Edit tour

Windows Analysis Report
7DpzcPcsTS.exe

Overview

General Information

Sample name:	7DpzcPcsTS.exe renamed because original name is a hash value
Original sample name:	e26b0860871046c78f03c38d50b4208dab3478c2decfd616ec8fcc4ed9986602.exe
Analysis ID:	1587620
MD5:	26c7aa73526769f273ed73844e684cd9
SHA1:	538b444037fd8f77af00200e826a5e4aab917015
SHA256:	e26b0860871046c78f03c38d50b4208dab3478c2decfd616ec8fcc4ed9986602
Tags:	exeuser-adrian__luca
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

7DpzcPcsTS.exe (PID: 2736 cmdline: "C:\Users\user\Desktop\7DpzcPcsTS.exe" MD5: 26C7AA73526769F273ED73844E684CD9)

powershell.exe (PID: 2884 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\7DpzcPcsTS.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 5636 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 5712 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

7DpzcPcsTS.exe (PID: 6592 cmdline: "C:\Users\user\Desktop\7DpzcPcsTS.exe" MD5: 26C7AA73526769F273ED73844E684CD9)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.privateemail.com", "Username": "info@bondamit.shop", "Password": "payment1759"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.2710083020.00000000029CC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.2708102365.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2708102365.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.2710083020.00000000029A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2710083020.00000000029A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1485605622.00000000041E9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1485605622.00000000041E9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: 7DpzcPcsTS.exe PID: 2736	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 7DpzcPcsTS.exe PID: 2736	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 7DpzcPcsTS.exe PID: 2736	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: 7DpzcPcsTS.exe PID: 6592	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 7DpzcPcsTS.exe PID: 6592	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.7DpzcPcsTS.exe.423b410.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.7DpzcPcsTS.exe.423b410.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.7DpzcPcsTS.exe.423b410.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31695:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31707:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31791:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31823:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3188d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x318ff:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31995:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a25:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.7DpzcPcsTS.exe.42009f0.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.7DpzcPcsTS.exe.42009f0.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.7DpzcPcsTS.exe.42009f0.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31695:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31707:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31791:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31823:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3188d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x318ff:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31995:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a25:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
4.2.7DpzcPcsTS.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.7DpzcPcsTS.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.7DpzcPcsTS.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33495:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33507:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33591:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33623:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3368d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x336ff:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33795:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33825:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.7DpzcPcsTS.exe.423b410.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.7DpzcPcsTS.exe.423b410.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.7DpzcPcsTS.exe.423b410.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.7DpzcPcsTS.exe.423b410.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33495:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6dcb5:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33507:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6dd27:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33591:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6ddb1:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33623:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6de43:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3368d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6dead:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x336ff:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6df1f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33795:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6dfb5:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33825:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e045:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.7DpzcPcsTS.exe.42009f0.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.7DpzcPcsTS.exe.42009f0.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.7DpzcPcsTS.exe.42009f0.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.7DpzcPcsTS.exe.42009f0.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33495:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6deb5:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa86d5:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33507:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6df27:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa8747:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33591:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6dfb1:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa87d1:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33623:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e043:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa8863:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3368d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e0ad:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa88cd:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x336ff:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e11f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa893f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33795:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e1b5:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa89d5:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 12 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\7DpzcPcsTS.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\7DpzcPcsTS.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\7DpzcPcsTS.exe", ParentImage: C:\Users\user\Desktop\7DpzcPcsTS.exe, ParentProcessId: 2736, ParentProcessName: 7DpzcPcsTS.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\7DpzcPcsTS.exe", ProcessId: 2884, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 66.29.159.53, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\7DpzcPcsTS.exe, Initiated: true, ProcessId: 6592, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49708

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\7DpzcPcsTS.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\7DpzcPcsTS.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\7DpzcPcsTS.exe", ParentImage: C:\Users\user\Desktop\7DpzcPcsTS.exe, ParentProcessId: 2736, ParentProcessName: 7DpzcPcsTS.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\7DpzcPcsTS.exe", ProcessId: 2884, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 4.2.7DpzcPcsTS.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.privateemail.com", "Username": "info@bondamit.shop", "Password": "payment1759"}

Multi AV Scanner detection for submitted file

Source: 7DpzcPcsTS.exe	Virustotal: Detection: 54%			Perma Link
Source: 7DpzcPcsTS.exe	ReversingLabs: Detection: 86%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 7DpzcPcsTS.exe

Joe Sandbox ML: detected

Source: 7DpzcPcsTS.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.8:49706 version: TLS 1.2

Source: 7DpzcPcsTS.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: FcLw.pdb source: 7DpzcPcsTS.exe
Source:	Binary string: FcLw.pdbSHA2561 source: 7DpzcPcsTS.exe

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.7DpzcPcsTS.exe.423b410.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7DpzcPcsTS.exe.42009f0.4.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.8:49708 -> 66.29.159.53:587

Source: Joe Sandbox View	IP Address: 66.29.159.53 66.29.159.53
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

ASN Name: ADVANTAGECOMUS ADVANTAGECOMUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.8:49708 -> 66.29.159.53:587

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: smtp.privateemail.com

Source: 7DpzcPcsTS.exe, 00000004.00000002.2708459949.0000000000C15000.00000004.00000020.00020000.00000000.sdmp, 7DpzcPcsTS.exe, 00000004.00000002.2710083020.00000000029D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: 7DpzcPcsTS.exe, 00000004.00000002.2708459949.0000000000C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: 7DpzcPcsTS.exe, 00000004.00000002.2708459949.0000000000C36000.00000004.00000020.00020000.00000000.sdmp, 7DpzcPcsTS.exe, 00000004.00000002.2710083020.00000000029D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#
Source: 7DpzcPcsTS.exe, 00000004.00000002.2708459949.0000000000C15000.00000004.00000020.00020000.00000000.sdmp, 7DpzcPcsTS.exe, 00000004.00000002.2710083020.00000000029D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: 7DpzcPcsTS.exe, 00000004.00000002.2708459949.0000000000C36000.00000004.00000020.00020000.00000000.sdmp, 7DpzcPcsTS.exe, 00000004.00000002.2710083020.00000000029D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: 7DpzcPcsTS.exe, 00000000.00000002.1483480261.0000000003214000.00000004.00000800.00020000.00000000.sdmp, 7DpzcPcsTS.exe, 00000004.00000002.2710083020.0000000002951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 7DpzcPcsTS.exe, 00000004.00000002.2710083020.00000000029CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://smtp.privateemail.com
Source: 7DpzcPcsTS.exe	String found in binary or memory: http://tempuri.org/DataSet1.xsdQdelete
Source: 7DpzcPcsTS.exe, 00000000.00000002.1485605622.00000000041E9000.00000004.00000800.00020000.00000000.sdmp, 7DpzcPcsTS.exe, 00000004.00000002.2708102365.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: 7DpzcPcsTS.exe, 00000000.00000002.1485605622.00000000041E9000.00000004.00000800.00020000.00000000.sdmp, 7DpzcPcsTS.exe, 00000004.00000002.2710083020.0000000002951000.00000004.00000800.00020000.00000000.sdmp, 7DpzcPcsTS.exe, 00000004.00000002.2708102365.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: 7DpzcPcsTS.exe, 00000004.00000002.2710083020.0000000002951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: 7DpzcPcsTS.exe, 00000004.00000002.2710083020.0000000002951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: 7DpzcPcsTS.exe, 00000004.00000002.2708459949.0000000000C36000.00000004.00000020.00020000.00000000.sdmp, 7DpzcPcsTS.exe, 00000004.00000002.2710083020.00000000029D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.8:49706 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.7DpzcPcsTS.exe.423b410.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.7DpzcPcsTS.exe.42009f0.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.7DpzcPcsTS.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.7DpzcPcsTS.exe.423b410.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.7DpzcPcsTS.exe.42009f0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Code function: 0_2_017CD5BC	0_2_017CD5BC
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Code function: 0_2_0915C920	0_2_0915C920
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Code function: 0_2_091584E8	0_2_091584E8
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Code function: 0_2_0915F938	0_2_0915F938
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Code function: 0_2_0915F4FA	0_2_0915F4FA
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Code function: 4_2_0282E2C1	4_2_0282E2C1
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Code function: 4_2_02824AA0	4_2_02824AA0
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Code function: 4_2_0282AA27	4_2_0282AA27
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Code function: 4_2_02823E88	4_2_02823E88
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Code function: 4_2_028241D0	4_2_028241D0
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Code function: 4_2_0663A494	4_2_0663A494
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Code function: 4_2_0663A178	4_2_0663A178
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Code function: 4_2_0663BA00	4_2_0663BA00
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Code function: 4_2_0663D810	4_2_0663D810
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Code function: 4_2_06646678	4_2_06646678
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Code function: 4_2_06645630	4_2_06645630
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Code function: 4_2_0664C220	4_2_0664C220
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Code function: 4_2_0664B2BA	4_2_0664B2BA
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Code function: 4_2_066430F8	4_2_066430F8
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Code function: 4_2_06647E08	4_2_06647E08
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Code function: 4_2_06647728	4_2_06647728
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Code function: 4_2_0664E448	4_2_0664E448
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Code function: 4_2_06640040	4_2_06640040
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Code function: 4_2_06640006	4_2_06640006
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Code function: 4_2_06645D67	4_2_06645D67

Source: 7DpzcPcsTS.exe, 00000000.00000002.1481735938.000000000122E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 7DpzcPcsTS.exe
Source: 7DpzcPcsTS.exe, 00000000.00000000.1450618222.0000000000CD2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFcLw.exe8 vs 7DpzcPcsTS.exe
Source: 7DpzcPcsTS.exe, 00000000.00000002.1483480261.0000000003214000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamebb26f961-fadf-4425-9082-cde080536011.exe4 vs 7DpzcPcsTS.exe
Source: 7DpzcPcsTS.exe, 00000000.00000002.1485605622.00000000041E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamebb26f961-fadf-4425-9082-cde080536011.exe4 vs 7DpzcPcsTS.exe
Source: 7DpzcPcsTS.exe, 00000000.00000002.1485605622.00000000041E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs 7DpzcPcsTS.exe
Source: 7DpzcPcsTS.exe, 00000000.00000002.1488936450.0000000007B00000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs 7DpzcPcsTS.exe
Source: 7DpzcPcsTS.exe, 00000004.00000002.2708102365.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamebb26f961-fadf-4425-9082-cde080536011.exe4 vs 7DpzcPcsTS.exe
Source: 7DpzcPcsTS.exe, 00000004.00000002.2708398926.0000000000B39000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs 7DpzcPcsTS.exe
Source: 7DpzcPcsTS.exe	Binary or memory string: OriginalFilenameFcLw.exe8 vs 7DpzcPcsTS.exe

Source: 7DpzcPcsTS.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.7DpzcPcsTS.exe.423b410.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.7DpzcPcsTS.exe.42009f0.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.7DpzcPcsTS.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.7DpzcPcsTS.exe.423b410.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.7DpzcPcsTS.exe.42009f0.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: 7DpzcPcsTS.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/6@2/2

Source: C:\Users\user\Desktop\7DpzcPcsTS.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\7DpzcPcsTS.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5636:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3a51dgjt.apm.ps1

Jump to behavior

Source: 7DpzcPcsTS.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 7DpzcPcsTS.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\7DpzcPcsTS.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\7DpzcPcsTS.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 7DpzcPcsTS.exe	Virustotal: Detection: 54%
Source: 7DpzcPcsTS.exe	ReversingLabs: Detection: 86%

Source: 7DpzcPcsTS.exe	String found in binary or memory: -Add Fertilizer Details
Source: 7DpzcPcsTS.exe	String found in binary or memory: /Add Transaction Details!Transaction Name!Transaction Type/Transaction Description

Source: unknown	Process created: C:\Users\user\Desktop\7DpzcPcsTS.exe "C:\Users\user\Desktop\7DpzcPcsTS.exe"
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\7DpzcPcsTS.exe"
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process created: C:\Users\user\Desktop\7DpzcPcsTS.exe "C:\Users\user\Desktop\7DpzcPcsTS.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\7DpzcPcsTS.exe"	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process created: C:\Users\user\Desktop\7DpzcPcsTS.exe "C:\Users\user\Desktop\7DpzcPcsTS.exe"	Jump to behavior

Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\7DpzcPcsTS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\7DpzcPcsTS.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\7DpzcPcsTS.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: 7DpzcPcsTS.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 7DpzcPcsTS.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: 7DpzcPcsTS.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: FcLw.pdb source: 7DpzcPcsTS.exe
Source:	Binary string: FcLw.pdbSHA2561 source: 7DpzcPcsTS.exe

Source: 7DpzcPcsTS.exe

Static PE information: 0xECEC1038 [Fri Dec 16 17:07:04 2095 UTC]

Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Code function: 4_2_02820C6D push edi; retf		4_2_02820C7A
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Code function: 4_2_0663FBCD push es; iretd		4_2_0663FBDC

Source: 7DpzcPcsTS.exe

Static PE information: section name: .text entropy: 7.542312672926484

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior

Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: 7DpzcPcsTS.exe PID: 2736, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\7DpzcPcsTS.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Memory allocated: 1720000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Memory allocated: 31E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Memory allocated: 1720000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Memory allocated: 9160000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Memory allocated: A160000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Memory allocated: A360000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Memory allocated: B360000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Memory allocated: 2790000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Memory allocated: 2950000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Memory allocated: 4950000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7684	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2046	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Window / User API: threadDelayed 1373	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Window / User API: threadDelayed 2610	Jump to behavior

Source: C:\Users\user\Desktop\7DpzcPcsTS.exe TID: 4840	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5588	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe TID: 2112	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe TID: 2112	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe TID: 792	Thread sleep count: 1373 > 30	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe TID: 2112	Thread sleep time: -99874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe TID: 792	Thread sleep count: 2610 > 30	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe TID: 2112	Thread sleep time: -99765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe TID: 2112	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe TID: 2112	Thread sleep time: -99547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe TID: 2112	Thread sleep time: -99438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe TID: 2112	Thread sleep time: -99313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe TID: 2112	Thread sleep time: -99200s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe TID: 2112	Thread sleep time: -99078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe TID: 2112	Thread sleep time: -98969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe TID: 2112	Thread sleep time: -98859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe TID: 2112	Thread sleep time: -98750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe TID: 2112	Thread sleep time: -98641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe TID: 2112	Thread sleep time: -98516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe TID: 2112	Thread sleep time: -98391s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe TID: 2112	Thread sleep time: -98281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe TID: 2112	Thread sleep time: -98166s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe TID: 2112	Thread sleep time: -98040s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe TID: 2112	Thread sleep time: -97922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe TID: 2112	Thread sleep time: -97813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe TID: 2112	Thread sleep time: -97690s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe TID: 2112	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\7DpzcPcsTS.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\7DpzcPcsTS.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Thread delayed: delay time: 99874	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Thread delayed: delay time: 99438	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Thread delayed: delay time: 99313	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Thread delayed: delay time: 99200	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Thread delayed: delay time: 99078	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Thread delayed: delay time: 98969	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Thread delayed: delay time: 98859	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Thread delayed: delay time: 98750	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Thread delayed: delay time: 98641	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Thread delayed: delay time: 98516	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Thread delayed: delay time: 98391	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Thread delayed: delay time: 98281	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Thread delayed: delay time: 98166	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Thread delayed: delay time: 98040	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Thread delayed: delay time: 97922	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Thread delayed: delay time: 97813	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Thread delayed: delay time: 97690	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: 7DpzcPcsTS.exe, 00000000.00000002.1485605622.00000000041E9000.00000004.00000800.00020000.00000000.sdmp, 7DpzcPcsTS.exe, 00000004.00000002.2708102365.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: hgfsZrw6
Source: 7DpzcPcsTS.exe, 00000004.00000002.2708459949.0000000000C36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\7DpzcPcsTS.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\7DpzcPcsTS.exe"
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\7DpzcPcsTS.exe"			Jump to behavior

Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\7DpzcPcsTS.exe"			Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Process created: C:\Users\user\Desktop\7DpzcPcsTS.exe "C:\Users\user\Desktop\7DpzcPcsTS.exe"			Jump to behavior

Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Queries volume information: C:\Users\user\Desktop\7DpzcPcsTS.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Queries volume information: C:\Users\user\Desktop\7DpzcPcsTS.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\7DpzcPcsTS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.7DpzcPcsTS.exe.423b410.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7DpzcPcsTS.exe.42009f0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.7DpzcPcsTS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7DpzcPcsTS.exe.423b410.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7DpzcPcsTS.exe.42009f0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2710083020.00000000029CC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2708102365.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2710083020.00000000029A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1485605622.00000000041E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7DpzcPcsTS.exe PID: 2736, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7DpzcPcsTS.exe PID: 6592, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\7DpzcPcsTS.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\7DpzcPcsTS.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\7DpzcPcsTS.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.7DpzcPcsTS.exe.423b410.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7DpzcPcsTS.exe.42009f0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.7DpzcPcsTS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7DpzcPcsTS.exe.423b410.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7DpzcPcsTS.exe.42009f0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2708102365.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2710083020.00000000029A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1485605622.00000000041E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7DpzcPcsTS.exe PID: 2736, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7DpzcPcsTS.exe PID: 6592, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.7DpzcPcsTS.exe.423b410.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7DpzcPcsTS.exe.42009f0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.7DpzcPcsTS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7DpzcPcsTS.exe.423b410.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7DpzcPcsTS.exe.42009f0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2710083020.00000000029CC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2708102365.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2710083020.00000000029A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1485605622.00000000041E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7DpzcPcsTS.exe PID: 2736, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7DpzcPcsTS.exe PID: 6592, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	2 Obfuscated Files or Information	1 Credentials in Registry	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Software Packing	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Timestomp	NTDS	111 Security Software Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
7DpzcPcsTS.exe	55%	Virustotal		Browse
7DpzcPcsTS.exe	87%	ReversingLabs	ByteCode-MSIL.Trojan.Remcos
7DpzcPcsTS.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://smtp.privateemail.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	172.67.74.152	true	false		high
smtp.privateemail.com	66.29.159.53	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	7DpzcPcsTS.exe, 00000004.00000002.2708459949.0000000000C36000.00000004.00000020.00020000.00000000.sdmp, 7DpzcPcsTS.exe, 00000004.00000002.2710083020.00000000029D4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ipify.org	7DpzcPcsTS.exe, 00000000.00000002.1485605622.00000000041E9000.00000004.00000800.00020000.00000000.sdmp, 7DpzcPcsTS.exe, 00000004.00000002.2710083020.0000000002951000.00000004.00000800.00020000.00000000.sdmp, 7DpzcPcsTS.exe, 00000004.00000002.2708102365.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	7DpzcPcsTS.exe, 00000004.00000002.2708459949.0000000000C36000.00000004.00000020.00020000.00000000.sdmp, 7DpzcPcsTS.exe, 00000004.00000002.2710083020.00000000029D4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://account.dyn.com/	7DpzcPcsTS.exe, 00000000.00000002.1485605622.00000000041E9000.00000004.00000800.00020000.00000000.sdmp, 7DpzcPcsTS.exe, 00000004.00000002.2708102365.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	7DpzcPcsTS.exe, 00000004.00000002.2708459949.0000000000C36000.00000004.00000020.00020000.00000000.sdmp, 7DpzcPcsTS.exe, 00000004.00000002.2710083020.00000000029D4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ipify.org/t	7DpzcPcsTS.exe, 00000004.00000002.2710083020.0000000002951000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	7DpzcPcsTS.exe, 00000000.00000002.1483480261.0000000003214000.00000004.00000800.00020000.00000000.sdmp, 7DpzcPcsTS.exe, 00000004.00000002.2710083020.0000000002951000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/DataSet1.xsdQdelete	7DpzcPcsTS.exe	false		high
http://smtp.privateemail.com	7DpzcPcsTS.exe, 00000004.00000002.2710083020.00000000029CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
66.29.159.53	smtp.privateemail.com	United States		19538	ADVANTAGECOMUS	true
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587620
Start date and time:	2025-01-10 15:52:33 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	7DpzcPcsTS.exe renamed because original name is a hash value
Original Sample Name:	e26b0860871046c78f03c38d50b4208dab3478c2decfd616ec8fcc4ed9986602.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/6@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 75 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.23.242.162, 20.109.210.53, 13.107.246.45
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:53:33	API Interceptor	23x Sleep call for process: 7DpzcPcsTS.exe modified
09:53:36	API Interceptor	18x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
66.29.159.53	C2jr42FUsv.exe	Get hash	malicious	AgentTesla	Browse
	DB_DHL_AWB_001833022AD.exe	Get hash	malicious	AgentTesla	Browse
	Remittance Receipt.exe	Get hash	malicious	AgentTesla	Browse
	Payment Slip.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	HSBC Payment Advice_pdf.exe	Get hash	malicious	AgentTesla	Browse
	Payment List.bat.exe	Get hash	malicious	AgentTesla	Browse
	INQUIRY RE44535_pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Texas_Tool_Purchase_Order#T18834-1.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse
	Swift_Message#1234323456.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse
	e-dekont_swift-details.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse
172.67.74.152	jgbC220X2U.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=text
	malware.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	api.ipify.org/
	Simple1.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Simple2.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	systemConfigChecker.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	systemConfigChecker.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Zc9eO57fgF.elf	Get hash	malicious	Unknown	Browse	api.ipify.org/
	67065b4c84713_Javiles.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
smtp.privateemail.com	C2jr42FUsv.exe	Get hash	malicious	AgentTesla	Browse	66.29.159.53
	DB_DHL_AWB_001833022AD.exe	Get hash	malicious	AgentTesla	Browse	66.29.159.53
	Remittance Receipt.exe	Get hash	malicious	AgentTesla	Browse	66.29.159.53
	Payment Slip.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	66.29.159.53
	HSBC Payment Advice_pdf.exe	Get hash	malicious	AgentTesla	Browse	66.29.159.53
	Payment List.bat.exe	Get hash	malicious	AgentTesla	Browse	66.29.159.53
	INQUIRY RE44535_pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	66.29.159.53
	Texas_Tool_Purchase_Order#T18834-1.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	66.29.159.53
	Swift_Message#1234323456.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	66.29.159.53
	e-dekont_swift-details.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	66.29.159.53
api.ipify.org	B8FnDUj8hy.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	FSRHC6mB16.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	9pIm5d0rsW.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	104.26.13.205
	VYLigyTDuW.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	gem1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	https://www.tremendous.com/email/activate/yE_yBdRtyVv4Xqgg7hu_	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://marcuso-wq.github.io/home/	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	drop1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	https://vq6btbhdpo.nutignaera.shop/?email=YWxlamFuZHJvLmdhcnJpZG9Ac2VhYm9hcmRtYXJpbmUuY29t	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	104.26.12.205
	EZZGTmJj4O.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ADVANTAGECOMUS	DHL-DOC83972025-1.exe	Get hash	malicious	FormBook	Browse	66.29.149.46
	KSts9xW7qy.exe	Get hash	malicious	FormBook	Browse	66.29.132.194
	BP-50C26_20241220_082241.exe	Get hash	malicious	FormBook	Browse	66.29.149.46
	https://universidad-unidem.edu.mx/mah/i/amFjb2JAc3RlaW5ib3JuLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	66.29.153.55
	rDHL8350232025-2.exe	Get hash	malicious	FormBook	Browse	66.29.149.46
	DHL 8350232025-1.exe	Get hash	malicious	FormBook	Browse	66.29.149.46
	DHL 745-12302024.exe	Get hash	malicious	FormBook	Browse	66.29.149.46
	DHL 806-232024.exe	Get hash	malicious	FormBook	Browse	66.29.149.46
	DHL 0737-12182024.exe	Get hash	malicious	FormBook	Browse	66.29.149.46
	DHL 073412182024.exe	Get hash	malicious	FormBook	Browse	66.29.149.46
CLOUDFLARENETUS	B8FnDUj8hy.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	B3aqD8srjF.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	FSRHC6mB16.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	9pIm5d0rsW.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	104.26.13.205
	B7N48hmO78.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	VIAmJUhQ54.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.80.1
	VYLigyTDuW.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	bd9Gvqt6AK.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.80.1
	PO-0005082025 pdf.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	172.67.131.144
	zrNcqxZRSM.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	B8FnDUj8hy.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	FSRHC6mB16.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	9pIm5d0rsW.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	172.67.74.152
	B7N48hmO78.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.74.152
	VIAmJUhQ54.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.74.152
	VYLigyTDuW.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	QUOTATION-9044456778.pdf (83kb).com.exe	Get hash	malicious	PureLog Stealer, Quasar	Browse	172.67.74.152
	PO#17971.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	172.67.74.152
	https://sign.zoho.com/zsguest?locale=en&sign_id=234b4d535f4956237c699124bb06f6840075804affff79070f72fbd27ec4885c3a2ba06657b8a52338eb80052baee9f74c4e2e0e7f85c073df939f1ac4dff75f76c95d46ac2361c7b14335e4f12c5c5d49c49b1d2f4c838a&action_type=SIGN	Get hash	malicious	Unknown	Browse	172.67.74.152

