.exe, 00000004.00000003.1590536574.00000000030D1000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1590646508.00000000030DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ferrobackup.com/en/webhelp-c1.php
Source: PDapp.exe, 00000004.00000003.1590646508.00000000030DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mindworkshop.com
Source: PDapp.exe, 00000004.00000003.1590536574.00000000030D1000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1590646508.00000000030DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sencha.com/contact
Source: PDapp.exe, 00000004.00000003.1590536574.00000000030D1000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1590646508.00000000030DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sencha.com/contact.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443

E-Banking Fraud

Yara detected DanaBot stealer dll

Source: Yara match	File source: 00000004.00000003.1598650148.000000000634A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2218101798.00000000068D3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1599548259.00000000068D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1588397878.0000000005826000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2238596294.0000000006914000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1597628514.0000000006347000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2216719709.00000000068D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2239231619.0000000006347000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1594751310.0000000005827000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1602077865.0000000006342000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2238031943.0000000006344000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1593103115.0000000005294000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2221320021.000000000634A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1596300179.000000000582C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1598188675.00000000068D4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2216023924.000000000634A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1589224792.0000000005DB5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2217552974.0000000006346000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PDapp.exe PID: 8124, type: MEMORYSTR

Spam, unwanted Advertisements and Ransom Demands

Writes a notice file (html or txt) to demand a ransom

Source: C:\Windows\System32\msiexec.exe

File dropped: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\console\locale\en.txt -> decryption onlyencryption and decryptionon demanddailyday intervalshour intervalsweeklyno recovery tasksadministratoroperatorobserversystem shutting downscriptdisable - do not activate backup on system shutdownonly when the backup scheduled for today has not yet been mademultiedituse all settings (fields) for selected records?all connected workstations have already been configured. check currently connected workstations in network monitor tab.on startupbefore backupafter backuplanguage codeenstate codeenfilters(all workstations)report generation timechartdetailstask statistics reportymdhmsworkstation userprofilecreate "{0}" accounts for all configured workstationstry to select .fbf directory manually.change passwordnew passwordexampleaboutall rights reserved.creditswarning: this computer program is protected by copyright law and international treaties. unauthorized duplication or distribution of this program, or any portion of

Jump to dropped file

System Summary

PE file has a writeable .text section

Source: CES_PlugInHost.dll.3.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\5d9ca9.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{41545D7A-04E6-42E7-A2A9-BD96B26CB1FC}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA36F.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\5d9cab.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\5d9cab.msi	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\5d9cab.msi

Jump to behavior

Source: adbeape.dll.3.dr

Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: PDapp.exe, 00000004.00000003.1599548259.00000000068D0000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2218101798.00000000068D3000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2216023924.000000000634A000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1598650148.000000000634A000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2238596294.0000000006914000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2216719709.00000000068D0000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2239231619.0000000006347000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2238031943.0000000006344000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1588397878.0000000005826000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1597628514.0000000006347000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2217552974.0000000006346000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: .VbPx

Source: classification engine

Classification label: mal80.rans.troj.spyw.evad.winMSI@4/679@0/5

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\CMLA563.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Mutant created: \Sessions\1\BaseNamedObjects\PDApp.log
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Mutant created: \Sessions\1\BaseNamedObjects\57667331

