Windows Analysis Report
ij4YvAl59D.exe

Overview

General Information

Sample name: ij4YvAl59D.exe
renamed because original name is a hash value
Original sample name: 63348a3de870f9d1a0e8dc66584529b7.exe
Analysis ID: 1576616
MD5: 63348a3de870f9d1a0e8dc66584529b7
SHA1: 1610b479e8415bec8a184cc00cecdef2865354f2
SHA256: 81200273f9dd78935d8bc3b61ab7bd15c4e24be31c4a10fb55504595370e977b
Tags: exeuser-abuse_ch
Infos:

Detection

RisePro Stealer
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Sigma detected: Search for Antivirus process
Suricata IDS alerts for network traffic
Yara detected RisePro Stealer
AI detected suspicious sample
Adds extensions / path to Windows Defender exclusion list (Registry)
Contains functionality to inject threads in other processes
Disable Windows Defender real time protection (registry)
Disables Windows Defender (deletes autostart)
Drops PE files with a suspicious file extension
Exclude list of file types from scheduled, custom, and real-time scanning
Found stalling execution ending in API Sleep call
Injects a PE file into a foreign processes
Modifies Group Policy settings
Sigma detected: Suspicious Command Patterns In Scheduled Task Creation
Sigma detected: WScript or CScript Dropper
Uses schtasks.exe or at.exe to add and modify task schedules
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes many files with high entropy
Wscript called in batch mode (surpress errors)
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found WSH timer for Javascript or VBS script (likely evasive script)
Found evasive API chain (date check)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Execution of Suspicious File Type Extension
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious Copy From or To System Directory
Sigma detected: Suspicious Schtasks From Env Var Folder
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Sigma detected: Windows Defender Exclusions Added - Registry
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: ij4YvAl59D.exe Virustotal: Detection: 59% Perma Link
Source: ij4YvAl59D.exe ReversingLabs: Detection: 50%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 98.9% probability
Uses 32bit PE files
Source: ij4YvAl59D.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: ij4YvAl59D.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Change of critical system settings
barindex
Adds extensions / path to Windows Defender exclusion list (Registry)
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{581A8394-A0F5-4CA9-9527-C29248E9064A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions Exclusions_Extensions Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{581A8394-A0F5-4CA9-9527-C29248E9064A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions exe Jump to behavior
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Code function: 0_2_004062D5 FindFirstFileW,FindClose, 0_2_004062D5
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Code function: 0_2_00402E18 FindFirstFileW, 0_2_00402E18
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 0_2_00406C9B
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_006847B7 GetFileAttributesW,FindFirstFileW,FindClose, 16_2_006847B7
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_00683E72 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 16_2_00683E72
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_0068C16C FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose, 16_2_0068C16C
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_0068CB81 FindFirstFileW,FindClose, 16_2_0068CB81
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_0068CC0C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, 16_2_0068CC0C
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_0068F445 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 16_2_0068F445
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_0068F5A2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 16_2_0068F5A2
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_0068F8A3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose, 16_2_0068F8A3
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_00683B4F FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 16_2_00683B4F
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008FC16C FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose, 37_2_008FC16C
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008F47B7 GetFileAttributesW,FindFirstFileW,FindClose, 37_2_008F47B7
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008FCB81 FindFirstFileW,FindClose, 37_2_008FCB81
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008FCC0C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, 37_2_008FCC0C
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008FF445 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 37_2_008FF445
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008FF5A2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 37_2_008FF5A2
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008FF8A3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose, 37_2_008FF8A3
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008F3B4F FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 37_2_008F3B4F
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008F3E72 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 37_2_008F3E72
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_01432022 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx, 37_2_01432022
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_01431F9C FindClose,FindFirstFileExW,GetLastError, 37_2_01431F9C

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2049060 - Severity 1 - ET MALWARE RisePro TCP Heartbeat Packet : 192.168.2.4:50027 -> 3.36.173.8:50500
Source: Network traffic Suricata IDS: 2046269 - Severity 1 - ET MALWARE [ANY.RUN] RisePro TCP (Activity) : 192.168.2.4:50027 -> 3.36.173.8:50500
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.4:50027 -> 3.36.173.8:50500
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AMAZONEXPANSIONGB AMAZONEXPANSIONGB
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Source: unknown DNS traffic detected: query: jZFqZYoOtpryMyRHD.jZFqZYoOtpryMyRHD replaycode: Name error (3)
Source: unknown TCP traffic detected without corresponding DNS query: 3.36.173.8
Source: unknown TCP traffic detected without corresponding DNS query: 3.36.173.8
Source: unknown TCP traffic detected without corresponding DNS query: 3.36.173.8
Source: unknown TCP traffic detected without corresponding DNS query: 3.36.173.8
Source: unknown TCP traffic detected without corresponding DNS query: 3.36.173.8
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_0069279E InternetReadFile,InternetQueryDataAvailable,InternetReadFile, 16_2_0069279E
Source: global traffic DNS traffic detected: DNS query: jZFqZYoOtpryMyRHD.jZFqZYoOtpryMyRHD
Source: ij4YvAl59D.exe, 00000000.00000003.1754054360.00000000027BB000.00000004.00000020.00020000.00000000.sdmp, Origin.pif, 0000000A.00000003.1827991644.000000000497E000.00000004.00000800.00020000.00000000.sdmp, Origin.pif, 00000025.00000002.4204020665.0000000003326000.00000004.00000020.00020000.00000000.sdmp, SecureHawk.pif.10.dr, Origin.pif.1.dr, Beginning.0.dr String found in binary or memory: http://crl.globalsign.com/gs/gscodesigng2.crl0
Source: ij4YvAl59D.exe, 00000000.00000003.1754054360.00000000027BB000.00000004.00000020.00020000.00000000.sdmp, Origin.pif, 0000000A.00000003.1827991644.000000000497E000.00000004.00000800.00020000.00000000.sdmp, Origin.pif, 00000025.00000002.4204020665.0000000003326000.00000004.00000020.00020000.00000000.sdmp, SecureHawk.pif.10.dr, Origin.pif.1.dr, Beginning.0.dr String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingg2.crl0T
Source: ij4YvAl59D.exe, 00000000.00000003.1754054360.00000000027BB000.00000004.00000020.00020000.00000000.sdmp, Origin.pif, 0000000A.00000003.1827991644.000000000497E000.00000004.00000800.00020000.00000000.sdmp, Origin.pif, 00000025.00000002.4204020665.0000000003326000.00000004.00000020.00020000.00000000.sdmp, SecureHawk.pif.10.dr, Origin.pif.1.dr, Beginning.0.dr String found in binary or memory: http://crl.globalsign.net/root.crl0
Source: ij4YvAl59D.exe String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: ij4YvAl59D.exe, 00000000.00000003.1754054360.00000000027BB000.00000004.00000020.00020000.00000000.sdmp, Origin.pif, 0000000A.00000003.1827991644.000000000497E000.00000004.00000800.00020000.00000000.sdmp, Origin.pif, 00000025.00000002.4203516927.000000000180D000.00000004.00000020.00020000.00000000.sdmp, Origin.pif, 00000025.00000002.4204020665.0000000003326000.00000004.00000020.00020000.00000000.sdmp, SecureHawk.pif.10.dr, Origin.pif.1.dr, Beginning.0.dr String found in binary or memory: http://ocsp2.globalsign.com/gscodesigng20
Source: ij4YvAl59D.exe, 00000000.00000003.1754054360.00000000027BB000.00000004.00000020.00020000.00000000.sdmp, Origin.pif, 0000000A.00000003.1827991644.000000000497E000.00000004.00000800.00020000.00000000.sdmp, Origin.pif, 00000025.00000002.4204020665.0000000003326000.00000004.00000020.00020000.00000000.sdmp, SecureHawk.pif.10.dr, Origin.pif.1.dr, Beginning.0.dr String found in binary or memory: http://secure.globalsign.com/cacert/gscodesigng2.crt04
Source: Origin.pif, 00000025.00000002.4203516927.000000000180D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://secure.globalsign.com/cacert/gscodesigng2.crt04r
Source: ij4YvAl59D.exe, 00000000.00000003.1754054360.00000000027BB000.00000004.00000020.00020000.00000000.sdmp, Origin.pif, 0000000A.00000003.1827991644.000000000497E000.00000004.00000800.00020000.00000000.sdmp, Origin.pif, 00000025.00000002.4204020665.0000000003326000.00000004.00000020.00020000.00000000.sdmp, SecureHawk.pif.10.dr, Origin.pif.1.dr, Beginning.0.dr String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingg2.crt0
Source: ij4YvAl59D.exe, 00000000.00000003.1754054360.00000000027BB000.00000004.00000020.00020000.00000000.sdmp, Origin.pif, 0000000A.00000003.1827991644.000000000497E000.00000004.00000800.00020000.00000000.sdmp, Origin.pif, 00000025.00000002.4204020665.0000000003326000.00000004.00000020.00020000.00000000.sdmp, SecureHawk.pif.10.dr, Origin.pif.1.dr, Beginning.0.dr String found in binary or memory: http://www.autoitscript.com/autoit3/0
Source: ij4YvAl59D.exe, 00000000.00000003.1783937876.00000000027C2000.00000004.00000020.00020000.00000000.sdmp, Origin.pif, 0000000A.00000003.1827991644.000000000497E000.00000004.00000800.00020000.00000000.sdmp, Origin.pif, 0000000A.00000000.1817611127.0000000000958000.00000002.00000001.01000000.00000005.sdmp, SecureHawk.pif, 00000010.00000000.1850685413.00000000006E8000.00000002.00000001.01000000.00000008.sdmp, Origin.pif, 00000025.00000002.4202785920.0000000000958000.00000002.00000001.01000000.00000005.sdmp, Origin.pif, 00000025.00000002.4204020665.0000000003326000.00000004.00000020.00020000.00000000.sdmp, Studios.0.dr, SecureHawk.pif.10.dr, Origin.pif.1.dr String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: Origin.pif, Origin.pif, 00000025.00000002.4203013330.0000000001400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://www.winimage.com/zLibDll
Source: Origin.pif String found in binary or memory: https://ipinfo.io/
Source: Origin.pif, 00000025.00000002.4203013330.0000000001400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: Origin.pif, 00000025.00000002.4203516927.00000000017C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/RiseProSUPPORT
Source: ij4YvAl59D.exe, 00000000.00000003.1754054360.00000000027BB000.00000004.00000020.00020000.00000000.sdmp, Origin.pif, 0000000A.00000003.1827991644.000000000497E000.00000004.00000800.00020000.00000000.sdmp, Origin.pif, 00000025.00000002.4203516927.000000000180D000.00000004.00000020.00020000.00000000.sdmp, Origin.pif, 00000025.00000002.4204020665.0000000003326000.00000004.00000020.00020000.00000000.sdmp, SecureHawk.pif.10.dr, Origin.pif.1.dr, Beginning.0.dr String found in binary or memory: https://www.globalsign.com/repository/0
Source: ij4YvAl59D.exe, 00000000.00000003.1754054360.00000000027BB000.00000004.00000020.00020000.00000000.sdmp, Origin.pif, 0000000A.00000003.1827991644.000000000497E000.00000004.00000800.00020000.00000000.sdmp, Origin.pif, 00000025.00000002.4204020665.0000000003326000.00000004.00000020.00020000.00000000.sdmp, SecureHawk.pif.10.dr, Origin.pif.1.dr, Beginning.0.dr String found in binary or memory: https://www.globalsign.com/repository/03
Source: Origin.pif String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Code function: 0_2_004050CD GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 0_2_004050CD
Contains functionality to modify clipboard data
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_00694614 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard, 16_2_00694614
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_00904614 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard, 37_2_00904614
Contains functionality to read the clipboard data
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_00694416 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard, 16_2_00694416
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Code function: 0_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 0_2_004044A5
Potential key logger detected (key state polling based)
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_006ACEDF DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW, 16_2_006ACEDF
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_0091CEDF DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW, 37_2_0091CEDF

Spam, unwanted Advertisements and Ransom Demands
barindex
Writes many files with high entropy
Source: C:\Users\user\Desktop\ij4YvAl59D.exe File created: C:\Users\user\AppData\Local\Temp\Massachusetts entropy: 7.99846554018 Jump to dropped file
Source: C:\Users\user\Desktop\ij4YvAl59D.exe File created: C:\Users\user\AppData\Local\Temp\Radius entropy: 7.99902505433 Jump to dropped file
Source: C:\Users\user\Desktop\ij4YvAl59D.exe File created: C:\Users\user\AppData\Local\Temp\Stockings entropy: 7.99820786051 Jump to dropped file
Source: C:\Users\user\Desktop\ij4YvAl59D.exe File created: C:\Users\user\AppData\Local\Temp\Bdsm entropy: 7.99861815368 Jump to dropped file
Source: C:\Users\user\Desktop\ij4YvAl59D.exe File created: C:\Users\user\AppData\Local\Temp\Vendor entropy: 7.99556101212 Jump to dropped file
Source: C:\Users\user\Desktop\ij4YvAl59D.exe File created: C:\Users\user\AppData\Local\Temp\Convenience entropy: 7.99573659303 Jump to dropped file
Source: C:\Users\user\Desktop\ij4YvAl59D.exe File created: C:\Users\user\AppData\Local\Temp\Joke entropy: 7.99883402213 Jump to dropped file
Source: C:\Users\user\Desktop\ij4YvAl59D.exe File created: C:\Users\user\AppData\Local\Temp\Severe entropy: 7.99824795157 Jump to dropped file
Source: C:\Users\user\Desktop\ij4YvAl59D.exe File created: C:\Users\user\AppData\Local\Temp\Falls entropy: 7.99917331785 Jump to dropped file
Source: C:\Users\user\Desktop\ij4YvAl59D.exe File created: C:\Users\user\AppData\Local\Temp\Sig entropy: 7.9984885368 Jump to dropped file
Source: C:\Users\user\Desktop\ij4YvAl59D.exe File created: C:\Users\user\AppData\Local\Temp\Outreach entropy: 7.99921983985 Jump to dropped file
Source: C:\Users\user\Desktop\ij4YvAl59D.exe File created: C:\Users\user\AppData\Local\Temp\Dental entropy: 7.99901607447 Jump to dropped file
Source: C:\Users\user\Desktop\ij4YvAl59D.exe File created: C:\Users\user\AppData\Local\Temp\Mask entropy: 7.99382891469 Jump to dropped file
Source: C:\Users\user\Desktop\ij4YvAl59D.exe File created: C:\Users\user\AppData\Local\Temp\Fighting entropy: 7.99892313786 Jump to dropped file
Source: C:\Users\user\Desktop\ij4YvAl59D.exe File created: C:\Users\user\AppData\Local\Temp\June entropy: 7.99829631291 Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Users\user\AppData\Local\Temp\369580\Z entropy: 7.99991695551 Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif File created: C:\Users\user\AppData\Local\LinkGuard Dynamics\r entropy: 7.99991695551 Jump to dropped file

System Summary
barindex
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Source: C:\Windows\System32\wscript.exe COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8} Jump to behavior
Wscript called in batch mode (surpress errors)
Source: unknown Process created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js"
Contains functionality to communicate with device drivers
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_006840C1: CreateFileW,DeviceIoControl,CloseHandle, 16_2_006840C1
Contains functionality to launch a process as a different user
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_00678D11 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock, 16_2_00678D11
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Code function: 0_2_00403883 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,InitOnceBeginInitialize,ExitWindowsEx, 0_2_00403883
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_006855E5 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState, 16_2_006855E5
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008F55E5 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState, 37_2_008F55E5
Creates files inside the system directory
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif File created: C:\Windows\SysWOW64\GroupPolicy\gpt.ini Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif File created: C:\Windows\System32\GroupPolicy\Machine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif File created: C:\Windows\System32\GroupPolicy\User Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif File created: C:\Windows\System32\GroupPolicy\Machine\Registry.pol Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif File created: C:\Windows\System32\GroupPolicy\GPT.INI Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Code function: 0_2_0040497C 0_2_0040497C
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Code function: 0_2_00406ED2 0_2_00406ED2
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Code function: 0_2_004074BB 0_2_004074BB
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_0062B020 16_2_0062B020
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_006294E0 16_2_006294E0
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_00629C80 16_2_00629C80
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_006A81C8 16_2_006A81C8
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_00642325 16_2_00642325
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_00656432 16_2_00656432
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_0065258E 16_2_0065258E
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_0062E6F0 16_2_0062E6F0
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_0064275A 16_2_0064275A
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_006A0802 16_2_006A0802
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_006588EF 16_2_006588EF
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_006569A4 16_2_006569A4
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_00630BE0 16_2_00630BE0
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_0067EB95 16_2_0067EB95
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_006A0C7F 16_2_006A0C7F
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_00688CB1 16_2_00688CB1
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_0064CC81 16_2_0064CC81
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_00656F16 16_2_00656F16
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_006432E9 16_2_006432E9
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_0064F339 16_2_0064F339
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_0063D457 16_2_0063D457
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_0063F57E 16_2_0063F57E
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_006415E4 16_2_006415E4
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_00621663 16_2_00621663
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_0062F6A0 16_2_0062F6A0
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_006477F3 16_2_006477F3
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_0064DAD5 16_2_0064DAD5
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_00641AD8 16_2_00641AD8
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_00659C15 16_2_00659C15
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_0063DD14 16_2_0063DD14
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_00641EF0 16_2_00641EF0
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_0064BF06 16_2_0064BF06
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_009181C8 37_2_009181C8
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008B2325 37_2_008B2325
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008C6432 37_2_008C6432
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008C258E 37_2_008C258E
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_0089E6F0 37_2_0089E6F0
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008B275A 37_2_008B275A
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008C88EF 37_2_008C88EF
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_00910802 37_2_00910802
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008C69A4 37_2_008C69A4
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008EEB95 37_2_008EEB95
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008A0BE0 37_2_008A0BE0
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008BCC81 37_2_008BCC81
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008F8CB1 37_2_008F8CB1
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_00910C7F 37_2_00910C7F
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008C6F16 37_2_008C6F16
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_0089B020 37_2_0089B020
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008B32E9 37_2_008B32E9
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008BF339 37_2_008BF339
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008994E0 37_2_008994E0
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008AD457 37_2_008AD457
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008B15E4 37_2_008B15E4
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008AF57E 37_2_008AF57E
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_0089F6A0 37_2_0089F6A0
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_00891663 37_2_00891663
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008B77F3 37_2_008B77F3
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008B1AD8 37_2_008B1AD8
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008BDAD5 37_2_008BDAD5
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_00899C80 37_2_00899C80
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008C9C15 37_2_008C9C15
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008ADD14 37_2_008ADD14
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008B1EF0 37_2_008B1EF0
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008BBF06 37_2_008BBF06
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_0144002D 37_2_0144002D
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_0144036F 37_2_0144036F
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_014547BF 37_2_014547BF
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_0143C960 37_2_0143C960
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_0143A928 37_2_0143A928
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_01422870 37_2_01422870
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_01458BB0 37_2_01458BB0
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_014F2FD0 37_2_014F2FD0
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_014371A0 37_2_014371A0
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_0142F580 37_2_0142F580
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_0144DA86 37_2_0144DA86
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_014EFC40 37_2_014EFC40
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: String function: 01434380 appears 52 times
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: String function: 008B8A60 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: String function: 008B0C42 appears 70 times
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: String function: 008A1A36 appears 33 times
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Code function: String function: 004062A3 appears 57 times
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: String function: 00631A36 appears 34 times
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: String function: 00648A60 appears 42 times
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: String function: 00640C42 appears 70 times
Sample file is different than original file name gathered from version info
Source: ij4YvAl59D.exe, 00000000.00000003.1783937876.00000000027C2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameAutoIt3.exeB vs ij4YvAl59D.exe
Uses 32bit PE files
Source: ij4YvAl59D.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: ij4YvAl59D.exe Static PE information: Section: .reloc ZLIB complexity 1.002685546875
Source: classification engine Classification label: mal100.rans.troj.evad.winEXE@30/56@2/1
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_0068A51A GetLastError,FormatMessageW, 16_2_0068A51A
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_00678BCC AdjustTokenPrivileges,CloseHandle, 16_2_00678BCC
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_0067917C LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError, 16_2_0067917C
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008E8BCC AdjustTokenPrivileges,CloseHandle, 37_2_008E8BCC
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008E917C LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError, 37_2_008E917C
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Code function: 0_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 0_2_004044A5
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_00683FB5 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle, 16_2_00683FB5
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Code function: 0_2_004024FB CoCreateInstance, 0_2_004024FB
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_006842AA __swprintf,__swprintf,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx, 16_2_006842AA
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif File created: C:\Users\user\AppData\Local\LinkGuard Dynamics Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5432:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3848:120:WilError_03
Source: C:\Users\user\Desktop\ij4YvAl59D.exe File created: C:\Users\user\AppData\Local\Temp\nsu4B6A.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Command line argument: @] 16_2_00635F8B
Source: ij4YvAl59D.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\SysWOW64\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Users\user\Desktop\ij4YvAl59D.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Origin.pif, Origin.pif, 00000025.00000002.4203013330.0000000001400000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: Origin.pif, 00000025.00000002.4203013330.0000000001400000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: ij4YvAl59D.exe Virustotal: Detection: 59%
Source: ij4YvAl59D.exe ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\ij4YvAl59D.exe File read: C:\Users\user\Desktop\ij4YvAl59D.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\ij4YvAl59D.exe "C:\Users\user\Desktop\ij4YvAl59D.exe"
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k copy Emotions Emotions.cmd & Emotions.cmd & exit
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa.exe opssvc.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 369580
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "MaskBathroomsCompoundInjection" Participants
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Massachusetts + Radius + Dental + Vendor + Fighting + June + Stockings + Convenience + Falls + Joke + Mask + Severe + Outreach + Sig + Bdsm 369580\Z
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\369580\Origin.pif 369580\Origin.pif 369580\Z
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 15
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "SecureHawk" /tr "wscript //B 'C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js'" /sc onlogon /F /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js"
Source: C:\Windows\System32\wscript.exe Process created: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif "C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif" "C:\Users\user\AppData\Local\LinkGuard Dynamics\r"
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Process created: C:\Users\user\AppData\Local\Temp\369580\Origin.pif C:\Users\user\AppData\Local\Temp\369580\Origin.pif
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k copy Emotions Emotions.cmd & Emotions.cmd & exit Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa.exe opssvc.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 369580 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "MaskBathroomsCompoundInjection" Participants Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Massachusetts + Radius + Dental + Vendor + Fighting + June + Stockings + Convenience + Falls + Joke + Mask + Severe + Outreach + Sig + Bdsm 369580\Z Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\369580\Origin.pif 369580\Origin.pif 369580\Z Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 15 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "SecureHawk" /tr "wscript //B 'C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js'" /sc onlogon /F /RL HIGHEST Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Process created: C:\Users\user\AppData\Local\Temp\369580\Origin.pif C:\Users\user\AppData\Local\Temp\369580\Origin.pif Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif "C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif" "C:\Users\user\AppData\Local\LinkGuard Dynamics\r" Jump to behavior
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: cmdext.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: jscript.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: scrobj.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: d3d11.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: dxgi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: dxcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: gpedit.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: activeds.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: dssec.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: dsuiext.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: framedynos.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: adsldpc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: dsrole.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: logoncli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: ntdsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: authz.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Section loaded: devobj.dll Jump to behavior
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif File written: C:\Windows\SysWOW64\GroupPolicy\gpt.ini Jump to behavior
Source: ij4YvAl59D.exe Static file information: File size 17135424 > 1048576
Source: ij4YvAl59D.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress, 0_2_004062FC
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_00648AA5 push ecx; ret 16_2_00648AB8
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008F88B7 push FFFFFF8Bh; iretd 37_2_008F88B9
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008BE86F push edi; ret 37_2_008BE871
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008BE988 push esi; ret 37_2_008BE98A
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008B8AA5 push ecx; ret 37_2_008B8AB8
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008ACBF1 push eax; retf 37_2_008ACBF8
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008BEB63 push esi; ret 37_2_008BEB65
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008BEC4C push edi; ret 37_2_008BEC4E
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_009072DC push eax; iretd 37_2_009072DD
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_01433F59 push ecx; ret 37_2_01433F6C

Persistence and Installation Behavior
barindex
Drops PE files with a suspicious file extension
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif File created: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Jump to dropped file
Drops PE files
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif File created: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "SecureHawk" /tr "wscript //B 'C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js'" /sc onlogon /F /RL HIGHEST
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_006A577B IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed, 16_2_006A577B
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_00635EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput, 16_2_00635EDA
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_0091577B IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed, 37_2_0091577B
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008A5EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput, 37_2_008A5EDA
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_006432E9 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 16_2_006432E9
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Found stalling execution ending in API Sleep call
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Stalling execution: Execution stalls by calling Sleep
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Stalling execution: Execution stalls by calling Sleep
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\System32\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Found evasive API chain (date check)
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif API coverage: 4.8 %
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif API coverage: 1.1 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\timeout.exe TID: 4592 Thread sleep count: 120 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif TID: 1700 Thread sleep count: 66 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif TID: 1356 Thread sleep count: 37 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif TID: 1356 Thread sleep count: 198 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif TID: 5212 Thread sleep count: 91 > 30 Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Last function: Thread delayed
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Code function: 0_2_004062D5 FindFirstFileW,FindClose, 0_2_004062D5
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Code function: 0_2_00402E18 FindFirstFileW, 0_2_00402E18
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 0_2_00406C9B
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_006847B7 GetFileAttributesW,FindFirstFileW,FindClose, 16_2_006847B7
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_00683E72 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 16_2_00683E72
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_0068C16C FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose, 16_2_0068C16C
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_0068CB81 FindFirstFileW,FindClose, 16_2_0068CB81
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_0068CC0C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, 16_2_0068CC0C
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_0068F445 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 16_2_0068F445
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_0068F5A2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 16_2_0068F5A2
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_0068F8A3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose, 16_2_0068F8A3
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_00683B4F FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 16_2_00683B4F
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008FC16C FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose, 37_2_008FC16C
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008F47B7 GetFileAttributesW,FindFirstFileW,FindClose, 37_2_008F47B7
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008FCB81 FindFirstFileW,FindClose, 37_2_008FCB81
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008FCC0C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, 37_2_008FCC0C
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008FF445 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 37_2_008FF445
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008FF5A2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 37_2_008FF5A2
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008FF8A3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose, 37_2_008FF8A3
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008F3B4F FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 37_2_008F3B4F
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008F3E72 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 37_2_008F3E72
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_01432022 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx, 37_2_01432022
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_01431F9C FindClose,FindFirstFileExW,GetLastError, 37_2_01431F9C
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_00635D13 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 16_2_00635D13
Source: Origin.pif, 00000025.00000002.4203516927.000000000180D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000S
Source: Origin.pif, 00000025.00000002.4203516927.000000000181E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91e
Source: Origin.pif, 00000025.00000002.4203516927.000000000180D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000M
Source: Origin.pif, 00000025.00000002.4203516927.000000000180D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: Origin.pif, 00000025.00000002.4203516927.000000000180D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}|
Source: SecureHawk.pif, 00000010.00000002.4205566786.0000000003C7A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllxE=
Source: Origin.pif, 00000025.00000002.4202967200.00000000013FB000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}T
Source: Origin.pif, 00000025.00000002.4203516927.0000000001827000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-9
Source: Origin.pif, 00000025.00000002.4203516927.000000000180D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Process information queried: ProcessInformation Jump to behavior
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_006943B9 BlockInput, 16_2_006943B9
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_00635240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW, 16_2_00635240
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_00655BDC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 16_2_00655BDC
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress, 0_2_004062FC
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_006786B0 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity, 16_2_006786B0
Enables debug privileges
Source: C:\Windows\SysWOW64\tasklist.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_0064A2B5 SetUnhandledExceptionFilter,UnhandledExceptionFilter, 16_2_0064A2B5
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_0064A284 SetUnhandledExceptionFilter, 16_2_0064A284
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008BA284 SetUnhandledExceptionFilter, 37_2_008BA284
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_008BA2B5 SetUnhandledExceptionFilter,UnhandledExceptionFilter, 37_2_008BA2B5
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_01434184 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 37_2_01434184
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_0143451D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 37_2_0143451D
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_01438A64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 37_2_01438A64

HIPS / PFW / Operating System Protection Evasion
barindex
Contains functionality to inject threads in other processes
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: 37_2_014CF280 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject, 37_2_014CF280
Disables Windows Defender (deletes autostart)
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Registry value deleted: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{581A8394-A0F5-4CA9-9527-C29248E9064A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender DisableAntiSpyware Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Memory written: C:\Users\user\AppData\Local\Temp\369580\Origin.pif base: 1400000 value starts with: 4D5A Jump to behavior
Contains functionality to execute programs as a different user
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_0067914C LogonUserW, 16_2_0067914C
Contains functionality to launch a program with higher privileges
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_00635240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW, 16_2_00635240
Contains functionality to simulate keystroke presses
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_00681932 SendInput,keybd_event, 16_2_00681932
Contains functionality to simulate mouse events
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_0068507B mouse_event, 16_2_0068507B
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k copy Emotions Emotions.cmd & Emotions.cmd & exit Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa.exe opssvc.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 369580 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "MaskBathroomsCompoundInjection" Participants Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Massachusetts + Radius + Dental + Vendor + Fighting + June + Stockings + Convenience + Falls + Joke + Mask + Severe + Outreach + Sig + Bdsm 369580\Z Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\369580\Origin.pif 369580\Origin.pif 369580\Z Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 15 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Process created: C:\Users\user\AppData\Local\Temp\369580\Origin.pif C:\Users\user\AppData\Local\Temp\369580\Origin.pif Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif "C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif" "C:\Users\user\AppData\Local\LinkGuard Dynamics\r" Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_006786B0 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity, 16_2_006786B0
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_00684D89 AllocateAndInitializeSid,CheckTokenMembership,FreeSid, 16_2_00684D89
Source: Origin.pif, 0000000A.00000003.1828150960.0000000004A6E000.00000004.00000800.00020000.00000000.sdmp, Origin.pif, 0000000A.00000000.1817508928.0000000000945000.00000002.00000001.01000000.00000005.sdmp, SecureHawk.pif, 00000010.00000002.4202781597.00000000006D5000.00000002.00000001.01000000.00000008.sdmp Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: SecureHawk.pif, Origin.pif Binary or memory string: Shell_TrayWnd
Source: ij4YvAl59D.exe, 00000000.00000003.1783937876.00000000027B9000.00000004.00000020.00020000.00000000.sdmp, Studios.0.dr Binary or memory string: u3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_0064878B cpuid 16_2_0064878B
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: GetACP,IsValidCodePage,GetLocaleInfoW, 37_2_01452B5A
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: GetLocaleInfoW, 37_2_01452D5F
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, 37_2_01452F77
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: EnumSystemLocalesW, 37_2_01452E51
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: EnumSystemLocalesW, 37_2_01452E06
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: EnumSystemLocalesW, 37_2_01452EEC
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: GetLocaleInfoW, 37_2_014531CA
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: EnumSystemLocalesW, 37_2_0144B1B1
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: GetLocaleInfoW, 37_2_014533F9
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 37_2_014532F3
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 37_2_014534CF
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: GetLocaleInfoW, 37_2_0144B734
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Code function: GetLocaleInfoEx,FormatMessageA, 37_2_01431D94
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_0068E0CA GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,__wsplitpath,_wcscat,_wcscat,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,_wcscpy,SetCurrentDirectoryW, 16_2_0068E0CA
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_00660652 GetUserNameW, 16_2_00660652
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_0065409A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte, 16_2_0065409A
Source: C:\Users\user\Desktop\ij4YvAl59D.exe Code function: 0_2_00406805 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW, 0_2_00406805
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Disable Windows Defender real time protection (registry)
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{581A8394-A0F5-4CA9-9527-C29248E9064A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions Registry value created: Exclusions_Extensions 1 Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{581A8394-A0F5-4CA9-9527-C29248E9064A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender Registry value created: DisableAntiSpyware 1 Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{581A8394-A0F5-4CA9-9527-C29248E9064A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender Registry value created: DisableRoutinelyTakingAction 1 Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{581A8394-A0F5-4CA9-9527-C29248E9064A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableBehaviorMonitoring 1 Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{581A8394-A0F5-4CA9-9527-C29248E9064A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableOnAccessProtection 1 Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{581A8394-A0F5-4CA9-9527-C29248E9064A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableScanOnRealtimeEnable 1 Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{581A8394-A0F5-4CA9-9527-C29248E9064A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableRealtimeMonitoring 1 Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{581A8394-A0F5-4CA9-9527-C29248E9064A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableIOAVProtection 1 Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{581A8394-A0F5-4CA9-9527-C29248E9064A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableRawWriteNotification 1 Jump to behavior
Exclude list of file types from scheduled, custom, and real-time scanning
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif Registry value created: Exclusions_Extensions 1 Jump to behavior
Modifies Group Policy settings
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif File written: C:\Windows\System32\GroupPolicy\GPT.INI Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected RisePro Stealer
Source: Yara match File source: Process Memory Space: Origin.pif PID: 1592, type: MEMORYSTR
OS version to string mapping found (often used in BOTs)
Source: Origin.pif Binary or memory string: WIN_81
Source: Origin.pif Binary or memory string: WIN_XP
Source: Origin.pif Binary or memory string: WIN_XPe
Source: Origin.pif.1.dr Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 2USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyteP
Source: Origin.pif Binary or memory string: WIN_VISTA
Source: Origin.pif Binary or memory string: WIN_7
Source: Origin.pif Binary or memory string: WIN_8

Remote Access Functionality
barindex
Yara detected RisePro Stealer
Source: Yara match File source: Process Memory Space: Origin.pif PID: 1592, type: MEMORYSTR
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_00696733 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket, 16_2_00696733
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif Code function: 16_2_00696BF7 socket,WSAGetLastError,bind,WSAGetLastError,closesocket, 16_2_00696BF7
windows-stand
Behavior
Click here to start
Slideshow Behavior Animation
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1576616 Sample: ij4YvAl59D.exe Startdate: 17/12/2024 Architecture: WINDOWS Score: 100 63 jZFqZYoOtpryMyRHD.jZFqZYoOtpryMyRHD 2->63 77 Suricata IDS alerts for network traffic 2->77 79 Multi AV Scanner detection for submitted file 2->79 81 Yara detected RisePro Stealer 2->81 83 5 other signatures 2->83 10 ij4YvAl59D.exe 95 2->10         started        14 wscript.exe 1 2->14         started        signatures3 process4 file5 53 C:\Users\user\AppData\Local\Temp\Vendor, data 10->53 dropped 55 C:\Users\user\AppData\Local\Temp\Stockings, data 10->55 dropped 57 C:\Users\user\AppData\Local\Temp\Sig, data 10->57 dropped 59 14 other files (13 malicious) 10->59 dropped 93 Found stalling execution ending in API Sleep call 10->93 95 Writes many files with high entropy 10->95 16 cmd.exe 3 10->16         started        97 Windows Scripting host queries suspicious COM object (likely to drop second stage) 14->97 20 SecureHawk.pif 14->20         started        signatures6 process7 file8 41 C:\Users\user\AppData\Local\...\Origin.pif, PE32 16->41 dropped 65 Drops PE files with a suspicious file extension 16->65 67 Writes many files with high entropy 16->67 22 Origin.pif 4 16->22         started        26 cmd.exe 2 16->26         started        28 conhost.exe 16->28         started        30 7 other processes 16->30 signatures9 process10 file11 45 C:\Users\user\AppData\Local\...\r, data 22->45 dropped 47 C:\Users\user\AppData\Local\...\SecureHawk.js, ASCII 22->47 dropped 49 C:\Users\user\AppData\...\SecureHawk.pif, PE32 22->49 dropped 85 Found stalling execution ending in API Sleep call 22->85 87 Contains functionality to inject threads in other processes 22->87 89 Drops PE files with a suspicious file extension 22->89 91 3 other signatures 22->91 32 Origin.pif 10 7 22->32         started        37 schtasks.exe 1 22->37         started        51 C:\Users\user\AppData\Local\Temp\369580\Z, data 26->51 dropped signatures12 process13 dnsIp14 61 3.36.173.8, 50027, 50500 AMAZONEXPANSIONGB United States 32->61 43 C:\Windows\System32behaviorgraphroupPolicybehaviorgraphPT.INI, ASCII 32->43 dropped 69 Disables Windows Defender (deletes autostart) 32->69 71 Exclude list of file types from scheduled, custom, and real-time scanning 32->71 73 Adds extensions / path to Windows Defender exclusion list (Registry) 32->73 75 2 other signatures 32->75 39 conhost.exe 37->39         started        file15 signatures16 process17
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
3.36.173.8
 unknown United States
8987 AMAZONEXPANSIONGB true

Contacted Domains

Name IP Active
jZFqZYoOtpryMyRHD.jZFqZYoOtpryMyRHD unknown unknown