Process:	C:\Users\user\Desktop\7DpzcPcsTS.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.3785452578096224
Encrypted:	false
SSDEEP:	48:fWSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMuge//ZPUyufF:fLHyIFKL3IZ2KRH9OugbfF
MD5:	6E4605A73E70C5DECB26660C6B35DAC8
SHA1:	6EA7BCD64C17FC318F89E67E6863B52C82935D1B
SHA-256:	BCEB0C7AAD4BCE81AC03D5DA59372611CBDA984B197A20E03316E41DB421F005
SHA-512:	4D00C9D1725D18CB85DFBA5035666FFD85D9CF3C8CBB7958AB23E7D65C44240A6DF00F492105B5DA2F0E7DF5992F3DF21D9F1BA24922EDEEFA6AFC889042DA3F
Malicious:	false
Reputation:	low
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2ncfo4yi.mb4.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3a51dgjt.apm.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lbnuvlib.pzf.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nmhcjyuv.di5.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.53679494624098
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	7DpzcPcsTS.exe
File size:	826'368 bytes
MD5:	26c7aa73526769f273ed73844e684cd9
SHA1:	538b444037fd8f77af00200e826a5e4aab917015
SHA256:	e26b0860871046c78f03c38d50b4208dab3478c2decfd616ec8fcc4ed9986602
SHA512:	a82f36d8b5b7f9fbe20cc599d01520d7299c452d287141b472d796c849db8faba85dace4c9f50dbc697b17cd5d93f02a73db5cec43aed12452c260cbd356d929
SSDEEP:	12288:PNaaJeMNR5mHZCbvlIYihHbnLR1qQ9x5/sdmlx+BVimE5Yp:kluUCRpgHbn5b5NWV5E5a
TLSH:	1B05BF146A548F53CA7487F57872E07013F85EAEA41EF2655EC17EEBB9A2F008950F83
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...8.................0..~............... ........@.. ....................................@................................

File Icon


Icon Hash:	4f4b4c4c4c4a239f

Static PE Info

General

Entrypoint:	0x4c9d96
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xECEC1038 [Fri Dec 16 17:07:04 2095 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc9d42	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xca000	0x1914	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xcc000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xc5d1c	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xc7d9c	0xc7e00	f90099b23ba3f9dc43dbf6a479953889	False	0.8110049249530957	data	7.542312672926484	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xca000	0x1914	0x1a00	58da8c773a504d8c33478f6d791ea553	False	0.7384314903846154	data	7.1529095290171645	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xcc000	0xc	0x200	80448a8162464f69bc13b537938c9788	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xca130	0x1255	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.8740677604943533
RT_GROUP_ICON	0xcb388	0x14	data	0.9
RT_VERSION	0xcb39c	0x38c	PGP symmetric key encrypted data - Plaintext or unencrypted data	0.42290748898678415
RT_MANIFEST	0xcb728	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 15:53:37.643431902 CET	49706	443	192.168.2.8	172.67.74.152
Jan 10, 2025 15:53:37.643476963 CET	443	49706	172.67.74.152	192.168.2.8
Jan 10, 2025 15:53:37.643659115 CET	49706	443	192.168.2.8	172.67.74.152
Jan 10, 2025 15:53:37.683270931 CET	49706	443	192.168.2.8	172.67.74.152
Jan 10, 2025 15:53:37.683285952 CET	443	49706	172.67.74.152	192.168.2.8
Jan 10, 2025 15:53:38.172660112 CET	443	49706	172.67.74.152	192.168.2.8
Jan 10, 2025 15:53:38.172904015 CET	49706	443	192.168.2.8	172.67.74.152
Jan 10, 2025 15:53:38.176680088 CET	49706	443	192.168.2.8	172.67.74.152
Jan 10, 2025 15:53:38.176707029 CET	443	49706	172.67.74.152	192.168.2.8
Jan 10, 2025 15:53:38.177078009 CET	443	49706	172.67.74.152	192.168.2.8
Jan 10, 2025 15:53:38.224668980 CET	49706	443	192.168.2.8	172.67.74.152
Jan 10, 2025 15:53:38.348572016 CET	49706	443	192.168.2.8	172.67.74.152
Jan 10, 2025 15:53:38.391330957 CET	443	49706	172.67.74.152	192.168.2.8
Jan 10, 2025 15:53:38.463576078 CET	443	49706	172.67.74.152	192.168.2.8
Jan 10, 2025 15:53:38.463639975 CET	443	49706	172.67.74.152	192.168.2.8
Jan 10, 2025 15:53:38.464274883 CET	49706	443	192.168.2.8	172.67.74.152
Jan 10, 2025 15:53:38.487199068 CET	49706	443	192.168.2.8	172.67.74.152
Jan 10, 2025 15:53:39.944082022 CET	49708	587	192.168.2.8	66.29.159.53
Jan 10, 2025 15:53:39.948909044 CET	587	49708	66.29.159.53	192.168.2.8
Jan 10, 2025 15:53:39.948971987 CET	49708	587	192.168.2.8	66.29.159.53
Jan 10, 2025 15:53:40.725533009 CET	587	49708	66.29.159.53	192.168.2.8
Jan 10, 2025 15:53:40.725850105 CET	49708	587	192.168.2.8	66.29.159.53
Jan 10, 2025 15:53:40.730686903 CET	587	49708	66.29.159.53	192.168.2.8
Jan 10, 2025 15:53:40.887244940 CET	587	49708	66.29.159.53	192.168.2.8
Jan 10, 2025 15:53:40.887427092 CET	49708	587	192.168.2.8	66.29.159.53
Jan 10, 2025 15:53:40.895304918 CET	587	49708	66.29.159.53	192.168.2.8
Jan 10, 2025 15:53:41.049264908 CET	587	49708	66.29.159.53	192.168.2.8
Jan 10, 2025 15:53:41.049789906 CET	49708	587	192.168.2.8	66.29.159.53
Jan 10, 2025 15:53:41.056091070 CET	587	49708	66.29.159.53	192.168.2.8
Jan 10, 2025 15:53:41.209187984 CET	587	49708	66.29.159.53	192.168.2.8
Jan 10, 2025 15:53:41.209208965 CET	587	49708	66.29.159.53	192.168.2.8
Jan 10, 2025 15:53:41.209220886 CET	587	49708	66.29.159.53	192.168.2.8
Jan 10, 2025 15:53:41.209232092 CET	587	49708	66.29.159.53	192.168.2.8
Jan 10, 2025 15:53:41.209245920 CET	587	49708	66.29.159.53	192.168.2.8
Jan 10, 2025 15:53:41.209265947 CET	49708	587	192.168.2.8	66.29.159.53
Jan 10, 2025 15:53:41.209319115 CET	49708	587	192.168.2.8	66.29.159.53
Jan 10, 2025 15:53:41.248248100 CET	49708	587	192.168.2.8	66.29.159.53
Jan 10, 2025 15:53:41.253019094 CET	587	49708	66.29.159.53	192.168.2.8
Jan 10, 2025 15:53:41.407022953 CET	587	49708	66.29.159.53	192.168.2.8
Jan 10, 2025 15:53:41.411427021 CET	49708	587	192.168.2.8	66.29.159.53
Jan 10, 2025 15:53:41.416260004 CET	587	49708	66.29.159.53	192.168.2.8
Jan 10, 2025 15:53:41.569399118 CET	587	49708	66.29.159.53	192.168.2.8
Jan 10, 2025 15:53:41.570607901 CET	49708	587	192.168.2.8	66.29.159.53
Jan 10, 2025 15:53:41.575458050 CET	587	49708	66.29.159.53	192.168.2.8
Jan 10, 2025 15:53:41.729285002 CET	587	49708	66.29.159.53	192.168.2.8
Jan 10, 2025 15:53:41.730891943 CET	49708	587	192.168.2.8	66.29.159.53
Jan 10, 2025 15:53:41.736326933 CET	587	49708	66.29.159.53	192.168.2.8
Jan 10, 2025 15:53:41.891336918 CET	587	49708	66.29.159.53	192.168.2.8
Jan 10, 2025 15:53:41.891643047 CET	49708	587	192.168.2.8	66.29.159.53
Jan 10, 2025 15:53:41.896473885 CET	587	49708	66.29.159.53	192.168.2.8
Jan 10, 2025 15:53:42.051870108 CET	587	49708	66.29.159.53	192.168.2.8
Jan 10, 2025 15:53:42.052098036 CET	49708	587	192.168.2.8	66.29.159.53
Jan 10, 2025 15:53:42.056881905 CET	587	49708	66.29.159.53	192.168.2.8
Jan 10, 2025 15:53:42.211827993 CET	587	49708	66.29.159.53	192.168.2.8
Jan 10, 2025 15:53:42.255968094 CET	49708	587	192.168.2.8	66.29.159.53
Jan 10, 2025 15:53:42.257952929 CET	49708	587	192.168.2.8	66.29.159.53
Jan 10, 2025 15:53:42.262973070 CET	587	49708	66.29.159.53	192.168.2.8
Jan 10, 2025 15:53:42.265307903 CET	49708	587	192.168.2.8	66.29.159.53

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 15:53:37.628823042 CET	57147	53	192.168.2.8	1.1.1.1
Jan 10, 2025 15:53:37.636075020 CET	53	57147	1.1.1.1	192.168.2.8
Jan 10, 2025 15:53:39.932980061 CET	65531	53	192.168.2.8	1.1.1.1
Jan 10, 2025 15:53:39.943351030 CET	53	65531	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 15:53:37.628823042 CET	192.168.2.8	1.1.1.1	0x22e1	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:53:39.932980061 CET	192.168.2.8	1.1.1.1	0x4b03	Standard query (0)	smtp.privateemail.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 15:53:37.636075020 CET	1.1.1.1	192.168.2.8	0x22e1	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:53:37.636075020 CET	1.1.1.1	192.168.2.8	0x22e1	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:53:37.636075020 CET	1.1.1.1	192.168.2.8	0x22e1	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:53:39.943351030 CET	1.1.1.1	192.168.2.8	0x4b03	No error (0)	smtp.privateemail.com	66.29.159.53	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	172.67.74.152	443	6592	C:\Users\user\Desktop\7DpzcPcsTS.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:53:38 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2025-01-10 14:53:38 UTC	424	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:53:38 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8ffd7f6afb907288-EWR server-timing: cfL4;desc="?proto=TCP&rtt=2104&min_rtt=2084&rtt_var=796&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2820&recv_bytes=769&delivery_rate=1401151&cwnd=245&unsent_bytes=0&cid=b39fe27f5735f236&ts=303&x=0"
2025-01-10 14:53:38 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jan 10, 2025 15:53:40.725533009 CET	587	49708	66.29.159.53	192.168.2.8	220 PrivateEmail.com prod Mail Node
Jan 10, 2025 15:53:40.725850105 CET	49708	587	192.168.2.8	66.29.159.53	EHLO 226533
Jan 10, 2025 15:53:40.887244940 CET	587	49708	66.29.159.53	192.168.2.8	250-mta-07.privateemail.com 250-PIPELINING 250-SIZE 81788928 250-ETRN 250-AUTH PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-CHUNKING 250 STARTTLS
Jan 10, 2025 15:53:40.887427092 CET	49708	587	192.168.2.8	66.29.159.53	STARTTLS
Jan 10, 2025 15:53:41.049264908 CET	587	49708	66.29.159.53	192.168.2.8	220 Ready to start TLS

Target ID:	0
Start time:	09:53:32
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\7DpzcPcsTS.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\7DpzcPcsTS.exe"
Imagebase:	0xcd0000
File size:	826'368 bytes
MD5 hash:	26C7AA73526769F273ED73844E684CD9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1485605622.00000000041E9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1485605622.00000000041E9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:53:35
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\7DpzcPcsTS.exe"
Imagebase:	0x580000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:53:35
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\7DpzcPcsTS.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\7DpzcPcsTS.exe"
Imagebase:	0x6d0000
File size:	826'368 bytes
MD5 hash:	26C7AA73526769F273ED73844E684CD9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.2710083020.00000000029CC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2708102365.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.2708102365.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2710083020.00000000029A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.2710083020.00000000029A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	09:53:35
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:53:37
Start date:	10/01/2025
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff605670000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	8.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	92
Total number of Limit Nodes:	4

Executed Functions

Function 091584E8 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1490194981.0000000009150000.00000040.00000800.00020000.00000000.sdmp, Offset: 09150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9150000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da8b1afc2802b02638e334e6fb705634fb7f3d74d2ba0b5ee6a1b19b450776be
Instruction ID: 09ca96f950066a99026049ed8968de00643323f3ee2a2ee629e7aa59620bd39d
Opcode Fuzzy Hash: da8b1afc2802b02638e334e6fb705634fb7f3d74d2ba0b5ee6a1b19b450776be
Instruction Fuzzy Hash: EED1A0B0F05255CFCB14CBA5C8506BEBBB1BF44309F5685AAE8A7EB281D734D841CB91

Function 0915C920 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1490194981.0000000009150000.00000040.00000800.00020000.00000000.sdmp, Offset: 09150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9150000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd353d6da248798f2e6f5598c8924c2ec32abe1760aab42df434ed76d7404548
Instruction ID: 152a74861235facf951c3d4ee09694c4d06061e9e75e95eefb4225635f986bfd
Opcode Fuzzy Hash: cd353d6da248798f2e6f5598c8924c2ec32abe1760aab42df434ed76d7404548
Instruction Fuzzy Hash: B0912874E05229CFDB64CFA5C884BEDBBB6FF89304F0285A5D81AA7255D7345A81CF80

Function 017CD031 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 017CD0BE
GetCurrentThread.KERNEL32 ref: 017CD0FB
GetCurrentProcess.KERNEL32 ref: 017CD138
GetCurrentThreadId.KERNEL32 ref: 017CD191

Memory Dump Source

Source File: 00000000.00000002.1482806832.00000000017C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17c0000_7DpzcPcsTS.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 32871b945712e7fa9cba118738500892f46834352bc5b9246d896180ae10f6af
Instruction ID: de972a36badf1af34d7db418176473c5e56311eb51bb0fb495d64e63acdcdffe
Opcode Fuzzy Hash: 32871b945712e7fa9cba118738500892f46834352bc5b9246d896180ae10f6af
Instruction Fuzzy Hash: F45145B0900349CFEB14DFAAD948B9EBBF1BB88314F20846DE419A7390DB345984CB65

Function 017CD040 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 017CD0BE
GetCurrentThread.KERNEL32 ref: 017CD0FB
GetCurrentProcess.KERNEL32 ref: 017CD138
GetCurrentThreadId.KERNEL32 ref: 017CD191

Memory Dump Source

Source File: 00000000.00000002.1482806832.00000000017C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17c0000_7DpzcPcsTS.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 1a0a431dc866dd8999958b96698d8d5d876e77b899cf2b470a4b6198e0d0830d
Instruction ID: 4d997fc7cc7f9e7086bab68eda247e30a04a7343290655207195a78ed2ae0cd0
Opcode Fuzzy Hash: 1a0a431dc866dd8999958b96698d8d5d876e77b899cf2b470a4b6198e0d0830d
Instruction Fuzzy Hash: 0E5137B0900349CFEB14DFAAD548B9EBBF1BB88714F20842DE419A7350DB749984CF65

Function 017CADA8 Relevance: 1.7, APIs: 1, Instructions: 210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 017CAFFE

Memory Dump Source

Source File: 00000000.00000002.1482806832.00000000017C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17c0000_7DpzcPcsTS.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 4908302a4aaa50790da61c67ac7493d5aecde72f4535a88f67dde247cd21965a
Instruction ID: 86c54a352e13a1ad981ee4090cf12a744759e5e53cec624710c72142e1333092
Opcode Fuzzy Hash: 4908302a4aaa50790da61c67ac7493d5aecde72f4535a88f67dde247cd21965a
Instruction Fuzzy Hash: 95813670A00B098FD724DF6AD44579AFBF1BF88705F008A2DD4869BA54E775E846CF90

Function 017C5914 Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 017C59D1

Memory Dump Source

Source File: 00000000.00000002.1482806832.00000000017C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17c0000_7DpzcPcsTS.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 46efd0136ba547530710d0e10c7d30c068ed866b29cbe6be9caf4c3dfda4c5ed
Instruction ID: 5a0205e07804578310e517fcae4f78d08b5f9422016ea717255bf788435f6683
Opcode Fuzzy Hash: 46efd0136ba547530710d0e10c7d30c068ed866b29cbe6be9caf4c3dfda4c5ed
Instruction Fuzzy Hash: 7F41EF71D00719CFDB24DFAAC888BCEBBB1BF88714F20816AD418AB251DB716946CF50

Function 017C44B4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 017C59D1

Memory Dump Source

Source File: 00000000.00000002.1482806832.00000000017C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17c0000_7DpzcPcsTS.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 06b4987b6cfd1103308a870eb96c23f018ed96c15d3fa086945834d29f83c12c
Instruction ID: 9f0b75fdc140a39ceceff1847f466048a4235302a07f2f7c030b2cb8f1694c65
Opcode Fuzzy Hash: 06b4987b6cfd1103308a870eb96c23f018ed96c15d3fa086945834d29f83c12c
Instruction Fuzzy Hash: 0441EFB0D0071DCFDB24DFAAC848B8EBBB5BF89704F20816AD408AB251DB716945CF90

Function 017CD688 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 017CD717

Memory Dump Source

Source File: 00000000.00000002.1482806832.00000000017C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17c0000_7DpzcPcsTS.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4f20c1c723daeb5284fcbe0c15111e5365f51facdbdb8f32a33370ba68f66594
Instruction ID: c8a0e70c4a0a0181313de2b230356f9efbf290d6f7b415a172c6bfdbb07c8d15
Opcode Fuzzy Hash: 4f20c1c723daeb5284fcbe0c15111e5365f51facdbdb8f32a33370ba68f66594
Instruction Fuzzy Hash: 7321E6B5900249DFDB10CFAAD884ADEFBF5FB48714F14812AE918A7350C378A955CFA0

Function 09151FB8 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MonitorFromPoint.USER32(?,?,00000002), ref: 09152037

Memory Dump Source

Source File: 00000000.00000002.1490194981.0000000009150000.00000040.00000800.00020000.00000000.sdmp, Offset: 09150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9150000_7DpzcPcsTS.jbxd

Similarity

API ID: FromMonitorPoint
String ID:
API String ID: 1566494148-0
Opcode ID: a8c897a04d49fc8c3e43dad5e85b8bdba6ddcd73c9c8d90a94c7104ee9c36134
Instruction ID: 35aaf5c9849bc002c1c17ccd2e5ae7f4aaa8bd9174ad5ef1e98cd6e79ab9e3cf
Opcode Fuzzy Hash: a8c897a04d49fc8c3e43dad5e85b8bdba6ddcd73c9c8d90a94c7104ee9c36134
Instruction Fuzzy Hash: B7218EB1A00209DFDB10EF9AD405BAEBBF5FB88710F108419E925BB384C775A945CFA0

Function 017CB031 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 017CAFFE

Memory Dump Source

Source File: 00000000.00000002.1482806832.00000000017C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17c0000_7DpzcPcsTS.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 9770f7daeb8a349043056d66ff626f2a80636941daf96be1bf5eb86de5240d77
Instruction ID: 840cda14c914151a9e13fe604a3a478f0ce3090065f032a492a66445b7ec1613
Opcode Fuzzy Hash: 9770f7daeb8a349043056d66ff626f2a80636941daf96be1bf5eb86de5240d77
Instruction Fuzzy Hash: DD11E6729002098FDB14DFAAD8447DAFBF5EBC4750F04805ED11997251D6359846CFA0

Function 017CD690 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 017CD717

Memory Dump Source

Source File: 00000000.00000002.1482806832.00000000017C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17c0000_7DpzcPcsTS.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c93b4c0f29037d21b74ca106bfae984ea7c0693a8af4c11bca99f52453207b5a
Instruction ID: b90bb8be0ad40afefa8cb3e3a04389583c46f0f617f88674216e4ee199e2b35c
Opcode Fuzzy Hash: c93b4c0f29037d21b74ca106bfae984ea7c0693a8af4c11bca99f52453207b5a
Instruction Fuzzy Hash: 6621E4B59002499FDB10CFAAD884ADEFBF8FB48710F14802AE918A3350D374A954CFA4

Function 09151FA9 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MonitorFromPoint.USER32(?,?,00000002), ref: 09152037

Memory Dump Source

Source File: 00000000.00000002.1490194981.0000000009150000.00000040.00000800.00020000.00000000.sdmp, Offset: 09150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9150000_7DpzcPcsTS.jbxd

Similarity

API ID: FromMonitorPoint
String ID:
API String ID: 1566494148-0
Opcode ID: 0988f42bc3f069abd82f36bf5fc6499755e62cf1b482981a1defa91a5c937aec
Instruction ID: d13f31b6d11dbf1e350f1b19e11eb6db1888cd939e0dcbcd7694ff742b45eb3e
Opcode Fuzzy Hash: 0988f42bc3f069abd82f36bf5fc6499755e62cf1b482981a1defa91a5c937aec
Instruction Fuzzy Hash: 94217AB5900249DFDB10EF9AD445BEEBBB4EB48314F10841AE825B7681C735A945CFA1

Function 017CAF98 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 017CAFFE

Memory Dump Source

Source File: 00000000.00000002.1482806832.00000000017C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17c0000_7DpzcPcsTS.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 410674fa3e06c4b320252e96fd89226e89263292a6dec7c16078505828c45950
Instruction ID: c493dca557818b55008c9a07674ed5c79ac1bbc61bfa82bb7dca5b69f5b9fa89
Opcode Fuzzy Hash: 410674fa3e06c4b320252e96fd89226e89263292a6dec7c16078505828c45950
Instruction Fuzzy Hash: 661110B5C003498FDB24CF9AC844BDEFBF4AB88724F10842ED529A7610D379A545CFA1

Function 0169D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1482485009.000000000169D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0169D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_169d000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e47453bde548a377625b5b6749cbb0546703f3ef7359e7fcbd02bca8577f6ede
Instruction ID: f317750e0d5d2c6b184ae5e5daa0cb3d2001dc8217bf56611765860faadec407
Opcode Fuzzy Hash: e47453bde548a377625b5b6749cbb0546703f3ef7359e7fcbd02bca8577f6ede
Instruction Fuzzy Hash: BE21D075604304DFDF15DF64D984B26BB69FB84264F20C57DD84A4B386C33AD447CA62

Function 0169D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1482485009.000000000169D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0169D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_169d000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34f79e3b0c05a80fd0b838895c76c077630f13c86c7bf99e5faddf62f1b3d92c
Instruction ID: 3e3dc11fc62d61f9df50a8e5c3ba36a4406d486a946fd565fc7418e1d59ba829
Opcode Fuzzy Hash: 34f79e3b0c05a80fd0b838895c76c077630f13c86c7bf99e5faddf62f1b3d92c
Instruction Fuzzy Hash: 1621D0B5604304AFDF05DF94D984B26BBA9FB84224F20C6BDEA494B396C336D446CA61

Function 0169D006 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1482485009.000000000169D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0169D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_169d000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e9c366e9b0dfbe549bf6f4ab6b096bfabd6ea1ddac148f37298c9f78ab1d826
Instruction ID: 090ea09ea4ca249516e170883f32d6273b435f8c8de3cf877bdf354215934b7a
Opcode Fuzzy Hash: 8e9c366e9b0dfbe549bf6f4ab6b096bfabd6ea1ddac148f37298c9f78ab1d826
Instruction Fuzzy Hash: 77219F755083809FDB02CF64D994B11BFB5FB46314F24C5EAD8498F2A7C33A9806CB62

Function 0169D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1482485009.000000000169D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0169D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_169d000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
Instruction ID: b5c9c5743e5b6f720b41345647da201a8e26b2e049ef2267763f6d290f7638a9
Opcode Fuzzy Hash: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
Instruction Fuzzy Hash: 0311BB75504280DFCB02CF54C9C0B15BBA2FB84224F24C6ADD9494B396C33AD40ACB61

Function 0168D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1482405954.000000000168D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0168D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_168d000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b167979888a9afc196f62ceeffdafceacc55158ca570bc9b3ba179f5b628e045
Instruction ID: 2fdb6e03b02e9c18bf28dbf345f2c0cafaba8a9bc92af88b993ea41ae70d893b
Opcode Fuzzy Hash: b167979888a9afc196f62ceeffdafceacc55158ca570bc9b3ba179f5b628e045
Instruction Fuzzy Hash: 2F01F7710043849AF7107EA5CC84B36BF98DF81625F18C61AED080A2C2C7799401CB71

Function 0168D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1482405954.000000000168D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0168D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_168d000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a4cd8d7edca47aeaefb2df65ab770b6cf3af2375f967c06224e861f2bfeabbd
Instruction ID: a4fe726f2803cda6c495ef8a73bb758b5c6c03d73e5afbbadb82545650aa37ff
Opcode Fuzzy Hash: 4a4cd8d7edca47aeaefb2df65ab770b6cf3af2375f967c06224e861f2bfeabbd
Instruction Fuzzy Hash: 6BF062714043849EE710AE1ACC84B66FF98EB85634F18C55AED085A2D7C3799844CBB1

Non-executed Functions

Function 0915F938 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1490194981.0000000009150000.00000040.00000800.00020000.00000000.sdmp, Offset: 09150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9150000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b42cbaf4650178f90e18aec5470cbdf4cc21e1fac53bc98cce7c90c79661a13a
Instruction ID: eda2ce07ce87fa52434f5b9d78406ce95c07ee3e3afc15cf8450ae4c79e766c6
Opcode Fuzzy Hash: b42cbaf4650178f90e18aec5470cbdf4cc21e1fac53bc98cce7c90c79661a13a
Instruction Fuzzy Hash: E5E10A74E00219CFDB14DFA9C590AAEBBB2FF89305F248169D825AB355D730AD42CF61

Function 0915F4FA Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1490194981.0000000009150000.00000040.00000800.00020000.00000000.sdmp, Offset: 09150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9150000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dd8edeb8fe347a2e00a792ec446ede530acaa3abea0259ccb78c984724bf875
Instruction ID: 993ec4738e0700f57819569fdcedb76dee94601177f0bd3f8ec06f0b5e484217
Opcode Fuzzy Hash: 0dd8edeb8fe347a2e00a792ec446ede530acaa3abea0259ccb78c984724bf875
Instruction Fuzzy Hash: 09E1F974E00259CFDB14DFA9C580AAEBBB2FF89305F258169E815AB355D730AD42CF60

Function 017CD5BC Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1482806832.00000000017C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17c0000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d0fad3c53bc66a3fa742e8596f785093380c3a97bf7ee0f20df3bf104895d07
Instruction ID: 748a71c8ea37ce9351ed5b3924fe250e38715dbd67b47081bc2c3abf53323a84
Opcode Fuzzy Hash: 3d0fad3c53bc66a3fa742e8596f785093380c3a97bf7ee0f20df3bf104895d07
Instruction Fuzzy Hash: F7A16C32E0021A8FCF19DFB5C84459EBBB3FF89700B15856EE905AB265DB31E955CB80

Analysis Process: 7DpzcPcsTS.exePID: 6592, Parent PID: 2736COMMON

Execution Graph

Execution Coverage:	11.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	140
Total number of Limit Nodes:	13

Executed Functions

Function 06645630 Relevance: 1.8, Strings: 1, Instructions: 597
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 066459E7

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 97529228806074bd872d095aff63823020a6c870c985fa358160ec16760d7a6b
Instruction ID: 4e5141fa9566161a614c9b73b5870776ceb1831f51926ebcb9ac0d5fa6edce52
Opcode Fuzzy Hash: 97529228806074bd872d095aff63823020a6c870c985fa358160ec16760d7a6b
Instruction Fuzzy Hash: 2C22D335E00255CFDF60EBA4C8806AEBBB2EF85320F24856AD446EB354DB35ED41CB90

Function 06646678 Relevance: .8, Instructions: 819COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c54ebbc3f0b355363d95587a094fe8a1f40188ee30007d16720f674a5cf9865
Instruction ID: 5efa37d6b39f49ebb17a9ef3ce3505be56806134c5718f5ee97d644d7414160c
Opcode Fuzzy Hash: 5c54ebbc3f0b355363d95587a094fe8a1f40188ee30007d16720f674a5cf9865
Instruction Fuzzy Hash: FD629E34B00204DFDB64EB68D994AADBBF2EF85314F148469E806EB394DB35ED45CB90

Function 0664C220 Relevance: .6, Instructions: 644COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 964f646c9234090412cc20432bc5095de9830dbeaed22cc285f31d7590b75396
Instruction ID: de4d54ca0277cb01dcb16face6844ab638ac374c6443b140d175ec7f0fde5250
Opcode Fuzzy Hash: 964f646c9234090412cc20432bc5095de9830dbeaed22cc285f31d7590b75396
Instruction Fuzzy Hash: C9326034B012199FDF54EB68D990BAEBBB2FB88310F148529D405EB355DB35EC41CB91

Function 0664B2BA Relevance: .6, Instructions: 578COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 217af04b7a2d6ffecc6779ab31de70e9cc597b168e223f52149b3e939bc5f481
Instruction ID: 4d148398808b37da9c7b5abe873bdd47cb013a0cec47eb0978b936f4d4f7d50c
Opcode Fuzzy Hash: 217af04b7a2d6ffecc6779ab31de70e9cc597b168e223f52149b3e939bc5f481
Instruction Fuzzy Hash: 9A225330E102098FEF64EF59D9807AEBBB2EB89310F248526E405EB355DB35DC81DB91

Function 066430F8 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b22df3b4d2d22b921c4310a6d9cc444b9b2c58f961cc628ea7f129e1a5b7313
Instruction ID: aa491d80b298f99550d43804fc9885a634ee2901fc42a4bfd68c4ffa0b7891ef
Opcode Fuzzy Hash: 9b22df3b4d2d22b921c4310a6d9cc444b9b2c58f961cc628ea7f129e1a5b7313
Instruction Fuzzy Hash: B7320B35E10619CFDB15EB69D89059DB7B2FFC9300F60C6AAD409AB354EF30A985CB90

Function 06647E08 Relevance: .5, Instructions: 476COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cf52ad3dfce48b9b28ba0a1b5d455221f5d0bf28148d4b5a2c66893ed5eb4a3
Instruction ID: 7bb6cb4ea6c001b63b4fe6c0755b17e30047992fe925dc836e5026d31cd60198
Opcode Fuzzy Hash: 8cf52ad3dfce48b9b28ba0a1b5d455221f5d0bf28148d4b5a2c66893ed5eb4a3
Instruction Fuzzy Hash: B1028E31B002158FDB54EBA8D990BAEBBF2FF84740F148529D805AB355DB35ED42CB90

Function 06632E03 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 06632E86
GetCurrentThread.KERNEL32 ref: 06632EC3
GetCurrentProcess.KERNEL32 ref: 06632F00
GetCurrentThreadId.KERNEL32 ref: 06632F59

Memory Dump Source

Source File: 00000004.00000002.2714114801.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6630000_7DpzcPcsTS.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 8300e6f35235ee687354b2f76560aefb50bf177627ed0c96e465e764ee5298ff
Instruction ID: ce60f24a724499065f72b72efdedff73927a142e84866cf398ae56833e42b1f6
Opcode Fuzzy Hash: 8300e6f35235ee687354b2f76560aefb50bf177627ed0c96e465e764ee5298ff
Instruction Fuzzy Hash: EA5145B090074A8FDB94DFAAD948B9EBBF6FF88314F208159E409A7390D7346944CF65

Function 06632E08 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 06632E86
GetCurrentThread.KERNEL32 ref: 06632EC3
GetCurrentProcess.KERNEL32 ref: 06632F00
GetCurrentThreadId.KERNEL32 ref: 06632F59

Memory Dump Source

Source File: 00000004.00000002.2714114801.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6630000_7DpzcPcsTS.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: be41f6b8ee4dfa9bd63de5c1dd1f2777111ddbd40e975d9b3a51d4c243e85164
Instruction ID: 56a1782454a520f3dbb87015235a29fa538240fc303fa1984f336e997154edfa
Opcode Fuzzy Hash: be41f6b8ee4dfa9bd63de5c1dd1f2777111ddbd40e975d9b3a51d4c243e85164
Instruction Fuzzy Hash: FE5155B090074A8FDB94DFAAD948B9EBBF6FF88314F208159E409A7390D7346944CF65

Function 0663B318 Relevance: 1.7, APIs: 1, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0663B57E

Memory Dump Source

Source File: 00000004.00000002.2714114801.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6630000_7DpzcPcsTS.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: a93a7f1e16aa8c350edd6e4928b70a4ca7f4fa9b5548d47ad383cad6d70deba9
Instruction ID: 8d75598bdee5b6f7f24f27a96892174ab370461456b4cc67262cc43c77a9e865
Opcode Fuzzy Hash: a93a7f1e16aa8c350edd6e4928b70a4ca7f4fa9b5548d47ad383cad6d70deba9
Instruction Fuzzy Hash: 4D813470A00B158FEB64DF2AD44475ABBF1FF88304F048A2DD48AC7A50DB35E945CB95

Function 0282EB58 Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2709980924.0000000002820000.00000040.00000800.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2820000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86b48fcd6086d650fdb231246f2feb6b7dfa14217d7d670f70a5683113eeddfb
Instruction ID: 6d63b87020323014825d6764ee9b8f4af7b1c7e05797c8c976e1dc42ceb656c9
Opcode Fuzzy Hash: 86b48fcd6086d650fdb231246f2feb6b7dfa14217d7d670f70a5683113eeddfb
Instruction Fuzzy Hash: 2F412576D003599FDB10DFAAE8007EABBF5EF89210F10856AD409E7241DB74A885CBE5

Function 0663D504 Relevance: 1.6, APIs: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0663D622

Memory Dump Source

Source File: 00000004.00000002.2714114801.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6630000_7DpzcPcsTS.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: ad86b0eae785f79e8f10a36e1062952e2bff1ff48cf34f0a692168c7211effd6
Instruction ID: c983258f5c9f07a8024d1607b00a87e8d61b4a1a99f8eebff343b57036407d71
Opcode Fuzzy Hash: ad86b0eae785f79e8f10a36e1062952e2bff1ff48cf34f0a692168c7211effd6
Instruction Fuzzy Hash: A651C0B1D10359EFDB14CFAAC884ADEBFB5BF49310F24812AE819AB250D7719845CF90

Function 0663D510 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0663D622

Memory Dump Source

Source File: 00000004.00000002.2714114801.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6630000_7DpzcPcsTS.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: a09d8cc306329ae66046cc50ed6f40356588311b28022b2ab1ea090d47c4f088
Instruction ID: 7231b90047a3322a2c7b7ecd7a14d410bfbecd808ef6844f2eae43a417622f02
Opcode Fuzzy Hash: a09d8cc306329ae66046cc50ed6f40356588311b28022b2ab1ea090d47c4f088
Instruction Fuzzy Hash: DE41B0B1D10319DFDB14CFAAC884ADEBBB5BF49310F24812AE819AB210D7759845CF90

Function 0663E49C Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 0663FD11

Memory Dump Source

Source File: 00000004.00000002.2714114801.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6630000_7DpzcPcsTS.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 76bc8bf56588bca9db40e6b11d820e2d23339d51b5485f3720d48ff240fb9e88
Instruction ID: 9a89beb820bcbd3e509c86bea8b6fe1b9170c1d6b597d64f651481c5e1f8bd05
Opcode Fuzzy Hash: 76bc8bf56588bca9db40e6b11d820e2d23339d51b5485f3720d48ff240fb9e88
Instruction Fuzzy Hash: 644158B4D00319CFDB54DF9AC888AAABBF5FF88314F248459D519AB321C774A841CFA0

Function 06633048 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 066330D7

Memory Dump Source

Source File: 00000004.00000002.2714114801.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6630000_7DpzcPcsTS.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: bb4da522cf22b4337f3085ce2b87f78f0d58bc4b6b10b457b38b24b180b98304
Instruction ID: 5c499a0262b22e889bf9aa8294d1212ed596b5891f597fee75a2912031e06138
Opcode Fuzzy Hash: bb4da522cf22b4337f3085ce2b87f78f0d58bc4b6b10b457b38b24b180b98304
Instruction Fuzzy Hash: 8021D4B5D002499FDB10CFAAD984ADEFBF8EF48310F14841AE954A3350D375A954CFA5

Function 06633050 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 066330D7

Memory Dump Source

Source File: 00000004.00000002.2714114801.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6630000_7DpzcPcsTS.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7b4ccea4df921be952a172ee0803ea4a97eb059a6a48690043abfb54e0f6c2fe
Instruction ID: 7809f9d6ba1d38be5651f8f0c965147f038bbcbcd843d02a912361c3454428d6
Opcode Fuzzy Hash: 7b4ccea4df921be952a172ee0803ea4a97eb059a6a48690043abfb54e0f6c2fe
Instruction Fuzzy Hash: C021E3B59002499FDB10CFAAD884ADEFBF8EB48310F14801AE914A3350C375A944CFA4

Function 0282EC40 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 0282ECA7

Memory Dump Source

Source File: 00000004.00000002.2709980924.0000000002820000.00000040.00000800.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2820000_7DpzcPcsTS.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 0e4b2f4dfcb15624d111fac33db883af6d8455b2f54f773065542613fcc67f08
Instruction ID: 278c062195cb0a628cae8c47a529abcc350ac68c11c20a95f9b18914ebe01bb0
Opcode Fuzzy Hash: 0e4b2f4dfcb15624d111fac33db883af6d8455b2f54f773065542613fcc67f08
Instruction Fuzzy Hash: 101150B5C0026A9FDB10CFAAC444BDEFBF4BF48220F10812AD818A3240D378A944CFA5

Function 0663B518 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0663B57E

Memory Dump Source

Source File: 00000004.00000002.2714114801.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6630000_7DpzcPcsTS.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: b28d6c63a64445a2d0438a4932087c5c66ee1d16b0a858969e4af4af152b5235
Instruction ID: 67031c2e9b4a4a8eb664540bb9d21609902d5f53a4f4fbc72f6470e0d438affb
Opcode Fuzzy Hash: b28d6c63a64445a2d0438a4932087c5c66ee1d16b0a858969e4af4af152b5235
Instruction Fuzzy Hash: 33110FB6C003498FCB20CF9AC844BDEFBF4AB88320F14841AD419A7210D379A545CFA1

Function 0664CFE8 Relevance: .8, Instructions: 804COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccd38feed598a6cead1b7e8b15f733f8739f9c28c737b9d1c1b7b85fe6fcece2
Instruction ID: 9968bde1583d66f736315c288b7c355b4ea7df28a4e2e7f12b40eda8cdadf764
Opcode Fuzzy Hash: ccd38feed598a6cead1b7e8b15f733f8739f9c28c737b9d1c1b7b85fe6fcece2
Instruction Fuzzy Hash: F7625F30A00316CFEB55EF68D980A5DB7B2FF85704B208A68D8059F359DB75ED86CB81

Function 0664B6E0 Relevance: .5, Instructions: 473COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dc17040bfca8524fe00c1952ffb476a1de1c7d6e8aa7efd9747ed4fdb189c92
Instruction ID: 90797999cae611ea30a72b44e8b33da273e23b4870531e00170ab1c83fd9a36a
Opcode Fuzzy Hash: 8dc17040bfca8524fe00c1952ffb476a1de1c7d6e8aa7efd9747ed4fdb189c92
Instruction Fuzzy Hash: F5025E30E002098FEB64EFA8D5806ADB7B2FF85310F24896AD405EB355DB35ED85CB91

Function 06642B7B Relevance: .5, Instructions: 463COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7caaae7bf623aba5ec0b0f7e5cef9af2442ed51a05661c580f078b4436989900
Instruction ID: ccc6328d08637142b565550d4f710d660c8ecfac590482b718646dbd8e3080ea
Opcode Fuzzy Hash: 7caaae7bf623aba5ec0b0f7e5cef9af2442ed51a05661c580f078b4436989900
Instruction Fuzzy Hash: 3E025930A00204CFDBA4EB68C558A9DBBF2EF85315F5485A9E40AAB351DB35ED85CB90

Function 0664AD60 Relevance: .4, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408f3a2ba1e4e6010f902bf6a824fc19cf30b131c18b15b7bc34242ed0100c73
Instruction ID: 2f6cca0dc12ab45fbb27b55ad2d7cf6db66c6475da779e9b683bec8fdfb2c55c
Opcode Fuzzy Hash: 408f3a2ba1e4e6010f902bf6a824fc19cf30b131c18b15b7bc34242ed0100c73
Instruction Fuzzy Hash: D8E16F34E003159FDF65EBA8D8906AEB7B2FF85300F208529E815EB358DB75D846CB91

Function 066491D8 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15d6e31116bb9fc1dceff91076e0210c374279184c126f1e33739dc74d883c59
Instruction ID: bb2af414e8f42517da2ed800c8b1cbef41c2af7b0a4aac9c37473f3e984b7517
Opcode Fuzzy Hash: 15d6e31116bb9fc1dceff91076e0210c374279184c126f1e33739dc74d883c59
Instruction Fuzzy Hash: B6914230B5021ACFDB54EF68D9507AF77F2AF89700F108569D809AB348EF71AC419B90

Function 06646270 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5527dcd773db1d736cadae4e288b25113ee29ae18426e9f909daa418407e8c3
Instruction ID: 3302954d2ec5f1927b4837d1ddb816c4e14ed3f303d1a2c28cc9874006f32cbc
Opcode Fuzzy Hash: b5527dcd773db1d736cadae4e288b25113ee29ae18426e9f909daa418407e8c3
Instruction Fuzzy Hash: 6A61F571F001214BDF51AB7EC94465FBADBAFC5620B144439D80ADB360DEB5ED028BC5

Function 06644658 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4191f7c5309f57ff8596b9a455c48dd3f220f01b42325c268038d202f1436899
Instruction ID: 400a236328ef1ef444d5eab1c3aeb5f24b35eac32bf5cb178b9ca329e9e12c04
Opcode Fuzzy Hash: 4191f7c5309f57ff8596b9a455c48dd3f220f01b42325c268038d202f1436899
Instruction Fuzzy Hash: 6D913D34E002198FDF60DF68C890B99BBB1FF89310F208599D549BB395DB71AA85CF91

Function 06644347 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f16e870c24b00ef8dec3afbec7dccecb8e38fb37f48cb4dbe6737bbfde644db
Instruction ID: 2433e6a07157adede64f18c26c00d71e29f569a7e25d61151dc2156ef69bce03
Opcode Fuzzy Hash: 2f16e870c24b00ef8dec3afbec7dccecb8e38fb37f48cb4dbe6737bbfde644db
Instruction Fuzzy Hash: 28811D30B002058BDF54EFA9D55176EBBF2EB89700F208529D50AEB355EF35DC429B91

Function 06644670 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53902d84a8cef7ae4d86bb65a7c00c541bd1a6fbb4f5cd266eafd37be442798d
Instruction ID: 44820947962079138adb90afb09cfb8b74a7dbdf054523dc0367b38227064386
Opcode Fuzzy Hash: 53902d84a8cef7ae4d86bb65a7c00c541bd1a6fbb4f5cd266eafd37be442798d
Instruction Fuzzy Hash: 9C912D34E106198BDF60DF68C890B9DB7B1FF89310F208699D549BB385DB71AA85CF90

Function 0664EBB0 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 868531b87cf73acda38b45e673bdfd786672372d29029ed60685b29096af589d
Instruction ID: 3bbd82b79d5dc934d491a39eb3c870e7f2cbf9856da8c2b61972062c2159d6ed
Opcode Fuzzy Hash: 868531b87cf73acda38b45e673bdfd786672372d29029ed60685b29096af589d
Instruction Fuzzy Hash: 23814B35A002099FDB54EFA8D980AADBBF6FF88304F248529D405EB355DB31ED46CB51

Function 0664EBC0 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 865d8b957faaddc4077e4c927ef21164bf1da8971c0f14f3a13ddd5b78b060e6
Instruction ID: 0cd119db1fca0de44e3d857ec6e26195f86df68d02bf9432e4f65b2ff72fc07b
Opcode Fuzzy Hash: 865d8b957faaddc4077e4c927ef21164bf1da8971c0f14f3a13ddd5b78b060e6
Instruction Fuzzy Hash: E6712934A002099FDB54EFA9C980A9DBBF6FF88304F248529E419EB355DB31ED46CB51

Function 06644C08 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18a90d2b810dd702898df0612c1d8499055d20b883d4520dd0ee75932abffc38
Instruction ID: 40a30c9fc4a46bdcd6e8bf212f1d6044ff5e49b13ce4b68f093b423c4f84c96a
Opcode Fuzzy Hash: 18a90d2b810dd702898df0612c1d8499055d20b883d4520dd0ee75932abffc38
Instruction Fuzzy Hash: 6B618370F002189FEB549BA8C8557AEBBF6EF88700F208429D506EB395DF759D458B90

Function 0664FD20 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3affb548843a51946937b32aae0a77de2f31d9c07ead6de5effd086caef71790
Instruction ID: 0a8854b9772eb17501a6c6f78d5880b938b7ef6c1d15c767186b737430e6bf53
Opcode Fuzzy Hash: 3affb548843a51946937b32aae0a77de2f31d9c07ead6de5effd086caef71790
Instruction Fuzzy Hash: AC51CF31E01209DFDF54BB78E8946AEBBB2FBC5315F208869E106D7351DB358855CB81

Function 0664FAD1 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6480a4b0781c4330a951fa3145326edf2405217a1f10e45df2f3b863fb9a3e8f
Instruction ID: b20e88efe80696a086b793a775507f17b5545caae6c29c9c85dcf0d6d668cd15
Opcode Fuzzy Hash: 6480a4b0781c4330a951fa3145326edf2405217a1f10e45df2f3b863fb9a3e8f
Instruction Fuzzy Hash: 2D51B230B113148BFF607668D85476F7A5ADBCA711F60442AE90ACB794CF79CC8593A2

Function 0664FAE0 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5d2f6095519eadc7d44671548f2c5c17356fc228f280b7cbe926717ba5a6a01
Instruction ID: 653b5bb7a6473d11655fb99e488b2adbcd936c226975ec25bf06facf7737b894
Opcode Fuzzy Hash: b5d2f6095519eadc7d44671548f2c5c17356fc228f280b7cbe926717ba5a6a01
Instruction Fuzzy Hash: 9F51AF30B113148BFFA0766CD894B2F665AD7CA711F60442AE50ACB794CF79CC8553A2

Function 066491D6 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c0fb91735a3324691d876c02a45f65d3ad1c869c904d067f8f62d570149fae7
Instruction ID: 829a0ac349db6da30c3ba7e95b85014197f8b74d10fd6884c7cdd2bd93133a1b
Opcode Fuzzy Hash: 2c0fb91735a3324691d876c02a45f65d3ad1c869c904d067f8f62d570149fae7
Instruction Fuzzy Hash: 2E511130B502158FDB54EF78D990B6F77F2AB89710F14856AC40ADB388EE71EC519BA0

Function 06644BF8 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c12c2a11a3de0d74e75c0090c746bd3350abfc6476d17c5583b2e1b53c0e0c2a
Instruction ID: 1c9e1f7376756be171283f2f910d6923de161aa7ec45e8c9261bee852c18603a
Opcode Fuzzy Hash: c12c2a11a3de0d74e75c0090c746bd3350abfc6476d17c5583b2e1b53c0e0c2a
Instruction Fuzzy Hash: 36519230F002089FEB549FA9C8547AEBBF6FF88700F208529E506AB395DE759C00CB90

Function 066454B1 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ef30f544042134a6abe6ecba2c096834096414381441ee0e159a6aec3780091
Instruction ID: f9e01e491ef8ff7fedc77a343fa6f640c9e28efcdaece8d3e31b3d6f05e26d53
Opcode Fuzzy Hash: 4ef30f544042134a6abe6ecba2c096834096414381441ee0e159a6aec3780091
Instruction Fuzzy Hash: F4415971E006099FDB70DFA9D880ABFFBB2EB85310F20492AE156D7651D330E959CB91

Function 0664DB5D Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 943d25a6b83970c846d04557412e9a1081c8c1c6bc2a3e8bea813fd09c11a0b7
Instruction ID: 8278b7f3072e72a186ffc49d58e38b96c4251805b06aeaa3381385e11c393547
Opcode Fuzzy Hash: 943d25a6b83970c846d04557412e9a1081c8c1c6bc2a3e8bea813fd09c11a0b7
Instruction Fuzzy Hash: 6A41A170E0030ADFDB65EFA9C49469EBBB6BF85700F208529E805EB340DB70D946CB91

Function 06642298 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98cebdebacc7c761a91ba30bfd64a6dcab9aa0b2b16a4a94387f6c9e00dd796d
Instruction ID: 257bfca565532fbb1f72680b6efcfada24a647e4bd8fb66a6f29a05f234074d7
Opcode Fuzzy Hash: 98cebdebacc7c761a91ba30bfd64a6dcab9aa0b2b16a4a94387f6c9e00dd796d
Instruction Fuzzy Hash: 1F31AF30B002058FDB59AB78C96476F7BB6BF89604F248528E806DB385EF35DD46CB91

Function 06645620 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3b04e80ca07685af9403b31558878b994939eb6c04e12fbb1ada8b166a34ace
Instruction ID: 5538ca85ddb2056b78e5f6d71237ca5e98a3caa72ec6b9f993ee3fecb1df9ed3
Opcode Fuzzy Hash: b3b04e80ca07685af9403b31558878b994939eb6c04e12fbb1ada8b166a34ace
Instruction Fuzzy Hash: 88315071E102058FDF60EFAAD881AAFFBB1EB45310F20893AD516D7351D635E941CB91

Function 06642153 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6465a6294cd095d7cb22618e340f84eeb954eede97348c0ea6c7d1d4c4b833bb
Instruction ID: 8bbfd554b7496d234eac3e8305b6a418e68f8b9ed2a57b30451fea7f4a18faa0
Opcode Fuzzy Hash: 6465a6294cd095d7cb22618e340f84eeb954eede97348c0ea6c7d1d4c4b833bb
Instruction Fuzzy Hash: 92317030E10209DBDB59DFA8D8A469EB7F6FF89300F208519E916E7350DB71AD42CB60

Function 06642158 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8b5cea490a32bbaaa9434d7cc59d7175806575b78f3fe4dedd303bb77f455ae
Instruction ID: 162f6bea449f6c13dc6353a4e8e08a6167949de92e3a3ebd5b63825257b3a612
Opcode Fuzzy Hash: f8b5cea490a32bbaaa9434d7cc59d7175806575b78f3fe4dedd303bb77f455ae
Instruction Fuzzy Hash: B4316330E10209DBDB59DFA8D8A469EB7F6FF89300F208519E916E7350DB71AD46CB60

Function 06643B38 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddb229fac2299ec5fbc2f78834cd156f9a4a35f6dce148e811f4ebc9800175d4
Instruction ID: 18b7acd9433e63280995b04ddcd9b11595910d2945883def11073987ca469090
Opcode Fuzzy Hash: ddb229fac2299ec5fbc2f78834cd156f9a4a35f6dce148e811f4ebc9800175d4
Instruction Fuzzy Hash: 3D218D75E002159FDB40EF6DD940AEEBBF5EB48720F108126EA11EB395E731E9418B90

Function 06643B48 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f82f17dacc7dc6865f0d599743a305ea9368580ea314009c57eb03a007e2a2d
Instruction ID: 71a2943252cc062340153c8a780e511adace56a602b1bfc42c88b3c57c6199ff
Opcode Fuzzy Hash: 0f82f17dacc7dc6865f0d599743a305ea9368580ea314009c57eb03a007e2a2d
Instruction Fuzzy Hash: 02217F75F006159FDB50DF69D980AAEBBF5FB48710F108029E905EB395EB31E8418B94

Function 00F5D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2709653450.0000000000F5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f5d000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c628ba89ec77e1febeed1291f0552483731f56235631b54f17c6c5e3f36f198f
Instruction ID: 22f093db1f4b92330f9d952c4cfef55f2d2d294a7174c259d03c887314d37c9a
Opcode Fuzzy Hash: c628ba89ec77e1febeed1291f0552483731f56235631b54f17c6c5e3f36f198f
Instruction Fuzzy Hash: 472103716053049FDB20DF10C884B26BB65FB84325F20C569EE490B286C736D84AEA62

Function 06643C48 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fb8c6217eef399d7e265281246c37c5f87cdf6fe51e8caec62970800af304b0
Instruction ID: a868f32044f3454e7d3bd377f08ada735284b38748b4574ccddcf48caab6bc29
Opcode Fuzzy Hash: 2fb8c6217eef399d7e265281246c37c5f87cdf6fe51e8caec62970800af304b0
Instruction Fuzzy Hash: 1A01D236B101255BCF54A67EEC20BEB7BAADBC6661F140136D915EB394EE11CC0147E2

Function 06643C58 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74a75cb74f5a3f105f9778a4e4ae7948fab124dfc5dff9188b9d7355071b27c6
Instruction ID: e82776b249cedfc8fdbd3eb8b9bcafe8878cc85b9e7d300c504f10c64cd13788
Opcode Fuzzy Hash: 74a75cb74f5a3f105f9778a4e4ae7948fab124dfc5dff9188b9d7355071b27c6
Instruction Fuzzy Hash: 8311CE31B004258BCF94AA69D8146AF77FAEBC9711F004139C906E7344EF25DC029B90

Function 0664429A Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 076d81d8d05000224a1ede25074eb68273ce7c10d927d53a2aec31a1dc5507c4
Instruction ID: 176d058e421e57b8806446f192292d3f007743718a42b2ec5c4ae3c67f709137
Opcode Fuzzy Hash: 076d81d8d05000224a1ede25074eb68273ce7c10d927d53a2aec31a1dc5507c4
Instruction Fuzzy Hash: 4901B130B002600FDB61A67ED8517AF7BD6DBCA721F14852AE01ACB39ADD65DC0143E2

Function 06643910 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b06bf2f197280a5889bf6fd7b871604c8be2e03a8fc7167346d3710c590fd82
Instruction ID: b24e2d836b23d701c1acff01e857a3598fd5b451828f19cc2d4999e6d57dd95b
Opcode Fuzzy Hash: 0b06bf2f197280a5889bf6fd7b871604c8be2e03a8fc7167346d3710c590fd82
Instruction Fuzzy Hash: A821E0B1D01219AFCB10DF9AD884ADEFBF4FB48224F10822AE518A7340D3756944CBA5

Function 0664EE31 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 987dc645f531c62ddd54fe8e3166c1cf26c758f8820513e398449de022165c18
Instruction ID: 9ba31cc909aa5acc1d4e4de404c18fb37c45271c144595c16926e370e8d54dd8
Opcode Fuzzy Hash: 987dc645f531c62ddd54fe8e3166c1cf26c758f8820513e398449de022165c18
Instruction Fuzzy Hash: F601B530B002544FEB65EA7CD4D0B2F77D6EBC9714F14846AE50ACB381DA26EC0143A1

Function 0664A398 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7af91b3f8ee31047156a5bfd56e5d2f776773a95a23e654e2b31cc50e552bd32
Instruction ID: 5e6b1e67c6adf803b2ab92c3f512990cbe09c821f82f489c312baebf1748f98d
Opcode Fuzzy Hash: 7af91b3f8ee31047156a5bfd56e5d2f776773a95a23e654e2b31cc50e552bd32
Instruction Fuzzy Hash: CA01D8347042102FD761EABCE45475F77E2EB8A720F10442AE10ACB385EE11ED418791

Function 00F5D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2709653450.0000000000F5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f5d000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
Instruction ID: d9e597df8d3d2f1b4c8943ce770de861f614680803b8f7d0fb81c8f271e8b2b8
Opcode Fuzzy Hash: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
Instruction Fuzzy Hash: 4311D075904244CFDB11CF10C5C4B15BB62FB44325F24C6ADDD494B296C33AD84ADF51

Function 06643918 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58ad7e89130b7c67a5f77c34ec5cf281d14f0c97170c11906691eca2058ddabe
Instruction ID: 5504953b0797104f862c8a853f912b41fdacfb96a0d1c3a74021f72e5755e2e5
Opcode Fuzzy Hash: 58ad7e89130b7c67a5f77c34ec5cf281d14f0c97170c11906691eca2058ddabe
Instruction Fuzzy Hash: 5411CEB1D01259AFCB00DF9AD884ADEFBB4BB48210F10822AE918A7340D375A954CBA5

Function 066442A8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1175b5dd87e846ee5285f321772cac38b29a998364c9d969f5daca250fdbf75
Instruction ID: ba2fbcf04267740212237fd4998f53b103fae0979021146372416ef931cd758b
Opcode Fuzzy Hash: f1175b5dd87e846ee5285f321772cac38b29a998364c9d969f5daca250fdbf75
Instruction Fuzzy Hash: 32018131B001100BEB65A5AED451B6FB6DADBC9B21F20843AE50EC734ADE65DC0247D1

Function 0664EE40 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac021c5057a411553f76248676edb9192fbaa2a59a630b35322a11699c650c0a
Instruction ID: 96bfe55a3c5059c0fc76f237e2baf5b87dab0a591f862532cd2d3d56b101fa10
Opcode Fuzzy Hash: ac021c5057a411553f76248676edb9192fbaa2a59a630b35322a11699c650c0a
Instruction Fuzzy Hash: AA014431B005144BEB65E67DD490B2F77D6EBC9B21F14843AE50AC7381EE26EC024395

Function 0664A3A8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a9f940777cf0b2f8d7bdeb3078b5e2366b8d9fe7e2e33bda17520a18b68015b
Instruction ID: d869a0ab88ec2aed67c0c49fd0e37f0cfb0cf86940241418aca4fc5967536178
Opcode Fuzzy Hash: 7a9f940777cf0b2f8d7bdeb3078b5e2366b8d9fe7e2e33bda17520a18b68015b
Instruction Fuzzy Hash: E5018134B101145FDBA1EAACD454B2F77D6EB89720F108429E50BCB389EE21EC414791

Function 0664AFB0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28a05a5860af71807c90927390dc68544b8bd6367e8ca4a62330aff1b28abd2a
Instruction ID: 7571c48c55992491fba7894f81375c944cd662311fe570b820182c523dcbaa7b
Opcode Fuzzy Hash: 28a05a5860af71807c90927390dc68544b8bd6367e8ca4a62330aff1b28abd2a
Instruction Fuzzy Hash: 75F0A072E102189BEFB0A9A8D804B9EB7A9E785761F00483BE91AE7740D631DC958781

Function 066464F9 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2714158867.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6640000_7DpzcPcsTS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e8c3883ad6e1442c53744ed062f3f98fb6c279e94d06607bb6c18db9d86a9ef
Instruction ID: 9a4211d19ce7deb3b2f08223bf8f8d492f52858e0a69f3fe6fe3abe2f38acbdd
Opcode Fuzzy Hash: 0e8c3883ad6e1442c53744ed062f3f98fb6c279e94d06607bb6c18db9d86a9ef
Instruction Fuzzy Hash: 77E0DFB1E252486FEF60EE70D94579B7FACD742218F2088A7E408DB242E13ACD01CB90

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 7DpzcPcsTS.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\7DpzcPcsTS.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2ncfo4yi.mb4.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3a51dgjt.apm.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lbnuvlib.pzf.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nmhcjyuv.di5.psm1

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Windows Analysis Report
7DpzcPcsTS.exe

Function 017CD031 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Function 017CD040 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 017CADA8 Relevance: 1.7, APIs: 1, Instructions: 210
COMMON

Function 017C5914 Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Function 017C44B4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 017CD688 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 09151FB8 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Function 017CB031 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 017CD690 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 09151FA9 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 017CAF98 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre