Windows Analysis Report
CnjMEmbChO.exe

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6472:120:WilError_03

Source: CnjMEmbChO.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\CnjMEmbChO.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\CnjMEmbChO.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: CnjMEmbChO.exe

ReversingLabs: Detection: 50%

Source: RuntimeBrokers.exe	String found in binary or memory: --StartTask
Source: RuntimeBrokers.exe	String found in binary or memory: --InstallTask
Source: RuntimeBrokers.exe	String found in binary or memory: --stop
Source: RuntimeBrokers.exe	String found in binary or memory: --start
Source: RuntimeBrokers.exe	String found in binary or memory: --install

Source: C:\Users\user\Desktop\CnjMEmbChO.exe

File read: C:\Users\user\Desktop\CnjMEmbChO.exe

Source: unknown	Process created: C:\Users\user\Desktop\CnjMEmbChO.exe "C:\Users\user\Desktop\CnjMEmbChO.exe"
Source: C:\Users\user\Desktop\CnjMEmbChO.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c start C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe
Source: C:\Users\user\Desktop\CnjMEmbChO.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c start C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Jump to behavior

Source: C:\Users\user\Desktop\CnjMEmbChO.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\CnjMEmbChO.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\CnjMEmbChO.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CnjMEmbChO.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CnjMEmbChO.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\CnjMEmbChO.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\CnjMEmbChO.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\CnjMEmbChO.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\CnjMEmbChO.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\CnjMEmbChO.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\CnjMEmbChO.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\CnjMEmbChO.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\CnjMEmbChO.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\CnjMEmbChO.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\CnjMEmbChO.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\CnjMEmbChO.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\CnjMEmbChO.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\CnjMEmbChO.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\CnjMEmbChO.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\CnjMEmbChO.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\CnjMEmbChO.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: libcurl.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: flashcenter_pp_ax_install_cn.exe.lnk.4.dr

LNK file: ..\..\Public\Bilite\flashcenter_pp_ax_install_cn.exe

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: CnjMEmbChO.exe

Static file information: File size 23595283 > 1048576

Source:	Binary string: \YSS\Release\libcurl.pdb source: CnjMEmbChO.exe, 00000000.00000003.2061562693.0000000002B31000.00000004.00000020.00020000.00000000.sdmp, RuntimeBrokers.exe, 00000004.00000002.4498381816.000000006CADA000.00000002.00000001.01000000.00000006.sdmp, libcurl.dll.0.dr
Source:	Binary string: G:\ZCSD\XZRecordAlone\xzrecordalone\Release\XZCalendarServer.pdb source: CnjMEmbChO.exe, 00000000.00000003.2061562693.0000000002B31000.00000004.00000020.00020000.00000000.sdmp, RuntimeBrokers.exe, 00000004.00000000.2064804065.0000000000FDF000.00000002.00000001.01000000.00000005.sdmp, RuntimeBrokers.exe, 00000004.00000002.4497096968.0000000000FDF000.00000002.00000001.01000000.00000005.sdmp, RuntimeBrokers.exe.0.dr
Source:	Binary string: c:\workspace\GTChecker\plutus\main\dev\target\win\Release\GTCheck.pdb source: CnjMEmbChO.exe, 00000000.00000003.2061562693.0000000002B31000.00000004.00000020.00020000.00000000.sdmp, flashcenter_pp_ax_install_cn.exe.0.dr
Source:	Binary string: C:\Users\ymishra\Documents\GitHub\Dev\target\win\Release\Adobe Download Manager.pdb source: CnjMEmbChO.exe, 00000000.00000003.2061562693.0000000002B31000.00000004.00000020.00020000.00000000.sdmp, flashcenter_pp_ax_install_cn.exe.0.dr

Source: C:\Users\user\Desktop\CnjMEmbChO.exe

Code function: 0_2_00406D5D LoadLibraryA,GetProcAddress,GetModuleHandleW,GetWindow,GetWindow,LoadIconW,GetWindow,

0_2_00406D5D

Source: libcurl.dll.0.dr

Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\CnjMEmbChO.exe	Code function: 0_2_00411C20 push eax; ret	0_2_00411C4E
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_00F655E9 push ebx; retf	4_2_00F655EA
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_00F9C7E6 push ecx; ret	4_2_00F9C7F9
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_00F9BEE2 push ecx; ret	4_2_00F9BEF5
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_6C95F770 push eax; mov dword ptr [esp], 8007000Eh	4_2_6C95F774
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_6C9A0E84 pushfd ; retf	4_2_6C9A0E85
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_6C96FDC3 push esi; ret	4_2_6C96FDC5
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_6C97F74D push ecx; ret	4_2_6C97F760

Source: C:\Users\user\Desktop\CnjMEmbChO.exe	File created: C:\Users\Public\Bilite\flashcenter_pp_ax_install_cn.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CnjMEmbChO.exe	File created: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CnjMEmbChO.exe	File created: C:\Users\Public\Bilite\Axialis\libcurl.dll	Jump to dropped file

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_6C96E96E IsIconic,	4_2_6C96E96E
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_6C9987C4 SetRectEmpty,RedrawWindow,ReleaseCapture,SetCapture,ReleaseCapture,SetCapture,SendMessageW,UpdateWindow,SendMessageW,IsWindow,IsIconic,IsZoomed,IsWindow,UpdateWindow,	4_2_6C9987C4
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_6C98307D GetParent,IsIconic,GetParent,__EH_prolog3,	4_2_6C98307D
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_6C9672DF IsIconic,IsWindowVisible,	4_2_6C9672DF
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_6C9732E4 IsWindowVisible,IsIconic,	4_2_6C9732E4

Source: C:\Users\user\Desktop\CnjMEmbChO.exe

Process information set: NOOPENFILEERRORBOX

Query firmware table information (likely to detect VMs)

Malware Analysis System Evasion

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

System information queried: FirmwareTableInformation

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Code function: GetAdaptersInfo,GetAdaptersInfo,GetAdaptersInfo,

4_2_00F96390

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Window / User API: threadDelayed 978	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Window / User API: threadDelayed 3844	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Window / User API: threadDelayed 3268	Jump to behavior

Source: C:\Users\user\Desktop\CnjMEmbChO.exe

Dropped PE file which has not been started: C:\Users\Public\Bilite\flashcenter_pp_ax_install_cn.exe

Jump to dropped file

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_4-115827
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Evasive API call chain: GetLocalTime,DecisionNodes			graph_4-115349

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

API coverage: 6.0 %

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe TID: 5448	Thread sleep time: -73000s >= -30000s	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe TID: 5416	Thread sleep time: -2934000s >= -30000s	Jump to behavior
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe TID: 5416	Thread sleep time: -9804000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\CnjMEmbChO.exe	Code function: 0_2_0040301A GetFileAttributesW,SetLastError,FindFirstFileW,FindClose,CompareFileTime,	0_2_0040301A
Source: C:\Users\user\Desktop\CnjMEmbChO.exe	Code function: 0_2_00402B79 FindFirstFileW,SetFileAttributesW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,	0_2_00402B79
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_00F6BE70 GetLocalTime,FindFirstFileA,FindNextFileA,DeleteFileA,FindNextFileA,__Mtx_destroy_in_situ,__Mtx_destroy_in_situ,	4_2_00F6BE70
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_00FCF4E8 FindFirstFileExA,	4_2_00FCF4E8
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_6C9A82CF __EH_prolog3_GS,GetFullPathNameW,PathIsUNCW,GetVolumeInformationW,CharUpperW,FindFirstFileW,FindClose,	4_2_6C9A82CF
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_6CABF2EC FindFirstFileExW,FindNextFileW,FindClose,FindClose,	4_2_6CABF2EC
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_6CABF23B FindFirstFileExW,	4_2_6CABF23B

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Thread delayed: delay time: 73000

Source: yxhxvpke.png.0.dr	Binary or memory string: bfQeMU\|
Source: flashcenter_pp_ax_install_cn.exe.0.dr	Binary or memory string: >QeMu
Source: yxhxvpke.png.0.dr	Binary or memory string: %hgFs[n

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Process information queried: ProcessInformation

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Code function: 4_2_00F9B4C5 IsDebuggerPresent,OutputDebugStringW,

4_2_00F9B4C5

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Code function: 4_2_6C961028 OutputDebugStringA,GetLastError,

4_2_6C961028

Source: C:\Users\user\Desktop\CnjMEmbChO.exe

Code function: 0_2_00406D5D LoadLibraryA,GetProcAddress,GetModuleHandleW,GetWindow,GetWindow,LoadIconW,GetWindow,

0_2_00406D5D

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Code function: 4_2_00FC46B3 mov eax, dword ptr fs:[00000030h]

4_2_00FC46B3

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Code function: 4_2_00F61AD0 GetProcessHeap,

4_2_00F61AD0

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_00F9C128 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_00F9C128
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_00F9C411 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00F9C411
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_00FB655F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00FB655F
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_6C9D87A6 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_6C9D87A6
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_6CAB1F38 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_6CAB1F38
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_6C97D796 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_6C97D796

Source: C:\Users\user\Desktop\CnjMEmbChO.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c start C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe			Jump to behavior

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Code function: 4_2_00F5245C _strrchr,_strrchr,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateEventW,_strrchr,_strrchr,GetModuleHandleW,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,WaitForSingleObject,PeekMessageW,TranslateMessage,DispatchMessageW,WaitForSingleObject,WaitForSingleObject,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,_strrchr,curl_global_cleanup,MoveFileExW,_strrchr,_strrchr,

4_2_00F5245C

Source: C:\Users\user\Desktop\CnjMEmbChO.exe

Code function: 0_2_0040D72E cpuid

0_2_0040D72E

Source: C:\Users\user\Desktop\CnjMEmbChO.exe	Code function: GetLastError,GetLastError,wsprintfW,GetEnvironmentVariableW,GetEnvironmentVariableW,GetLastError,??2@YAPAXI@Z,GetEnvironmentVariableW,GetLastError,lstrcmpiW,??3@YAXPAX@Z,??3@YAXPAX@Z,SetLastError,lstrlenA,??2@YAPAXI@Z,GetLocaleInfoW,_wtol,MultiByteToWideChar,	0_2_00401F9D
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetLocaleInfoW,	4_2_00FD216F
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: EnumSystemLocalesW,	4_2_00FD22FE
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: EnumSystemLocalesW,	4_2_00FC92B6
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: EnumSystemLocalesW,	4_2_00FD2263
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: EnumSystemLocalesW,	4_2_00FD2218
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	4_2_00FD238B
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetLocaleInfoW,	4_2_00FD25DB
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetLocaleInfoW,	4_2_00FC979F
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	4_2_00FD2704
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	4_2_00FD28D8
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetLocaleInfoW,	4_2_00FD280B
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetModuleHandleW,GetProcAddress,EncodePointer,DecodePointer,GetLocaleInfoW,	4_2_6C9860F1
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetLocaleInfoW,	4_2_6CAC60D3
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: EnumSystemLocalesW,	4_2_6CAC6074
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: EnumSystemLocalesW,	4_2_6CAC61A8
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetLocaleInfoW,	4_2_6CAC61F3
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	4_2_6CAC629A
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetLocaleInfoW,	4_2_6CAC63A0
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: EnumSystemLocalesW,	4_2_6CAC5D86
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: EnumSystemLocalesW,	4_2_6CABBD0B
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	4_2_6CAC5E21
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	4_2_6CAC5B35
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: GetLocaleInfoW,	4_2_6CABB6EC

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\CnjMEmbChO.exe

Code function: 0_2_00401626 ??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetLocalTime,SystemTimeToFileTime,??2@YAPAXI@Z,GetLastError,??3@YAXPAX@Z,??3@YAXPAX@Z,GetLastError,??3@YAXPAX@Z,GetLastError,??3@YAXPAX@Z,??3@YAXPAX@Z,

0_2_00401626

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Code function: 4_2_00FCC3FF _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

4_2_00FCC3FF

Source: C:\Users\user\Desktop\CnjMEmbChO.exe

Code function: 0_2_00404FAA KiUserCallbackDispatcher,GetVersionExW,GetCommandLineW,_wtol,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetModuleFileNameW,_wtol,??2@YAPAXI@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,wsprintfW,_wtol,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,CoInitialize,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetKeyState,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetFileAttributesW,??3@YAXPAX@Z,??3@YAXPAX@Z,_wtol,memset,ShellExecuteExW,WaitForSingleObject,CloseHandle,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,SetCurrentDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,MessageBoxA,

0_2_00404FAA

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_00FAD8C9 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::InternalContextBase::SwitchOut,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::InternalContextBase::SwitchTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,		4_2_00FAD8C9
Source: C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	Code function: 4_2_00FACBF3 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext,		4_2_00FACBF3

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	21 Input Capture	2 System Time Discovery	Remote Services	21 Input Capture	2 Encrypted Channel	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	111 Virtualization/Sandbox Evasion	LSASS Memory	231 Security Software Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	111 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Clipboard Data	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	11 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	35 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
CnjMEmbChO.exe	50%	ReversingLabs	Win32.Adware.FlashHelper

Dropped Files

Source	Detection	Scanner	Label
C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	4%	ReversingLabs
C:\Users\Public\Bilite\Axialis\libcurl.dll	65%	ReversingLabs	Win32.Trojan.DllHijack
C:\Users\Public\Bilite\flashcenter_pp_ax_install_cn.exe	11%	ReversingLabs	Win32.Adware.FlashHelper

Source	Detection	Scanner	Label
http://dump.mgr.xzdesktop.cqttech.com/api/DumpInfoStat%s_%d-%02d-%02d.log	0%	Avira URL Cloud	safe
https://www.flash.cn/	0%	Avira URL Cloud	safe
https://flash.2144.com/cdm/icons/chn100.png	0%	Avira URL Cloud	safe
https://update-xztodolist.cqttech.com/api/v1/update/check50-B8D	0%	Avira URL Cloud	safe
https://update-xztodolist.cqttech.com/api/v1/update/check	0%	Avira URL Cloud	safe
https://help.2144.cn/about/duty.htm	0%	Avira URL Cloud	safe
https://www.flash.cn/cdm/	0%	Avira URL Cloud	safe
https://flash.2144.com/cdm/icons/ten100.png	0%	Avira URL Cloud	safe
https://update-xztodolist.cqttech.com/api/v1/update/check?version=3.2.7.32&union=4003&os=10.0.19041.	0%	Avira URL Cloud	safe
https://update-xztodolist.cqttech.com/api/v1/update/checkXZDesktopCalendarCXZUpdateModule	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	CnjMEmbChO.exe, 00000000.00000003.2061562693.0000000002B31000.00000004.00000020.00020000.00000000.sdmp, libcurl.dll.0.dr	false		high
http://dump.mgr.xzdesktop.cqttech.com/api/DumpInfoStat%s_%d-%02d-%02d.log	CnjMEmbChO.exe, 00000000.00000003.2061562693.0000000002B31000.00000004.00000020.00020000.00000000.sdmp, RuntimeBrokers.exe, 00000004.00000000.2064804065.0000000000FDF000.00000002.00000001.01000000.00000005.sdmp, RuntimeBrokers.exe, 00000004.00000002.4497096968.0000000000FDF000.00000002.00000001.01000000.00000005.sdmp, RuntimeBrokers.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://flash.2144.com/cdm/icons/chn100.png	flashcenter_pp_ax_install_cn.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	CnjMEmbChO.exe, 00000000.00000003.2061562693.0000000002B31000.00000004.00000020.00020000.00000000.sdmp, libcurl.dll.0.dr	false		high
https://www.flash.cn/	CnjMEmbChO.exe, 00000000.00000003.2061562693.0000000002B31000.00000004.00000020.00020000.00000000.sdmp, flashcenter_pp_ax_install_cn.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	CnjMEmbChO.exe, 00000000.00000003.2061562693.0000000002B31000.00000004.00000020.00020000.00000000.sdmp, libcurl.dll.0.dr	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	CnjMEmbChO.exe, 00000000.00000003.2061562693.0000000002B31000.00000004.00000020.00020000.00000000.sdmp, libcurl.dll.0.dr	false		high
http://ocsp.sectigo.com0	CnjMEmbChO.exe, 00000000.00000003.2061562693.0000000002B31000.00000004.00000020.00020000.00000000.sdmp, libcurl.dll.0.dr	false		high
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	CnjMEmbChO.exe, 00000000.00000003.2061562693.0000000002B31000.00000004.00000020.00020000.00000000.sdmp, libcurl.dll.0.dr	false		high
https://flash.2144.com/cdm/icons/ten100.png	flashcenter_pp_ax_install_cn.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://www.flash.cn/cdm/	CnjMEmbChO.exe, 00000000.00000003.2061562693.0000000002B31000.00000004.00000020.00020000.00000000.sdmp, flashcenter_pp_ax_install_cn.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://update-xztodolist.cqttech.com/api/v1/update/check50-B8D	RuntimeBrokers.exe, 00000004.00000002.4496708892.00000000009B3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://update-xztodolist.cqttech.com/api/v1/update/checkXZDesktopCalendarCXZUpdateModule	CnjMEmbChO.exe, 00000000.00000003.2061562693.0000000002B31000.00000004.00000020.00020000.00000000.sdmp, RuntimeBrokers.exe, 00000004.00000000.2064804065.0000000000FDF000.00000002.00000001.01000000.00000005.sdmp, RuntimeBrokers.exe, 00000004.00000002.4497096968.0000000000FDF000.00000002.00000001.01000000.00000005.sdmp, RuntimeBrokers.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	CnjMEmbChO.exe, 00000000.00000003.2061562693.0000000002B31000.00000004.00000020.00020000.00000000.sdmp, libcurl.dll.0.dr	false		high
https://update-xztodolist.cqttech.com/api/v1/update/check	CnjMEmbChO.exe, 00000000.00000003.2061562693.0000000002B31000.00000004.00000020.00020000.00000000.sdmp, RuntimeBrokers.exe, RuntimeBrokers.exe, 00000004.00000000.2064804065.0000000000FDF000.00000002.00000001.01000000.00000005.sdmp, RuntimeBrokers.exe, 00000004.00000002.4497096968.0000000000FDF000.00000002.00000001.01000000.00000005.sdmp, RuntimeBrokers.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://update-xztodolist.cqttech.com/api/v1/update/check?version=3.2.7.32&union=4003&os=10.0.19041.	RuntimeBrokers.exe, 00000004.00000002.4496708892.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	CnjMEmbChO.exe, 00000000.00000003.2061562693.0000000002B31000.00000004.00000020.00020000.00000000.sdmp, libcurl.dll.0.dr	false		high
https://help.2144.cn/about/duty.htm	CnjMEmbChO.exe, 00000000.00000003.2061562693.0000000002B31000.00000004.00000020.00020000.00000000.sdmp, flashcenter_pp_ax_install_cn.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://api.flash.cn/config/getCdnValue?key=zero_dayzero_day	CnjMEmbChO.exe, 00000000.00000003.2061562693.0000000002B31000.00000004.00000020.00020000.00000000.sdmp, flashcenter_pp_ax_install_cn.exe.0.dr	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581089
Start date and time:	2024-12-26 23:01:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	CnjMEmbChO.exe renamed because original name is a hash value
Original Sample Name:	6B64F2CD11EC2223C9818E0F752C649E.exe
Detection:	MAL
Classification:	mal48.evad.winEXE@6/9@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 93% Number of executed functions: 123 Number of non-executed functions: 257
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: CnjMEmbChO.exe

Simulations

Behavior and APIs

Time	Type	Description
17:02:05	API Interceptor	33183x Sleep call for process: RuntimeBrokers.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe	WiezmDFd6L.exe	Get hash	malicious	Unknown	Browse
	WiezmDFd6L.exe	Get hash	malicious	Unknown	Browse
	Fqae7BLq4m.exe	Get hash	malicious	Unknown	Browse
	Fqae7BLq4m.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\Public\Bilite\Axialis\IiViS

Process:	C:\Users\user\Desktop\CnjMEmbChO.exe
File Type:	openssl enc'd data with salted password, base64 encoded
Category:	dropped
Size (bytes):	76
Entropy (8bit):	5.471354487013932
Encrypted:	false
SSDEEP:	3:iqkmK2DEMpoClM+saTPyRyMHRY:ilm5YMAaTPyu
MD5:	E0BAD9CEBCCDC9699E01E13A5116F071
SHA1:	5A21864E5C390623A6B52054178F67611B52951D
SHA-256:	6D91853D9E6DCA611D9A374D0C31A7248349F5526CE51D6A03B1BD2FB41FD513
SHA-512:	809DFC6EE8AE4173FE011F19FBD6F5C6516EAEEE04DC77FE1581304B141948D989FA5C7BE02E993727E2137AFC9FFA22C0F59EBC84AD17F73F59048D34D52742
Malicious:	false
Reputation:	low
Preview:	U2FsdGVkX1+lTUHhfuKX513xdE7Qcgfgl3aMIFY+heLEFnJIOMsX588ejlBtuz4vIRkFb9yW/ck=

C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe

Process:	C:\Users\user\Desktop\CnjMEmbChO.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	777816
Entropy (8bit):	6.621348016864403
Encrypted:	false
SSDEEP:	12288:hEj1aAa/zgWDTuE8jegvwIDMuecTenORuFjBw7oHOSgmskduZnTKVrdMujyE3e+0:ooBCoH3BdoTKxdLyAZXdOEvnBzLRUFgi
MD5:	30A274E00DA842B09E9763F19777ADED
SHA1:	848C6A9348020EAEEC1A5674990683A1D9977B80
SHA-256:	9E65D0E8A1BE49EDE20AD53EE1CF57696C99A28D1B058A185818B58B7FD83F66
SHA-512:	81DED3C48D3FFDCF82952922C4B70D5F0945B1B0D5E178A1B552C7D5E8F39D00D3E007D161A7AFBA4502CC5CB2E92DF973902D94C28DF2DE5176FD2F50DE036A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Joe Sandbox View:	Filename: WiezmDFd6L.exe, Detection: malicious, Browse Filename: WiezmDFd6L.exe, Detection: malicious, Browse Filename: Fqae7BLq4m.exe, Detection: malicious, Browse Filename: Fqae7BLq4m.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........a............b......b.......b.................................,.................................................Rich............................PE..L.....Wg.........................................@.................................l.....@..........................................p..0...............X(.......{.. (..p...................0).......(..@............................................text............................... ..`.rdata..............................@..@.data....P.......:..................@....rsrc...0....p.......4..............@..@.reloc...{.......\|...:..............@..B................................................................................................................................................................................................................................................................

C:\Users\Public\Bilite\Axialis\libcurl.dll

Process:	C:\Users\user\Desktop\CnjMEmbChO.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2290968
Entropy (8bit):	6.60547019861942
Encrypted:	false
SSDEEP:	49152:AWc2Dj3hktNUysuFDbfes+p9bZuR6c3ne3EQBSeMyWF2:Vc2Dj3hkHRsuFP2s+pvuR6c3nKEQBSef
MD5:	E7E4AAF65906C66EEEA75F7AC2DF131B
SHA1:	73BE791833FBB819298115C6F636C3A246C19FFD
SHA-256:	C7AE0C27783E10E920CB7B0364D0990C1030584613BB96FBA95EB0FD40F52D5E
SHA-512:	0F8CF7111850629BA6FAF9DFBE79389BE590EF18EFF47E78EC4322C2B2F82291BCB781F4F5C2854C603C3E74F2B7931BC30E0EA0A38A4EB505A8AEB35939E5FE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 65%
Reputation:	low
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....eg...........!.........<.......!.......................................`#...........@............................0.......h..... ..H............"..)... !..0...........................b......P................................................text...m........................... ..`.rdata..._.......`..................@..@.data...@..... ..^..................@....00cfg........ ......N .............@..@.tls.......... ......P .............@....rsrc....H.... ..H...R .............@..@.reloc...0... !..2.... .............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Bilite\Axialis\yxhxvpke.png

Process:	C:\Users\user\Desktop\CnjMEmbChO.exe
File Type:	data
Category:	dropped
Size (bytes):	19985008
Entropy (8bit):	7.999989782543077
Encrypted:	true
SSDEEP:	393216:N7Zqa2Z/TasZct6podJSPp7nf+QaXnA77T1BIfBmqZi3:DqPVTlcVShnf+QrgBmWQ
MD5:	5FE2323F984A1F33A8FBC32DB8937202
SHA1:	9D20C4664CB7D9AEE6429794C8ECE4420DEB4CE3
SHA-256:	34B0DB3361AE9ADD45631CB88274277CE088E589332F4F6EF491EC51913BE6E9
SHA-512:	98A19F12EA7BF3889FE789EBDCE2AF5C681B2F46FD595B01AE41316782A7A5B62AD23FCD7600E8FF128F55489A4B2E76F2A2C660474BE349FD70518CD3A39EAE
Malicious:	false
Reputation:	low
Preview:	..>.....x...@...qyPc5....<..r...MY..?D~YV.^.(O.=...p0../q"2'\.~..G&.8."N.E..........B...NQ.[.9@.C.3.F..B...j...0@..!....I.R.P.y..M4P.....n..n..uTu..1.r-....;..4.....eC)D......./.....}.'...D..@.t.?.}+.........<.....1...$=.t.A;6Lzh..3.=hb.9p...[s......W..._..`._Y...V..c..b..nq...;.s.....T......?O[r\.o......=q.....@......i.5...;..9...;...s.T]......66. ...1\|.l..]]X.H....4......%m....z.....K..7...~.....+Jq.."..c.`w[.Z'.Dg;.".\|. .....[..lN..~!.VNp..i....L.;......2c+...e{.F.r..4....i......4..[..bL....L .h]"/....Xo...b/.V.vy.M.UW.....Z......R....Yt......w4~.2NV......2..r.....P..d..{H.[....W...I.....}...ox.;&.q.......~...^.N."yh\...4...v.L.....\|k.f5q.h.......D...P.o0..k.f.t.....b.5.a.H.p..a.'...E-g~..qp.,...8au...+..T....9.GO....+...lVk.."....qf..d^.F.iV..>P.....N.n..\.>U_...vU...`Q....<...%..i._..p.e.X\|....,.1...Q.!....vx........11.c.'.+J...+.XE..4.l....a.t{.GB.......nQ?:.2W...R..ar.7......E.Z.2....HK../.8V.U...?!.. (.7...S...?.#\|7.A......h

C:\Users\Public\Bilite\flashcenter_pp_ax_install_cn.exe

Process:	C:\Users\user\Desktop\CnjMEmbChO.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6678240
Entropy (8bit):	6.624932879315099
Encrypted:	false
SSDEEP:	98304:qbC9JeQIeYxZWf6JA7UY4zbANqv8GD8Gb/+E258QvZwQw6:qeJCq6Govv8GD8GbPYCh6
MD5:	7424FE053510D978F05F464EF34DD045
SHA1:	BBC9BB0BEEDC025CED722CB7D3217DB129F1A75F
SHA-256:	C2BCFCD1BAA8CC96AA6674AE8C2275ADFC1BFDEBED22BD537D44CC1C11406CA9
SHA-512:	CF2DB00FB044A8049B427F193A8E6090240B0614820768AF96CF2FACDC0D62D3DC1E46B1673BFB23E84B2AE351505684A953C920B27D297A0315611EDA746509
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 11%
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......e..!..!..!..(.T. ..(.S.5...... ...k......k.....k.....!..#..GC.."..(.C.4..GC..6..!.....GC.....GC.. ..GC.. ..GC.. ..Rich!..........................PE..L.....)g..................#...B...............#...@..........................`f.......f...@...........................,.i... h,.......-.h.1...........e.......^....@.#.8.............................).@.............#......I,......................text...N.#.......#................. ..`.rdata..i.....#.......#.............@..@.data...D.....,..~...~,.............@....rsrc...h.1...-...1...,.............@..@.reloc........^.......^.............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Cqttech\XZDesktopCalendar\crash\log\XZCalendarServer_2024-12-26.log

Process:	C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1177
Entropy (8bit):	5.123023479174324
Encrypted:	false
SSDEEP:	24:oV1zfHfOfoKI2DRUhaUC1RCVYMArTA1FW2j1PD:obj/GgmKhpQrMA48YPD
MD5:	F6EF1759B0102945A7094E28762D5C3B
SHA1:	3716FC9CFB288ABCB8D7B63C91FCF079DA0EF052
SHA-256:	C1949BAC046C2DF0ACB01F3B8D2BDC62EFB28573D829EE950E84F9B26C6459E9
SHA-512:	025FE3CD3999E747759F0FD775347B7A80C26E3D65D36C879DEAFA32608DD473E84AC1217373ADD6333225BAB0B2DAE4452617FE7CAC11A74ECACBBAF3550DBD
Malicious:	false
Preview:	[2024-12-26 18:49:18.710] [info] [5828] [application.cpp Run: 51] curl init res:2..[2024-12-26 18:49:18.712] [info] [5828] [application.cpp Run: 64] CreateEvent [628]..[2024-12-26 18:49:18.712] [info] [5828] [application.cpp Run: 76] CXZShellExecute init..[2024-12-26 18:49:18.712] [info] [5828] [application.cpp Run: 78] CXZUpdateModule init..[2024-12-26 18:49:18.716] [info] [5828] [application.cpp Run: 80] Timer init..[2024-12-26 18:49:18.734] [info] [5828] [application.cpp Run: 82] ServiceMgr Run..[2024-12-26 18:49:18.764] [info] [5828] [application.cpp Run: 84] ThreadPoolMgr Run..[2024-12-26 18:49:18.764] [info] [5828] [application.cpp Run: 87] Running m_hWndAsy:328776..[2024-12-26 18:49:18.765] [info] [5828] [application.cpp Run: 107] Message Loop..[2024-12-26 18:49:29.260] [info] [6000] [xzupdatemodule.cpp PerformCheckUpdateSync: 316] CheckUpdate getstart..[2024-12-26 18:49:32.089] [error] [6000] [mmcurl.cpp Get: 128] curl init failed..[2024-12-26 18:49:35.171] [info] [6000] [xzupd

C:\Users\user\AppData\Local\Cqttech\XZDesktopCalendar\crash\log\XZCalendarServer_2024-12-27.log

Process:	C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1245
Entropy (8bit):	5.157217857163627
Encrypted:	false
SSDEEP:	24:oVidArCCKFW2jCKPWqEsUArvaWUFW2jWUPWHAr/dgFW2jdgPD:o4dAbK85KPrUAbdU8zUP8Ai83PD
MD5:	D9C1BED8907080328AF9AA0A77125FD8
SHA1:	DDEF82279CFBCBB775A3BDF1E5F1705BFF68CCFE
SHA-256:	4749AC5C6B60A94526A5344186E830D1606673279701329F08D61839AF3010D5
SHA-512:	2A866D6B07ECAF2C7747FE75D2D1787FEA3CC89662E65A3545931BCE4A31E6F9D680758159699DCEDD086BD31C4F50DC0993DEAC31764F28B06C9DD2EBECDE93
Malicious:	false
Preview:	[2024-12-27 01:29:25.789] [info] [5652] [xzupdatemodule.cpp PerformCheckUpdateSync: 316] CheckUpdate getstart..[2024-12-27 02:25:46.866] [error] [5652] [mmcurl.cpp Get: 128] curl init failed..[2024-12-27 03:14:49.744] [info] [5652] [xzupdatemodule.cpp PerformCheckUpdateSync: 319] CheckUpdate Res:2-strRes:..[2024-12-27 03:14:49.744] [info] [5652] [xzupdatemodule.cpp PerformCheckUpdateSync: 330] updatecheck fail..[2024-12-27 09:51:15.693] [info] [1536] [xzupdatemodule.cpp PerformCheckUpdateSync: 316] CheckUpdate getstart..[2024-12-27 11:17:08.570] [error] [1536] [mmcurl.cpp Get: 128] curl init failed..[2024-12-27 12:08:59.459] [info] [1536] [xzupdatemodule.cpp PerformCheckUpdateSync: 319] CheckUpdate Res:2-strRes:..[2024-12-27 12:08:59.459] [info] [1536] [xzupdatemodule.cpp PerformCheckUpdateSync: 330] updatecheck fail..[2024-12-27 18:47:32.058] [info] [3276] [xzupdatemodule.cpp PerformCheckUpdateSync: 316] CheckUpdate getstart..[2024-12-27 19:48:11.415] [error] [3276] [mmcurl.cpp Get: 1

C:\Users\user\AppData\Local\Cqttech\XZDesktopCalendar\crash\log\XZCalendarServer_2024-12-28.log

Process:	C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1241
Entropy (8bit):	5.147745411413675
Encrypted:	false
SSDEEP:	24:oVpNznRArBSJ7RFW2jJYRPWCVArZRy+dFW2jRYPW/ArrWFW2jWPD:onrAtu8BPLAxd87PQAm8nPD
MD5:	9320F151889B84DA68FA19A89F00D3F8
SHA1:	B64B30766711D5A08FEE427A93AA7FED67B3589D
SHA-256:	A42DD03431AD9A2A55EAA7897C14733D31D82C0E08B86B173AAF5E2988B833E5
SHA-512:	468C8DFF3007A14302E7AE73F6C99069A67E882D11B49BD91F3997746C55527A799B629B10D4301781B29931B948EAF2EEE9D29FDBD90F8F2250B2D1A2268289
Malicious:	false
Preview:	[2024-12-28 03:29:54.522] [info] [764] [xzupdatemodule.cpp PerformCheckUpdateSync: 316] CheckUpdate getstart..[2024-12-28 04:38:52.298] [error] [764] [mmcurl.cpp Get: 128] curl init failed..[2024-12-28 05:21:01.058] [info] [764] [xzupdatemodule.cpp PerformCheckUpdateSync: 319] CheckUpdate Res:2-strRes:..[2024-12-28 05:21:01.059] [info] [764] [xzupdatemodule.cpp PerformCheckUpdateSync: 330] updatecheck fail..[2024-12-28 12:05:46.134] [info] [6556] [xzupdatemodule.cpp PerformCheckUpdateSync: 316] CheckUpdate getstart..[2024-12-28 13:05:37.257] [error] [6556] [mmcurl.cpp Get: 128] curl init failed..[2024-12-28 14:08:40.628] [info] [6556] [xzupdatemodule.cpp PerformCheckUpdateSync: 319] CheckUpdate Res:2-strRes:..[2024-12-28 14:08:40.629] [info] [6556] [xzupdatemodule.cpp PerformCheckUpdateSync: 330] updatecheck fail..[2024-12-28 21:34:52.918] [info] [6460] [xzupdatemodule.cpp PerformCheckUpdateSync: 316] CheckUpdate getstart..[2024-12-28 22:36:02.350] [error] [6460] [mmcurl.cpp Get: 128]

C:\Users\user\Desktop\flashcenter_pp_ax_install_cn.exe.lnk

Process:	C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Dec 26 21:02:04 2024, mtime=Thu Dec 26 21:02:04 2024, atime=Sat Nov 23 08:44:47 2024, length=6678240, window=hide
Category:	dropped
Size (bytes):	1141
Entropy (8bit):	4.67881657414848
Encrypted:	false
SSDEEP:	12:8Gvwu1SUYRiCECHqXJHx/XVACmqXsHcdT+8KVElljA6X8ZpGNKVEl0avj1b1K+4C:8Mwi5sss8w8K+jA4RK+/vj1b1Kiqygm
MD5:	EC3A4057342FC37399E9FD4FC2802004
SHA1:	9105744EF3F906BC190790E1A9FFFAF768D2B17C
SHA-256:	62F9162E0A44750F2C8A808928CF412130604550C47E6C55D09CA47671FE2DD1
SHA-512:	6157C89A01A580F95CA71B3D9579B4694B1E04B65B5EF1AE84CEA3D020CB3E9B8E55FF8BC6479D42F94E701F6801FAFB23D3CD5447E59645F0EFDDFDF1B27BF2
Malicious:	false
Preview:	L..................F.... ....GR..W..b.j..W....cU.=....e..........................P.O. .:i.....+00.../C:\...................x.1.....DW(m..Users.d......OwH.Y@.....................:.....NvM.U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....\|.1......YA...Public..f......O.I.YC.....+...............<.......T.P.u.b.l.i.c...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.6.....T.1......YC...Bilite..>......YA..YC..... ......................{..B.i.l.i.t.e.......2...e.wY.M .FLASHC~1.EXE..r......YC..YC.....).....................$.N.f.l.a.s.h.c.e.n.t.e.r._.p.p._.a.x._.i.n.s.t.a.l.l._.c.n...e.x.e.......f...............-.......e..................C:\Users\Public\Bilite\flashcenter_pp_ax_install_cn.exe..4.....\.....\.P.u.b.l.i.c.\.B.i.l.i.t.e.\.f.l.a.s.h.c.e.n.t.e.r._.p.p._.a.x._.i.n.s.t.a.l.l._.c.n...e.x.e..........v..*.cM.jVD.Es.!...`.......X.......128757...........hT..CrF.f4... .r{2=.b...,...W..hT..CrF.f4... .r{2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.999911659386662
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	CnjMEmbChO.exe
File size:	23'595'283 bytes
MD5:	6b64f2cd11ec2223c9818e0f752c649e
SHA1:	99948f90acbcf025a4462f1fe49c2f6f75817fbb
SHA256:	b43c39baeb60972d82f592e681f4d20aac4c4063676f34d43b10cda806d08ac6
SHA512:	303338334002d22305630daea16469ed88b16a69e272f391a4c92b2353a798cb3f477f79a500a36629b1c41abcf68e0d118a72b9d5b91153a9663db0e55464a3
SSDEEP:	393216:JpGdaDB9jrufnkq4MZdNHCRIKo6HQcRudv0SO2iywSQLGfVfSWun8L:XFDB9jCfnTXHCSKhHQFWSO29QsfF1
TLSH:	4D373350B51352BCC78C9C3C6F5DE546A2EDAF67032A0E3B67E435ABF98068F024D466
File Content Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...~.&L.....................N...............0....@..........................................................................P.............................

File Icon


Icon Hash:	878fd7f3b9353593

Static PE Info

General

Entrypoint:	0x411def
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x4C26F87E [Sun Jun 27 07:06:38 2010 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b5a014d7eeb4c2042897567e1288a095

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 00414C50h
push 00411F80h
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 68h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
xor ebx, ebx
mov dword ptr [ebp-04h], ebx
push 00000002h
call dword ptr [00413184h]
pop ecx
or dword ptr [00419924h], FFFFFFFFh
or dword ptr [00419928h], FFFFFFFFh
call dword ptr [00413188h]
mov ecx, dword ptr [0041791Ch]
mov dword ptr [eax], ecx
call dword ptr [0041318Ch]
mov ecx, dword ptr [00417918h]
mov dword ptr [eax], ecx
mov eax, dword ptr [00413190h]
mov eax, dword ptr [eax]
mov dword ptr [00419920h], eax
call 00007FD7085309F2h
cmp dword ptr [00417710h], ebx
jne 00007FD7085308DEh
push 00411F78h
call dword ptr [00413194h]
pop ecx
call 00007FD7085309C4h
push 00417048h
push 00417044h
call 00007FD7085309AFh
mov eax, dword ptr [00417914h]
mov dword ptr [ebp-6Ch], eax
lea eax, dword ptr [ebp-6Ch]
push eax
push dword ptr [00417910h]
lea eax, dword ptr [ebp-64h]
push eax
lea eax, dword ptr [ebp-70h]
push eax
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [0041319Ch]
push 00417040h
push 00417000h
call 00007FD70853097Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x150dc	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1a000	0x13c0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x13000	0x310	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x11317	0x11400	797279c5ab1a163aed1f2a528f9fe3ce	False	0.6174988677536232	data	6.576987441854239	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x13000	0x30ea	0x3200	1359639b02bcb8f0a8743e6ead1c0030	False	0.43828125	data	5.549434098115495	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x17000	0x292c	0x800	9415c9c8dea3245d6d73c23393e27d8e	False	0.431640625	data	3.6583182363171756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1a000	0x13c0	0x1400	5293a0fb2c46166ce21247d17e837639	False	0.3568359375	data	4.96958597460067	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x1a250	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.3709677419354839
RT_ICON	0x1a538	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.6081081081081081
RT_MENU	0x1a660	0x4a	data	English	United States	0.8648648648648649
RT_DIALOG	0x1a6ac	0xf2	data	English	United States	0.7148760330578512
RT_STRING	0x1a7a0	0x40	data	English	United States	0.59375
RT_GROUP_ICON	0x1a7e0	0x22	data	English	United States	1.0
RT_VERSION	0x1a804	0x314	data	English	United States	0.44416243654822335
RT_MANIFEST	0x1ab18	0x60f	XML 1.0 document, ASCII text, with CRLF line terminators			0.4229529335912315
RT_MANIFEST	0x1b128	0x298	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4894578313253012

Imports

DLL	Import
COMCTL32.dll
KERNEL32.dll	GetFileAttributesW, CreateDirectoryW, WriteFile, GetStdHandle, VirtualFree, GetModuleHandleW, GetProcAddress, LoadLibraryA, LockResource, LoadResource, SizeofResource, FindResourceExA, MulDiv, GlobalFree, GlobalAlloc, lstrcmpiA, GetSystemDefaultLCID, GetSystemDefaultUILanguage, GetUserDefaultUILanguage, MultiByteToWideChar, GetLocaleInfoW, lstrlenA, lstrcmpiW, GetEnvironmentVariableW, lstrcmpW, GlobalMemoryStatusEx, VirtualAlloc, WideCharToMultiByte, ExpandEnvironmentStringsW, RemoveDirectoryW, FindClose, FindNextFileW, DeleteFileW, FindFirstFileW, SetThreadLocale, GetLocalTime, GetSystemTimeAsFileTime, lstrlenW, GetTempPathW, SetEnvironmentVariableW, CloseHandle, CreateFileW, GetDriveTypeW, SetCurrentDirectoryW, GetModuleFileNameW, GetCommandLineW, GetVersionExW, CreateEventW, SetEvent, ResetEvent, InitializeCriticalSection, TerminateThread, ResumeThread, SuspendThread, IsBadReadPtr, LocalFree, lstrcpyW, FormatMessageW, GetSystemDirectoryW, DeleteCriticalSection, GetFileSize, SetFilePointer, ReadFile, SetFileTime, SetEndOfFile, EnterCriticalSection, LeaveCriticalSection, WaitForMultipleObjects, GetModuleHandleA, SystemTimeToFileTime, GetLastError, CreateThread, WaitForSingleObject, GetExitCodeThread, Sleep, SetLastError, SetFileAttributesW, GetDiskFreeSpaceExW, lstrcatW, ExitProcess, CompareFileTime, GetStartupInfoA
USER32.dll	CharUpperW, EndDialog, DestroyWindow, KillTimer, ReleaseDC, DispatchMessageW, GetMessageW, SetTimer, CreateWindowExW, ScreenToClient, GetWindowRect, wsprintfW, GetParent, GetSystemMenu, EnableMenuItem, EnableWindow, MessageBeep, LoadIconW, LoadImageW, wvsprintfW, IsWindow, DefWindowProcW, CallWindowProcW, DrawIconEx, DialogBoxIndirectParamW, GetWindow, ClientToScreen, GetDC, DrawTextW, ShowWindow, SystemParametersInfoW, SetFocus, SetWindowLongW, GetSystemMetrics, GetClientRect, GetDlgItem, GetKeyState, MessageBoxA, wsprintfA, SetWindowTextW, GetSysColor, GetWindowTextLengthW, GetWindowTextW, GetClassNameA, GetWindowLongW, GetMenu, SetWindowPos, CopyImage, SendMessageW, GetWindowDC
GDI32.dll	GetCurrentObject, StretchBlt, SetStretchBltMode, CreateCompatibleBitmap, SelectObject, CreateCompatibleDC, GetObjectW, GetDeviceCaps, DeleteObject, CreateFontIndirectW, DeleteDC
SHELL32.dll	SHGetFileInfoW, SHBrowseForFolderW, SHGetPathFromIDListW, SHGetMalloc, ShellExecuteExW, SHGetSpecialFolderPathW, ShellExecuteW
ole32.dll	CoInitialize, CreateStreamOnHGlobal, CoCreateInstance
OLEAUT32.dll	VariantClear, OleLoadPicture, SysAllocString
MSVCRT.dll	__set_app_type, __p__fmode, __p__commode, _adjust_fdiv, __setusermatherr, _initterm, __getmainargs, _acmdln, exit, _XcptFilter, _exit, ??1type_info@@UAE@XZ, _onexit, __dllonexit, _CxxThrowException, _beginthreadex, _EH_prolog, memset, _wcsnicmp, strncmp, malloc, memmove, _wtol, memcpy, free, memcmp, _purecall, ??2@YAPAXI@Z, ??3@YAXPAX@Z, _except_handler3, _controlfp

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	17:02:01
Start date:	26/12/2024
Path:	C:\Users\user\Desktop\CnjMEmbChO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\CnjMEmbChO.exe"
Imagebase:	0x400000
File size:	23'595'283 bytes
MD5 hash:	6B64F2CD11EC2223C9818E0F752C649E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	17:02:05
Start date:	26/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c start C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	17:02:05
Start date:	26/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	17:02:05
Start date:	26/12/2024
Path:	C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Bilite\Axialis\RuntimeBrokers.exe
Imagebase:	0xf50000
File size:	777'816 bytes
MD5 hash:	30A274E00DA842B09E9763F19777ADED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 4%, ReversingLabs
Reputation:	low
Has exited:	false