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DF04454D2550F5911B.TMP

Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe

Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe

File read: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\sslcert.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PDapp.exe, 00000004.00000003.1599548259.00000000068D0000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2218101798.00000000068D3000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2216023924.000000000634A000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1598650148.000000000634A000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2238596294.0000000006914000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2216719709.00000000068D0000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2239231619.0000000006347000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2238031943.0000000006344000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1588397878.0000000005826000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1597628514.0000000006347000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2217552974.0000000006346000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: PDapp.exe, 00000004.00000003.1552581314.00000000011BD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE applet_registration_info ( name char(16), type char(8), version char(16), display_name varchar(128), module_path varchar(512), packageid char(36) references package_installation_info ( packageid ), constraint pk PRIMARY KEY (name, type, version) );
Source: PDapp.exe, 00000004.00000003.1552703647.0000000001193000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO 'main'.sqlite_master VALUES('index','PackageInstallationInfo_packageName_index','package_installation_info',#1,'CREATE INDEX PackageInstallationInfo_packageName_index ON package_installation_info ( name )');
Source: PDapp.exe, 00000004.00000003.1599548259.00000000068D0000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2218101798.00000000068D3000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2216023924.000000000634A000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1598650148.000000000634A000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2238596294.0000000006914000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2216719709.00000000068D0000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2239231619.0000000006347000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2238031943.0000000006344000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1588397878.0000000005826000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1597628514.0000000006347000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2217552974.0000000006346000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: PDapp.exe, 00000004.00000003.1599548259.00000000068D0000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2218101798.00000000068D3000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2216023924.000000000634A000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1598650148.000000000634A000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2238596294.0000000006914000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2216719709.00000000068D0000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2239231619.0000000006347000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2238031943.0000000006344000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1588397878.0000000005826000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1597628514.0000000006347000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2217552974.0000000006346000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: PDapp.exe, 00000004.00000003.1599548259.00000000068D0000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2218101798.00000000068D3000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2216023924.000000000634A000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1598650148.000000000634A000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2238596294.0000000006914000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2216719709.00000000068D0000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2239231619.0000000006347000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2238031943.0000000006344000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1588397878.0000000005826000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1597628514.0000000006347000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2217552974.0000000006346000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

Source: nSORtPkIOR.msi

Static file information: TRID: Microsoft Windows Installer (60509/1) 88.31%

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\nSORtPkIOR.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe "C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe "C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe"	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: adbeape.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: jcopy2.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: windowsaccessbridge-64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: ces_pluginhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: cesimageutility.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: avifil32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: pstorec.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6D90F11-9C73-11D3-B32E-00C04F990BB4}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File written: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\sslcert.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: nSORtPkIOR.msi

Static file information: File size 14633893 > 1048576

Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe

File opened: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\Microsoft.VC90.CRT\MSVCR90.dll

Jump to behavior

Source: ucrtbase.dll.3.dr

Static PE information: 0x82DE8CA7 [Sat Jul 30 07:17:59 2039 UTC]

Source: adbeape.dll.3.dr	Static PE information: real checksum: 0x11288 should be: 0x139c9
Source: CES_PlugInHost.dll.3.dr	Static PE information: real checksum: 0xc7c2d should be: 0xcfc2d
Source: WindowsAccessBridge-64.dll.3.dr	Static PE information: real checksum: 0x0 should be: 0xa3683

Source: CES_PlugInHost.dll.3.dr	Static PE information: section name: .text1
Source: CES_PlugInHost.dll.3.dr	Static PE information: section name: .data1
Source: CES_PlugInHost.dll.3.dr	Static PE information: section name: _RDATA

Source: msvcr90.dll.3.dr

Static PE information: section name: .text entropy: 6.92063892456726

Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\concrt140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\switcher\CCM_UI.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\ucrtbase.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\msvcp140_codecvt_ids.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\ssleay32.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\switcher\LWA_UI.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\AdobePIM.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\switcher\UWA_UI.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\WindowsAccessBridge-64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\msvcp140_1.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\Microsoft.VC90.CRT\msvcm90.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\msvcp140_atomic_wait.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\msvcp140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\switcher\DWA_UI.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\Microsoft.VC90.CRT\msvcr90.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\adbeapecore.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\msvcp140_2.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\adbeape.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\CES_PlugInHost.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\vccorlib140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\JCopy2.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\Microsoft.VC90.CRT\msvcp90.dll	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\console\License,3.txt	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\console\License,1.txt	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\console\License,2.txt	Jump to behavior

Hooking and other Techniques for Hiding and Protection

May use the Tor software to hide its network traffic

Binary or memory string: torConnect

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter

Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Window / User API: threadDelayed 1441			Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Window / User API: threadDelayed 741			Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\concrt140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\msvcp140_1.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\Microsoft.VC90.CRT\msvcm90.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\msvcp140_atomic_wait.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\msvcp140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\switcher\DWA_UI.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\switcher\CCM_UI.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\msvcp140_codecvt_ids.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\ssleay32.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\Microsoft.VC90.CRT\msvcr90.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\switcher\LWA_UI.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\msvcp140_2.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\adbeapecore.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\AdobePIM.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\switcher\UWA_UI.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\vccorlib140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\Microsoft.VC90.CRT\msvcp90.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe TID: 8144	Thread sleep time: -72050s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe TID: 3292	Thread sleep time: -75075s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe TID: 4476	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe TID: 5508	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe

Last function: Thread delayed

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Thread delayed: delay time: 75075			Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe "C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe"

Source: PDapp.exe, 00000004.00000003.1599548259.00000000068D0000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2218101798.00000000068D3000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2216023924.000000000634A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndTrayNotifyWndSysPagerToolbarWindow32U
Source: PDapp.exe, 00000004.00000003.1599548259.00000000068D0000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2218101798.00000000068D3000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2216023924.000000000634A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: explorer.exeShell_TrayWnd

Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	11 Windows Management Instrumentation	1 DLL Side-Loading	2 Process Injection	11 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Multi-hop Proxy	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	131 Virtualization/Sandbox Evasion	Security Account Manager	131 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	1 Proxy	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	11 Peripheral Device Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	3 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	53 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 File Deletion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Source	Detection	Scanner
C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\AdobePIM.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\CES_PlugInHost.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\FBSProxy.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\JCopy2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\Microsoft.VC90.CRT\msvcm90.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\Microsoft.VC90.CRT\msvcp90.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\Microsoft.VC90.CRT\msvcr90.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\WindowsAccessBridge-64.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\adbeape.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\adbeapecore.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\concrt140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\msvcp140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\msvcp140_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\msvcp140_2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\msvcp140_atomic_wait.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\msvcp140_codecvt_ids.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\ssleay32.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\switcher\CCM_UI.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\switcher\DWA_UI.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\switcher\LWA_UI.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\switcher\UWA_UI.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\ucrtbase.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\vccorlib140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\vcruntime140.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://www.sencha.com/contact	0%	Avira URL Cloud	safe
http://www.sencha.com/contact.	0%	Avira URL Cloud	safe
http://www.ferrobackup.com/en/webhelp-c1.php	0%	Avira URL Cloud	safe
http://www.mindworkshop.com	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://html4/loose.dtd	PDapp.exe, 00000004.00000003.1599548259.00000000068D0000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2218101798.00000000068D3000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2216023924.000000000634A000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1598650148.000000000634A000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2238596294.0000000006914000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2216719709.00000000068D0000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2239231619.0000000006347000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2238031943.0000000006344000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1588397878.0000000005826000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1597628514.0000000006347000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2217552974.0000000006346000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1598188675.00000000068D4000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1602077865.0000000006342000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1593103115.0000000005294000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1594751310.0000000005827000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.sencha.com/contact	PDapp.exe, 00000004.00000003.1590536574.00000000030D1000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1590646508.00000000030DD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://.css	PDapp.exe, 00000004.00000003.1599548259.00000000068D0000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2218101798.00000000068D3000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2216023924.000000000634A000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1598650148.000000000634A000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2238596294.0000000006914000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2216719709.00000000068D0000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2239231619.0000000006347000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2238031943.0000000006344000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1588397878.0000000005826000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1597628514.0000000006347000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2217552974.0000000006346000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1598188675.00000000068D4000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1602077865.0000000006342000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1593103115.0000000005294000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1594751310.0000000005827000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.sencha.com/contact.	PDapp.exe, 00000004.00000003.1590536574.00000000030D1000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1590646508.00000000030DD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://.jpg	PDapp.exe, 00000004.00000003.1599548259.00000000068D0000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2218101798.00000000068D3000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2216023924.000000000634A000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1598650148.000000000634A000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2238596294.0000000006914000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2216719709.00000000068D0000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2239231619.0000000006347000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2238031943.0000000006344000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1588397878.0000000005826000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1597628514.0000000006347000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.2217552974.0000000006346000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1598188675.00000000068D4000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1602077865.0000000006342000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1593103115.0000000005294000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1594751310.0000000005827000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.ferrobackup.com/en/webhelp-c1.php	PDapp.exe, 00000004.00000003.1590536574.00000000030D1000.00000004.00000020.00020000.00000000.sdmp, PDapp.exe, 00000004.00000003.1590646508.00000000030DD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mindworkshop.com	PDapp.exe, 00000004.00000003.1590646508.00000000030DD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
8.8.8.8	unknown	United States	15169	GOOGLEUS	false
89.116.191.177	unknown	Lithuania	15419	LRTC-ASLT	true
213.210.13.4	unknown	United Kingdom	8851	EDGEtaGCIComGB	true
193.188.22.40	unknown	Russian Federation	49558	LIVECOMM-ASRespublikanskayastr3k6RU	true
193.188.22.41	unknown	Russian Federation	49558	LIVECOMM-ASRespublikanskayastr3k6RU	true

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1573189
Start date and time:	2024-12-11 16:17:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	nSORtPkIOR.msi renamed because original name is a hash value
Original Sample Name:	cdfcffceff42c4134d2e41f0bde414abe7a4b7e0480c8f4294ebca0b4ab9af24.msi
Detection:	MAL
Classification:	mal80.rans.troj.spyw.evad.winMSI@4/679@0/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .msi

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
89.116.191.177	zDcNyG6Csn.exe	Get hash	malicious	DanaBot	Browse
213.210.13.4	cloudflare.msi	Get hash	malicious	DanaBot	Browse
213.210.13.4	zDcNyG6Csn.exe	Get hash	malicious	DanaBot	Browse
193.188.22.40	cloudflare.msi	Get hash	malicious	DanaBot	Browse
193.188.22.40	zDcNyG6Csn.exe	Get hash	malicious	DanaBot	Browse
193.188.22.41	cloudflare.msi	Get hash	malicious	DanaBot	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\CES_PlugInHost.dll	1.e.msi	Get hash	malicious	DanaBot	Browse
	1.e.msi	Get hash	malicious	DanaBot	Browse
	1.e.msi	Get hash	malicious	DanaBot	Browse
	yJYNZgoiNh.msi	Get hash	malicious	DanaBot, RHADAMANTHYS	Browse

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	194180
Entropy (8bit):	5.63305837794626
Encrypted:	false
SSDEEP:	1536:UmUchMpHU3/As6VcBqCGKQLV2p6hNVfmJtdUVU3MIaquzBw:xUch+0o5FjLV20NVfucV+uze
MD5:	5C53DA2C0907B859FBAAC396EC52B0AC
SHA1:	C69F641AA0BAB238BE8E67E7E95FD810CFF85514
SHA-256:	C7D6DE06D2A94279E0DFF7A3355399027F11B3EE83EB1271165763CA0D439C48
SHA-512:	CE0BF28B0AF52794573405BF89326E36C9C1076FCD2AD54F1C1632457DC471F631142FE57E067CA30D6996EE69E4C448192E1E0432A5FAB349886E42D548A1E5
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@NR.Y.@.....@.....@.....@.....@.....@......&.{41545D7A-04E6-42E7-A2A9-BD96B26CB1FC}..EasyDuplicateFinder..nSORtPkIOR.msi.@.....@.....@.....@........&.{0A54C263-3378-4839-8B1F-E728530DE644}.....@.....@.....@.....@.......@.....@.....@.......@......EasyDuplicateFinder......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{97BBD436-347B-D630-43A9-20A8F16BAC16}&.{41545D7A-04E6-42E7-A2A9-BD96B26CB1FC}.@......&.{689F4BAB-4C70-0C1F-99E8-BDE529C1FCB3}&.{41545D7A-04E6-42E7-A2A9-BD96B26CB1FC}.@......&.{9C7FF675-517D-B553-1E28-671327C3A9B4}&.{41545D7A-04E6-42E7-A2A9-BD96B26CB1FC}.@......&.{ED92AA5B-5E4A-1251-0D78-DD6702D7AA05}&.{41545D7A-04E6-42E7-A2A9-BD96B26CB1FC}.@......&.{97C325D5-B29F-38C0-9F04-8651AC4DBD1A}&.{41545D7A-04E6-42E7-A2A9-BD96B26CB1FC}.@......&.{61626D64-CDFA-060B-D3CF-7B2CB834A7C4}&.{41545D7A-04E6-42E7-A2A9-BD96B26CB1FC}.@......&.{D78A4BDB-CB61-611E-5763-B3D9272E5AD6}&.{4

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: EasyDuplicateFinder, Author: Webminds, Inc., Keywords: Installer, Comments: This installer database contains the logic and data required to install EasyDuplicateFinder., Template: Intel;1033, Revision Number: {0A54C263-3378-4839-8B1F-E728530DE644}, Create Time/Date: Wed Dec 4 16:16:08 2024, Last Saved Time/Date: Wed Dec 4 16:16:08 2024, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Entropy (8bit):	7.992738648455643
TrID:	Microsoft Windows Installer (60509/1) 88.31% Generic OLE2 / Multistream Compound File (8008/1) 11.69%
File name:	nSORtPkIOR.msi
File size:	14'633'893 bytes
MD5:	5b4e1ae1818b630dae4535ec96807462
SHA1:	d1ad62a4b640fef1835a4d4dd54bfb4d6ddaaffc
SHA256:	cdfcffceff42c4134d2e41f0bde414abe7a4b7e0480c8f4294ebca0b4ab9af24
SHA512:	22bb5ef7eb5ae3f95cd166ff5915db5d97d013a45addf46128651caf4e023dada7eb6e157bbfd8a261b882b24bf67909014b8e9581a7353c214992f0d8036b79
SSDEEP:	393216:SOpBXH8JSvAg6RGOpkr4wlkOESYp4uY1N:rpBXH8JWl6EOpkUwO7Y1N
TLSH:	E7E63365BEB30F80C21A9477570703183F399E5A3B2143412DB6F84E7E794EE829E25E
File Content Preview:	........................>......................................................................................................................................................................................................................................

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 11, 2024 16:19:41.538242102 CET	49899	53	192.168.2.11	8.8.8.8
Dec 11, 2024 16:19:41.657756090 CET	53	49899	8.8.8.8	192.168.2.11
Dec 11, 2024 16:19:41.658447027 CET	49899	53	192.168.2.11	8.8.8.8
Dec 11, 2024 16:19:44.494168997 CET	49905	443	192.168.2.11	193.188.22.40
Dec 11, 2024 16:19:44.494209051 CET	443	49905	193.188.22.40	192.168.2.11
Dec 11, 2024 16:19:44.494290113 CET	49905	443	192.168.2.11	193.188.22.40
Dec 11, 2024 16:19:44.541970968 CET	49905	443	192.168.2.11	193.188.22.40
Dec 11, 2024 16:19:44.541970968 CET	49905	443	192.168.2.11	193.188.22.40
Dec 11, 2024 16:19:44.541994095 CET	443	49905	193.188.22.40	192.168.2.11
Dec 11, 2024 16:19:44.542007923 CET	443	49905	193.188.22.40	192.168.2.11
Dec 11, 2024 16:19:44.542064905 CET	443	49905	193.188.22.40	192.168.2.11
Dec 11, 2024 16:19:44.551019907 CET	53	49899	8.8.8.8	192.168.2.11
Dec 11, 2024 16:19:44.551187992 CET	49899	53	192.168.2.11	8.8.8.8
Dec 11, 2024 16:19:45.556372881 CET	49909	443	192.168.2.11	193.188.22.41
Dec 11, 2024 16:19:45.556459904 CET	443	49909	193.188.22.41	192.168.2.11
Dec 11, 2024 16:19:45.556555986 CET	49909	443	192.168.2.11	193.188.22.41
Dec 11, 2024 16:19:45.604527950 CET	49909	443	192.168.2.11	193.188.22.41
Dec 11, 2024 16:19:45.604551077 CET	443	49909	193.188.22.41	192.168.2.11
Dec 11, 2024 16:19:45.604567051 CET	49909	443	192.168.2.11	193.188.22.41
Dec 11, 2024 16:19:45.604574919 CET	443	49909	193.188.22.41	192.168.2.11
Dec 11, 2024 16:19:45.604624987 CET	443	49909	193.188.22.41	192.168.2.11
Dec 11, 2024 16:19:46.643219948 CET	49912	443	192.168.2.11	89.116.191.177
Dec 11, 2024 16:19:46.643359900 CET	443	49912	89.116.191.177	192.168.2.11
Dec 11, 2024 16:19:46.643440962 CET	49912	443	192.168.2.11	89.116.191.177
Dec 11, 2024 16:19:46.724881887 CET	49912	443	192.168.2.11	89.116.191.177
Dec 11, 2024 16:19:46.724905968 CET	443	49912	89.116.191.177	192.168.2.11
Dec 11, 2024 16:19:46.724929094 CET	49912	443	192.168.2.11	89.116.191.177
Dec 11, 2024 16:19:46.724936962 CET	443	49912	89.116.191.177	192.168.2.11
Dec 11, 2024 16:19:46.724953890 CET	443	49912	89.116.191.177	192.168.2.11
Dec 11, 2024 16:19:47.745707989 CET	49916	443	192.168.2.11	213.210.13.4
Dec 11, 2024 16:19:47.745753050 CET	443	49916	213.210.13.4	192.168.2.11
Dec 11, 2024 16:19:47.745804071 CET	49916	443	192.168.2.11	213.210.13.4
Dec 11, 2024 16:19:47.818031073 CET	49916	443	192.168.2.11	213.210.13.4
Dec 11, 2024 16:19:47.818058968 CET	443	49916	213.210.13.4	192.168.2.11
Dec 11, 2024 16:19:47.818114042 CET	443	49916	213.210.13.4	192.168.2.11
Dec 11, 2024 16:19:47.818126917 CET	49916	443	192.168.2.11	213.210.13.4
Dec 11, 2024 16:19:47.818145037 CET	443	49916	213.210.13.4	192.168.2.11
Dec 11, 2024 16:20:27.587827921 CET	49979	443	192.168.2.11	193.188.22.40
Dec 11, 2024 16:20:27.587877989 CET	443	49979	193.188.22.40	192.168.2.11
Dec 11, 2024 16:20:27.587956905 CET	49979	443	192.168.2.11	193.188.22.40
Dec 11, 2024 16:20:27.630706072 CET	49979	443	192.168.2.11	193.188.22.40
Dec 11, 2024 16:20:27.630729914 CET	443	49979	193.188.22.40	192.168.2.11
Dec 11, 2024 16:20:27.630815029 CET	49979	443	192.168.2.11	193.188.22.40
Dec 11, 2024 16:20:27.630819082 CET	443	49979	193.188.22.40	192.168.2.11
Dec 11, 2024 16:20:27.630829096 CET	443	49979	193.188.22.40	192.168.2.11
Dec 11, 2024 16:20:28.651722908 CET	49980	443	192.168.2.11	193.188.22.41
Dec 11, 2024 16:20:28.651803017 CET	443	49980	193.188.22.41	192.168.2.11
Dec 11, 2024 16:20:28.651913881 CET	49980	443	192.168.2.11	193.188.22.41
Dec 11, 2024 16:20:28.702574015 CET	49980	443	192.168.2.11	193.188.22.41
Dec 11, 2024 16:20:28.702606916 CET	443	49980	193.188.22.41	192.168.2.11
Dec 11, 2024 16:20:28.702667952 CET	49980	443	192.168.2.11	193.188.22.41
Dec 11, 2024 16:20:28.702673912 CET	443	49980	193.188.22.41	192.168.2.11
Dec 11, 2024 16:20:28.702686071 CET	443	49980	193.188.22.41	192.168.2.11
Dec 11, 2024 16:20:29.709976912 CET	49981	443	192.168.2.11	89.116.191.177
Dec 11, 2024 16:20:29.710014105 CET	443	49981	89.116.191.177	192.168.2.11
Dec 11, 2024 16:20:29.714041948 CET	49981	443	192.168.2.11	89.116.191.177
Dec 11, 2024 16:20:29.760001898 CET	49981	443	192.168.2.11	89.116.191.177
Dec 11, 2024 16:20:29.760023117 CET	443	49981	89.116.191.177	192.168.2.11
Dec 11, 2024 16:20:29.760080099 CET	49981	443	192.168.2.11	89.116.191.177
Dec 11, 2024 16:20:29.760086060 CET	443	49981	89.116.191.177	192.168.2.11
Dec 11, 2024 16:20:29.760133982 CET	443	49981	89.116.191.177	192.168.2.11
Dec 11, 2024 16:20:29.761415958 CET	49981	443	192.168.2.11	89.116.191.177
Dec 11, 2024 16:20:29.761431932 CET	443	49981	89.116.191.177	192.168.2.11
Dec 11, 2024 16:20:30.802916050 CET	49982	443	192.168.2.11	213.210.13.4
Dec 11, 2024 16:20:30.802963972 CET	443	49982	213.210.13.4	192.168.2.11
Dec 11, 2024 16:20:30.803026915 CET	49982	443	192.168.2.11	213.210.13.4
Dec 11, 2024 16:20:30.852430105 CET	49982	443	192.168.2.11	213.210.13.4
Dec 11, 2024 16:20:30.852463961 CET	443	49982	213.210.13.4	192.168.2.11
Dec 11, 2024 16:20:30.852514029 CET	443	49982	213.210.13.4	192.168.2.11
Dec 11, 2024 16:20:30.852518082 CET	49982	443	192.168.2.11	213.210.13.4
Dec 11, 2024 16:20:30.852538109 CET	443	49982	213.210.13.4	192.168.2.11
Dec 11, 2024 16:20:30.853718996 CET	49983	443	192.168.2.11	193.188.22.40
Dec 11, 2024 16:20:30.853765965 CET	443	49983	193.188.22.40	192.168.2.11
Dec 11, 2024 16:20:30.853826046 CET	49983	443	192.168.2.11	193.188.22.40
Dec 11, 2024 16:20:30.907248974 CET	49983	443	192.168.2.11	193.188.22.40
Dec 11, 2024 16:20:30.907354116 CET	443	49983	193.188.22.40	192.168.2.11
Dec 11, 2024 16:20:30.907407999 CET	443	49983	193.188.22.40	192.168.2.11
Dec 11, 2024 16:20:30.907553911 CET	49983	443	192.168.2.11	193.188.22.40
Dec 11, 2024 16:20:30.907597065 CET	443	49983	193.188.22.40	192.168.2.11
Dec 11, 2024 16:20:30.908452034 CET	49984	443	192.168.2.11	193.188.22.41
Dec 11, 2024 16:20:30.908492088 CET	443	49984	193.188.22.41	192.168.2.11
Dec 11, 2024 16:20:30.908582926 CET	49984	443	192.168.2.11	193.188.22.41
Dec 11, 2024 16:20:30.949388981 CET	49984	443	192.168.2.11	193.188.22.41
Dec 11, 2024 16:20:30.949419022 CET	443	49984	193.188.22.41	192.168.2.11
Dec 11, 2024 16:20:30.949476957 CET	443	49984	193.188.22.41	192.168.2.11
Dec 11, 2024 16:20:30.949592113 CET	49984	443	192.168.2.11	193.188.22.41
Dec 11, 2024 16:20:30.949609995 CET	443	49984	193.188.22.41	192.168.2.11
Dec 11, 2024 16:20:30.950700045 CET	49985	443	192.168.2.11	89.116.191.177
Dec 11, 2024 16:20:30.950732946 CET	443	49985	89.116.191.177	192.168.2.11
Dec 11, 2024 16:20:30.950809002 CET	49985	443	192.168.2.11	89.116.191.177
Dec 11, 2024 16:20:30.992158890 CET	49985	443	192.168.2.11	89.116.191.177
Dec 11, 2024 16:20:30.992183924 CET	443	49985	89.116.191.177	192.168.2.11
Dec 11, 2024 16:20:30.992259979 CET	443	49985	89.116.191.177	192.168.2.11
Dec 11, 2024 16:20:30.992278099 CET	49985	443	192.168.2.11	89.116.191.177
Dec 11, 2024 16:20:30.992297888 CET	443	49985	89.116.191.177	192.168.2.11
Dec 11, 2024 16:20:30.993655920 CET	49986	443	192.168.2.11	213.210.13.4
Dec 11, 2024 16:20:30.993705988 CET	443	49986	213.210.13.4	192.168.2.11
Dec 11, 2024 16:20:30.993818045 CET	49986	443	192.168.2.11	213.210.13.4
Dec 11, 2024 16:20:31.040529966 CET	49986	443	192.168.2.11	213.210.13.4
Dec 11, 2024 16:20:31.040555954 CET	443	49986	213.210.13.4	192.168.2.11
Dec 11, 2024 16:20:31.040581942 CET	49986	443	192.168.2.11	213.210.13.4
Dec 11, 2024 16:20:31.040597916 CET	443	49986	213.210.13.4	192.168.2.11
Dec 11, 2024 16:20:31.040617943 CET	443	49986	213.210.13.4	192.168.2.11

Target ID:	2
Start time:	10:18:23
Start date:	11/12/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\nSORtPkIOR.msi"
Imagebase:	0x7ff7e38d0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	10:18:24
Start date:	11/12/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff7e38d0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	4
Start time:	10:18:33
Start date:	11/12/2024
Path:	C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe"
Imagebase:	0xcc0000
File size:	2'511'040 bytes
MD5 hash:	8C91EACFF0F53860ECFC5FD67168927B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000003.1598650148.000000000634A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DanaBot_stealer_dll, Description: Yara detected DanaBot stealer dll, Source: 00000004.00000003.1598650148.000000000634A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000003.2218101798.00000000068D3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DanaBot_stealer_dll, Description: Yara detected DanaBot stealer dll, Source: 00000004.00000003.2218101798.00000000068D3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000003.1599548259.00000000068D0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DanaBot_stealer_dll, Description: Yara detected DanaBot stealer dll, Source: 00000004.00000003.1599548259.00000000068D0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000003.1588397878.0000000005826000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DanaBot_stealer_dll, Description: Yara detected DanaBot stealer dll, Source: 00000004.00000003.1588397878.0000000005826000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000003.2238596294.0000000006914000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DanaBot_stealer_dll, Description: Yara detected DanaBot stealer dll, Source: 00000004.00000003.2238596294.0000000006914000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000003.1597628514.0000000006347000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DanaBot_stealer_dll, Description: Yara detected DanaBot stealer dll, Source: 00000004.00000003.1597628514.0000000006347000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000003.2216719709.00000000068D0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DanaBot_stealer_dll, Description: Yara detected DanaBot stealer dll, Source: 00000004.00000003.2216719709.00000000068D0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000003.2239231619.0000000006347000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DanaBot_stealer_dll, Description: Yara detected DanaBot stealer dll, Source: 00000004.00000003.2239231619.0000000006347000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000003.1594751310.0000000005827000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DanaBot_stealer_dll, Description: Yara detected DanaBot stealer dll, Source: 00000004.00000003.1594751310.0000000005827000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000003.1602077865.0000000006342000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DanaBot_stealer_dll, Description: Yara detected DanaBot stealer dll, Source: 00000004.00000003.1602077865.0000000006342000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000003.2238031943.0000000006344000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DanaBot_stealer_dll, Description: Yara detected DanaBot stealer dll, Source: 00000004.00000003.2238031943.0000000006344000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000003.1593103115.0000000005294000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DanaBot_stealer_dll, Description: Yara detected DanaBot stealer dll, Source: 00000004.00000003.1593103115.0000000005294000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000003.2221320021.000000000634A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DanaBot_stealer_dll, Description: Yara detected DanaBot stealer dll, Source: 00000004.00000003.2221320021.000000000634A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000003.1596300179.000000000582C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DanaBot_stealer_dll, Description: Yara detected DanaBot stealer dll, Source: 00000004.00000003.1596300179.000000000582C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000003.1598188675.00000000068D4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DanaBot_stealer_dll, Description: Yara detected DanaBot stealer dll, Source: 00000004.00000003.1598188675.00000000068D4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000003.2216023924.000000000634A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DanaBot_stealer_dll, Description: Yara detected DanaBot stealer dll, Source: 00000004.00000003.2216023924.000000000634A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000003.1589224792.0000000005DB5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DanaBot_stealer_dll, Description: Yara detected DanaBot stealer dll, Source: 00000004.00000003.1589224792.0000000005DB5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000003.2217552974.0000000006346000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DanaBot_stealer_dll, Description: Yara detected DanaBot stealer dll, Source: 00000004.00000003.2217552974.0000000006346000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	false

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report nSORtPkIOR.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\5d9caa.rbs

C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\AdobePIM.dll

C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\Audits\File.wav

C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\CES_PlugInHost.dll

C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\DebugLogs\Customer.db

C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\FBSProxy.dll

C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\FBSWorker.ini

C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\JCopy2.dll

C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\Microsoft.VC90.CRT\Microsoft.VC90.CRT.manifest

C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\Microsoft.VC90.CRT\msvcm90.dll

C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\Microsoft.VC90.CRT\msvcp90.dll

C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\Microsoft.VC90.CRT\msvcr90.dll

C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe

C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\Thumbnail.sav

C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\WindowsAccessBridge-64.dll

C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\ZStringResources\cs_CZ\stringtable.xml

C:\Users\user\AppData\Local\Programs\EasyDuplicateFinder\ZStringResources\da_DK\stringtable.xml

Windows Analysis Report
nSORtPkIOR.msi

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre