Edit tour

Windows Analysis Report
Salinewin.exe-LikePayload.exe

Overview

General Information

Sample name:	Salinewin.exe-LikePayload.exe
Analysis ID:	1664249
MD5:	15b2cbeeb181e76f548cc88224c4f64a
SHA1:	fd482b5d01e1412266e323858b6886ee7ed5949f
SHA256:	12f9b03fc0e2e2cc133e3a8ed0b8449e4ffa5c000e2527acb7364ca9845b0061
Tags:	exeuser-FelloBoiYuuka
Infos:

Detection

Score:	48
Range:	0 - 100
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

PE file contains sections with non-standard names

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Classification

Process Tree

System is w10x64

Salinewin.exe-LikePayload.exe (PID: 7648 cmdline: "C:\Users\user\Desktop\Salinewin.exe-LikePayload.exe" MD5: 15B2CBEEB181E76F548CC88224C4F64A)

conhost.exe (PID: 7676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Joe Sandbox Signatures

• AV Detection
• Compliance
• Key, Mouse, Clipboard, Microphone and Screen Capturing
• System Summary
• Data Obfuscation
• Malware Analysis System Evasion
• Anti Debugging
• Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Salinewin.exe-LikePayload.exe

Virustotal: Detection: 7%

Perma Link

Source: Salinewin.exe-LikePayload.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: .C:\Users\dell\source\repos\GdiThings\x64\Debug\GdiThings.pdb$$ source: Salinewin.exe-LikePayload.exe
Source:	Binary string: C:\Users\dell\source\repos\GdiThings\x64\Debug\GdiThings.pdb source: Salinewin.exe-LikePayload.exe

Source: C:\Users\user\Desktop\Salinewin.exe-LikePayload.exe

Code function: 0_2_00007FF6034D5E00 srand,GetSystemMetrics,GetSystemMetrics,GetDC,CreateCompatibleDC,CreateDIBSection,SelectObject,GetDC,BitBlt,BitBlt,rand,rand,rand,CreateSolidBrush,SelectObject,Ellipse,GetCursorPos,rand,rand,SetCursorPos,Sleep,DeleteObject,ReleaseDC,DeleteDC,

0_2_00007FF6034D5E00

Source: C:\Users\user\Desktop\Salinewin.exe-LikePayload.exe	Code function: 0_2_00007FF6034D5590	0_2_00007FF6034D5590
Source: C:\Users\user\Desktop\Salinewin.exe-LikePayload.exe	Code function: 0_2_00007FF6034D5E00	0_2_00007FF6034D5E00
Source: C:\Users\user\Desktop\Salinewin.exe-LikePayload.exe	Code function: 0_2_00007FF6034D4C20	0_2_00007FF6034D4C20

Source: classification engine

Classification label: mal48.winEXE@2/0@0/0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7676:120:WilError_03

Source: C:\Users\user\Desktop\Salinewin.exe-LikePayload.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Salinewin.exe-LikePayload.exe

Virustotal: Detection: 7%

Source: unknown	Process created: C:\Users\user\Desktop\Salinewin.exe-LikePayload.exe "C:\Users\user\Desktop\Salinewin.exe-LikePayload.exe"
Source: C:\Users\user\Desktop\Salinewin.exe-LikePayload.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\Salinewin.exe-LikePayload.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Salinewin.exe-LikePayload.exe	Section loaded: vcruntime140d.dll	Jump to behavior
Source: C:\Users\user\Desktop\Salinewin.exe-LikePayload.exe	Section loaded: ucrtbased.dll	Jump to behavior

Source: Salinewin.exe-LikePayload.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: Salinewin.exe-LikePayload.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Salinewin.exe-LikePayload.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Salinewin.exe-LikePayload.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Salinewin.exe-LikePayload.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Salinewin.exe-LikePayload.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Salinewin.exe-LikePayload.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Salinewin.exe-LikePayload.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Salinewin.exe-LikePayload.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: .C:\Users\dell\source\repos\GdiThings\x64\Debug\GdiThings.pdb$$ source: Salinewin.exe-LikePayload.exe
Source:	Binary string: C:\Users\dell\source\repos\GdiThings\x64\Debug\GdiThings.pdb source: Salinewin.exe-LikePayload.exe

Source: Salinewin.exe-LikePayload.exe	Static PE information: section name: .textbss
Source: Salinewin.exe-LikePayload.exe	Static PE information: section name: .msvcjmc
Source: Salinewin.exe-LikePayload.exe	Static PE information: section name: .00cfg

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\Salinewin.exe-LikePayload.exe

Code function: 0_2_00007FF6034D4020 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF6034D4020

Source: C:\Users\user\Desktop\Salinewin.exe-LikePayload.exe

Code function: 0_2_00007FF6034D50D0 VirtualQuery,GetProcAddress,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,

0_2_00007FF6034D50D0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Salinewin.exe-LikePayload.exe	Code function: 0_2_00007FF6034D123A SetUnhandledExceptionFilter,	0_2_00007FF6034D123A
Source: C:\Users\user\Desktop\Salinewin.exe-LikePayload.exe	Code function: 0_2_00007FF6034D2F70 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF6034D2F70
Source: C:\Users\user\Desktop\Salinewin.exe-LikePayload.exe	Code function: 0_2_00007FF6034D4020 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6034D4020

Source: C:\Users\user\Desktop\Salinewin.exe-LikePayload.exe

Code function: 0_2_00007FF6034D3CE0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF6034D3CE0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Process Injection	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 DLL Side-Loading	LSASS Memory	2 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	2 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Salinewin.exe-LikePayload.exe	7%	Virustotal		Browse
Salinewin.exe-LikePayload.exe	6%	ReversingLabs

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1664249
Start date and time:	2025-04-13 22:30:22 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Salinewin.exe-LikePayload.exe
Detection:	MAL
Classification:	mal48.winEXE@2/0@0/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 9
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212
Excluded domains from analysis (whitelisted): c2a9c95e369881c67228a6591cac2686.clo.footprintdns.com, ax-ring.msedge.net, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Salinewin.exe-LikePayload.exe, PID 7648 because there are no executed function
Not all processes where analyzed, report is missing behavior information

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	3.712970190411325
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Salinewin.exe-LikePayload.exe
File size:	64'000 bytes
MD5:	15b2cbeeb181e76f548cc88224c4f64a
SHA1:	fd482b5d01e1412266e323858b6886ee7ed5949f
SHA256:	12f9b03fc0e2e2cc133e3a8ed0b8449e4ffa5c000e2527acb7364ca9845b0061
SHA512:	f08fcd3a5784260f718411d6c3b41098fb4e1d16b5ad6963d0546551c13262bc1785779d1b074323e8be19977ed2f818dc7580bd7592f91234ab1367ddcd6b53
SSDEEP:	384:Xg5Hpauf4KtWxhs1FTeT3wyfORp+DI3iJKd0JMdgwy6bnEyL4WQfB1VjTXX+A89e:wWuesmwyWRbf+WPbP4vBrXX+A89
TLSH:	3E53F74AF79930F7D6BAC13D95C62229F6B4706013262BCF502588799F607E83D3D39A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........S...S...S...BV..Q...BV..P...BV..X...BV..K.......Z...S........W..R....W].R....W..R...RichS...........................PE..d..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x14001127b
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67FBC49F [Sun Apr 13 14:05:19 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	e5d1fd150d5f105dec482e139b154cd7

Entrypoint Preview

Instruction
jmp 00007F3F35296435h
jmp 00007F3F35298250h
jmp 00007F3F3529873Bh
jmp 00007F3F35299D56h
jmp 00007F3F35297D51h
jmp 00007F3F3529882Ch
jmp 00007F3F35299D07h
jmp 00007F3F35299C76h
jmp 00007F3F35297F4Dh
jmp 00007F3F35297E58h
jmp 00007F3F35297033h
jmp 00007F3F352989AEh
jmp 00007F3F35299029h
jmp 00007F3F352977E4h
jmp 00007F3F35299BE7h
jmp 00007F3F35299C54h
jmp 00007F3F352976B5h
jmp 00007F3F35299BAEh
jmp 00007F3F35297F2Bh
jmp 00007F3F35299CC6h
jmp 00007F3F35299BC3h
jmp 00007F3F35297E7Ch
jmp 00007F3F35297F27h
jmp 00007F3F35299C32h
jmp 00007F3F352986FDh
jmp 00007F3F35298528h
jmp 00007F3F35297613h
jmp 00007F3F35299B82h
jmp 00007F3F35297A19h
jmp 00007F3F35299B00h
jmp 00007F3F35295A6Fh
jmp 00007F3F3529948Ah
jmp 00007F3F35297F15h
jmp 00007F3F35299BE8h
jmp 00007F3F35299B3Bh
jmp 00007F3F35297556h
jmp 00007F3F35297561h
jmp 00007F3F3529635Ch
jmp 00007F3F35295C67h
jmp 00007F3F352959D7h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x21488	0x78	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x25000	0x43c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x1e000	0x1d58	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x26000	0x6c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1b860	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1b6e0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x21000	0x488	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.textbss	0x1000	0x10000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.text	0x11000	0x829f	0x8400	6fcd1debb5d2d586cbde0614991d8e80	False	0.26228101325757575	data	3.824768185052854	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1a000	0x2d9d	0x2e00	0fd9ff4f3e32e780f247a8b812af9ca7	False	0.1727241847826087	data	2.218167736241953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1d000	0x948	0x200	af79bcfbaa784ba1a2dd24802a6163dd	False	0.1015625	data	0.5958979923095629	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x1e000	0x2154	0x2200	97c3f36317c08c508afad86377db0cdb	False	0.08995863970588236	data	1.1508312506719705	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.idata	0x21000	0x1152	0x1200	22cea6459adbaabc5f692817bd50e786	False	0.2921006944444444	data	3.6744231176525632	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.msvcjmc	0x23000	0x1c0	0x200	b9afd0ce60466fac045d606a18261724	False	0.033203125	Targa image data - Map (257-257) 257 x 257 x 1 +257 +257 - 1-bit alpha "\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001"	0.9129992135852473	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.00cfg	0x24000	0x175	0x200	f62b789ab6203f99bbd294a1b989478c	False	0.06640625	data	0.46454760634715014	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x25000	0x43c	0x600	70143e4401b8ff04168516e4dd17d259	False	0.18098958333333334	data	2.1429708819311997	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x26000	0x27c	0x400	7390fcb231707fb6aca0d7f0c1661920	False	0.119140625	data	0.7654841675655041	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x25170	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
USER32.dll	GetDC, ReleaseDC, GetSystemMetrics, LoadIconW, GetDesktopWindow, ScreenToClient, GetCursorPos, DrawIcon, SetCursorPos
GDI32.dll	CreateDIBSection, SelectObject, DeleteDC, BitBlt, CreateCompatibleDC, Ellipse, DeleteObject, CreateSolidBrush
VCRUNTIME140D.dll	__std_type_info_destroy_list, __vcrt_GetModuleFileNameW, __C_specific_handler, memcpy, __current_exception, __current_exception_context, __vcrt_GetModuleHandleW, __vcrt_LoadLibraryExW, __C_specific_handler_noexcept
ucrtbased.dll	_crt_at_quick_exit, terminate, _wmakepath_s, _wsplitpath_s, wcscpy_s, _crt_atexit, _execute_onexit_table, _register_onexit_function, _initialize_onexit_table, _seh_filter_dll, __stdio_common_vsprintf_s, strcpy_s, __p__commode, _set_new_mode, _configthreadlocale, _register_thread_local_exe_atexit_callback, _c_exit, _cexit, __p___argv, __p___argc, _set_fmode, _exit, exit, _initterm_e, _initterm, _get_initial_narrow_environment, _initialize_narrow_environment, _configure_narrow_argv, __setusermatherr, _set_app_type, _seh_filter_exe, _CrtDbgReportW, _CrtDbgReport, strcat_s, _time64, rand, srand
KERNEL32.dll	RaiseException, IsDebuggerPresent, HeapFree, MultiByteToWideChar, WideCharToMultiByte, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, GetProcAddress, FreeLibrary, VirtualQuery, GetProcessHeap, GetCurrentThreadId, HeapAlloc, GetLastError, GetModuleHandleW, GetStartupInfoW, InitializeSListHead, GetSystemTimeAsFileTime, GetCurrentProcessId, QueryPerformanceCounter, Sleep

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

• Salinewin.exe-LikePayload.exe
• conhost.exe

Click to jump to process

Click to jump to process

Behavior

• Salinewin.exe-LikePayload.exe
• conhost.exe

Click to jump to process

Target ID:	0
Start time:	16:31:22
Start date:	13/04/2025
Path:	C:\Users\user\Desktop\Salinewin.exe-LikePayload.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Salinewin.exe-LikePayload.exe"
Imagebase:	0x7ff6034c0000
File size:	64'000 bytes
MD5 hash:	15B2CBEEB181E76F548CC88224C4F64A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	16:31:22
Start date:	13/04/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7e2000000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Function 00007FF6034D5E00 Relevance: 44.1, APIs: 24, Strings: 1, Instructions: 318windowsleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6034D137F: GetCurrentThreadId.KERNEL32 ref: 00007FF6034D1E38

Part of subcall function 00007FF6034D17E0: _time64.UCRTBASED ref: 00007FF6034D1807

srand.UCRTBASED ref: 00007FF6034D5E56
GetSystemMetrics.USER32 ref: 00007FF6034D5E5F
GetSystemMetrics.USER32 ref: 00007FF6034D5E6D
GetDC.USER32 ref: 00007FF6034D5E78
CreateCompatibleDC.GDI32 ref: 00007FF6034D5E86
CreateDIBSection.GDI32 ref: 00007FF6034D5F12
SelectObject.GDI32 ref: 00007FF6034D5F2A
GetDC.USER32 ref: 00007FF6034D5F6F
BitBlt.GDI32 ref: 00007FF6034D5FAE
BitBlt.GDI32 ref: 00007FF6034D606B
rand.UCRTBASED ref: 00007FF6034D6072
rand.UCRTBASED ref: 00007FF6034D608B
rand.UCRTBASED ref: 00007FF6034D60B1
CreateSolidBrush.GDI32 ref: 00007FF6034D60D3
SelectObject.GDI32 ref: 00007FF6034D60EB
Ellipse.GDI32 ref: 00007FF6034D612A
GetCursorPos.USER32 ref: 00007FF6034D61BC
rand.UCRTBASED ref: 00007FF6034D61CA
rand.UCRTBASED ref: 00007FF6034D61EB
SetCursorPos.USER32 ref: 00007FF6034D6336
Sleep.KERNEL32 ref: 00007FF6034D6359
DeleteObject.GDI32 ref: 00007FF6034D6367
ReleaseDC.USER32 ref: 00007FF6034D6374
DeleteDC.GDI32 ref: 00007FF6034D637F

Strings

, xrefs: 00007FF6034D6036

Memory Dump Source

Source File: 00000000.00000002.2614569903.00007FF6034D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6034C0000, based on PE: true

Associated: 00000000.00000002.2614550947.00007FF6034C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614569903.00007FF6034D8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614600473.00007FF6034DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614616374.00007FF6034DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614631371.00007FF6034E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614645863.00007FF6034E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614660755.00007FF6034E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6034c0000_Salinewin.jbxd

Similarity

API ID: rand$CreateObject$CursorDeleteMetricsSelectSystem$BrushCompatibleCurrentEllipseReleaseSectionSleepSolidThread_time64srand
String ID:
API String ID: 2435039670-3916222277
Opcode ID: 755fec347b2c616cfbf7515448ec47bc49f52d1c5f0be63029d13352d55eba13
Instruction ID: a443ebf05a597e37f1addafba0bb361cb61d82c2e5bfe680ca2278a5c4ae8b8b
Opcode Fuzzy Hash: 755fec347b2c616cfbf7515448ec47bc49f52d1c5f0be63029d13352d55eba13
Instruction Fuzzy Hash: C6F1F0726056C28FD774DF38D9957E937E1EB4834AF104029E60ADBB58EF39AA44CB04

Function 00007FF6034D50D0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 253memorylibraryloaderCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00007FF6034D510C
GetProcAddress.KERNEL32 ref: 00007FF6034D51EF
GetProcessHeap.KERNEL32 ref: 00007FF6034D5367
HeapAlloc.KERNEL32 ref: 00007FF6034D537A
GetProcessHeap.KERNEL32 ref: 00007FF6034D5423
HeapFree.KERNEL32 ref: 00007FF6034D5431

Strings

PDBOpenValidate5, xrefs: 00007FF6034D51E5

Memory Dump Source

Source File: 00000000.00000002.2614569903.00007FF6034D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6034C0000, based on PE: true

Associated: 00000000.00000002.2614550947.00007FF6034C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614569903.00007FF6034D8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614600473.00007FF6034DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614616374.00007FF6034DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614631371.00007FF6034E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614645863.00007FF6034E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614660755.00007FF6034E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6034c0000_Salinewin.jbxd

Similarity

API ID: Heap$Process$AddressAllocFreeProcQueryVirtual
String ID: PDBOpenValidate5
API String ID: 1898765391-413491164
Opcode ID: 4b9a9baed6868698968b0d8dd6be461839e458aac491d51a3895ed7633f22220
Instruction ID: a05350e486e60f96832f53cfb1d2f65aff9a4f36514915293c113f5a1becdb52
Opcode Fuzzy Hash: 4b9a9baed6868698968b0d8dd6be461839e458aac491d51a3895ed7633f22220
Instruction Fuzzy Hash: 85B13A36B08B1686EB10CF66E48166D33A1FB89B8AB204135DE4DEBB64DF3CE545C700

Function 00007FF6034D4020 Relevance: 10.6, APIs: 7, Instructions: 83COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6034D4031
RtlCaptureContext.KERNEL32 ref: 00007FF6034D406C
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6034D408C
RtlVirtualUnwind.KERNEL32 ref: 00007FF6034D40DA
IsDebuggerPresent.KERNEL32 ref: 00007FF6034D413F
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6034D417B
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6034D4186

Memory Dump Source

Source File: 00000000.00000002.2614569903.00007FF6034D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6034C0000, based on PE: true

Associated: 00000000.00000002.2614550947.00007FF6034C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614569903.00007FF6034D8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614600473.00007FF6034DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614616374.00007FF6034DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614631371.00007FF6034E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614645863.00007FF6034E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614660755.00007FF6034E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6034c0000_Salinewin.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 7e866063b8cc79ab1bf4cc05d227a982b8d9528419544e26597b90383927b54a
Instruction ID: ee1c0ef649a246bc096f64a42e12a2eb779c6813aefb3d39e1db2f5e42854305
Opcode Fuzzy Hash: 7e866063b8cc79ab1bf4cc05d227a982b8d9528419544e26597b90383927b54a
Instruction Fuzzy Hash: B041E632608BC586E7608B15F4453AAB7A5F789742F600136DA8D97BA9EF3DC558CB00

Function 00007FF6034D2F70 Relevance: 6.0, APIs: 4, Instructions: 13COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6034D2F7B
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6034D2F86
GetCurrentProcess.KERNEL32 ref: 00007FF6034D2F8C
TerminateProcess.KERNEL32 ref: 00007FF6034D2F9A

Memory Dump Source

Source File: 00000000.00000002.2614569903.00007FF6034D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6034C0000, based on PE: true

Associated: 00000000.00000002.2614550947.00007FF6034C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614569903.00007FF6034D8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614600473.00007FF6034DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614616374.00007FF6034DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614631371.00007FF6034E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614645863.00007FF6034E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614660755.00007FF6034E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6034c0000_Salinewin.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: acf8eb23df1ed76f60f0603f437fc5b43d84170defd75ba25f2fb4af47c804f8
Instruction ID: bfb5633fed410198c384410efd8e68d5e0491f09180b2cecbff1e1552139e27f
Opcode Fuzzy Hash: acf8eb23df1ed76f60f0603f437fc5b43d84170defd75ba25f2fb4af47c804f8
Instruction Fuzzy Hash: 90D06225A5578186DB04EB63F85A02D2260BB85B43F705435D54FD6624DE3CD5994700

Function 00007FF6034D5590 Relevance: 1.5, Strings: 1, Instructions: 283COMMON

Download Yara Rule

Strings

$, xrefs: 00007FF6034D581C

Memory Dump Source

Source File: 00000000.00000002.2614569903.00007FF6034D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6034C0000, based on PE: true

Associated: 00000000.00000002.2614550947.00007FF6034C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614569903.00007FF6034D8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614600473.00007FF6034DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614616374.00007FF6034DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614631371.00007FF6034E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614645863.00007FF6034E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614660755.00007FF6034E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6034c0000_Salinewin.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: d7a9e96e1e3134ce42b3c729a084e1fb3ff7e742bac96f79326622650014127d
Instruction ID: 0a8a8d26dd76e828962ba5532fa9e5573c318fd013f94e9f0deb419458c191c7
Opcode Fuzzy Hash: d7a9e96e1e3134ce42b3c729a084e1fb3ff7e742bac96f79326622650014127d
Instruction Fuzzy Hash: EBD10B72A196418BEB55CB28F442329B7E0EB89355F244636E6ADDF7A4DF3CE4448F00

Function 00007FF6034D123A Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6034D439B

Memory Dump Source

Source File: 00000000.00000002.2614569903.00007FF6034D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6034C0000, based on PE: true

Associated: 00000000.00000002.2614550947.00007FF6034C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614569903.00007FF6034D8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614600473.00007FF6034DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614616374.00007FF6034DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614631371.00007FF6034E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614645863.00007FF6034E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614660755.00007FF6034E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6034c0000_Salinewin.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 76f3e4a83e66cacd52616146fcd58a79611a5d4ac741b69ae0dd79f0432d3c68
Instruction ID: 6ddb13ab6143f7bded2b81d5ed81723e64076549e87abafe0d234952e8dcad10
Opcode Fuzzy Hash: 76f3e4a83e66cacd52616146fcd58a79611a5d4ac741b69ae0dd79f0432d3c68
Instruction Fuzzy Hash: 02B09B26E05542C1D704A723EC4703811206B5D343FF04431C40DE4D505E3C525A4700

Function 00007FF6034D2570 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 70COMMON

Download Yara Rule

APIs

failwithmessage.LIBCMTD ref: 00007FF6034D25BB

Part of subcall function 00007FF6034D29C0: MultiByteToWideChar.KERNEL32 ref: 00007FF6034D2A31
Part of subcall function 00007FF6034D29C0: MultiByteToWideChar.KERNEL32 ref: 00007FF6034D2A63
Part of subcall function 00007FF6034D29C0: DebuggerProbe.LIBCMTD ref: 00007FF6034D2A81
Part of subcall function 00007FF6034D29C0: DebuggerRuntime.LIBCMTD ref: 00007FF6034D2A9C
Part of subcall function 00007FF6034D29C0: IsDebuggerPresent.KERNEL32 ref: 00007FF6034D2ABF

failwithmessage.LIBCMTD ref: 00007FF6034D269D

Strings

Data: <, xrefs: 00007FF6034D263E
Size: , xrefs: 00007FF6034D2668
%s%s%p%s%zd%s%d%s%s%s%s%s, xrefs: 00007FF6034D2619
Address: 0x, xrefs: 00007FF6034D2674
Stack area around _alloca memory reserved by this function is corrupted, xrefs: 00007FF6034D2601
Stack area around _alloca memory reserved by this function is corrupted, xrefs: 00007FF6034D25AC
Allocation number within this function: , xrefs: 00007FF6034D264A

Memory Dump Source

Source File: 00000000.00000002.2614569903.00007FF6034D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6034C0000, based on PE: true

Associated: 00000000.00000002.2614550947.00007FF6034C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614569903.00007FF6034D8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614600473.00007FF6034DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614616374.00007FF6034DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614631371.00007FF6034E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614645863.00007FF6034E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614660755.00007FF6034E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6034c0000_Salinewin.jbxd

Similarity

API ID: Debugger$ByteCharMultiWidefailwithmessage$PresentProbeRuntime
String ID: Address: 0x$Allocation number within this function: $Data: <$Size: $%s%s%p%s%zd%s%d%s%s%s%s%s$Stack area around _alloca memory reserved by this function is corrupted$Stack area around _alloca memory reserved by this function is corrupted
API String ID: 3941055102-3301296223
Opcode ID: 91dd88d2c0d5f5eb224572a133cd459818b898a550ab036cbe0ae0ecf56e025b
Instruction ID: 29814914cdc2c61f0b6083a82fd614e88bf5c29b1113d6c8a324a145b4d120e8
Opcode Fuzzy Hash: 91dd88d2c0d5f5eb224572a133cd459818b898a550ab036cbe0ae0ecf56e025b
Instruction Fuzzy Hash: 89316F36608B8691EB21CB50F4413EA7364FB88395F604136DA9DEBB64DF3CD159C700

Function 00007FF6034D4A60 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

GetPdbDllFromInstallPath.LIBCMTD ref: 00007FF6034D4A8D

Part of subcall function 00007FF6034D4C20: GetLastError.KERNEL32 ref: 00007FF6034D4C8D
Part of subcall function 00007FF6034D4C20: GetProcAddress.KERNEL32 ref: 00007FF6034D4CBF
Part of subcall function 00007FF6034D4C20: GetProcAddress.KERNEL32 ref: 00007FF6034D4CD7
Part of subcall function 00007FF6034D4C20: GetProcAddress.KERNEL32 ref: 00007FF6034D4CEF
Part of subcall function 00007FF6034D4C20: FreeLibrary.KERNEL32 ref: 00007FF6034D4D2E

GetLastError.KERNEL32 ref: 00007FF6034D4AFD
GetLastError.KERNEL32 ref: 00007FF6034D4B3C

Strings

MSPDB140, xrefs: 00007FF6034D4B25
VCRUNTIME140D.dll, xrefs: 00007FF6034D4A9B

Memory Dump Source

Source File: 00000000.00000002.2614569903.00007FF6034D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6034C0000, based on PE: true

Associated: 00000000.00000002.2614550947.00007FF6034C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614569903.00007FF6034D8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614600473.00007FF6034DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614616374.00007FF6034DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614631371.00007FF6034E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614645863.00007FF6034E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614660755.00007FF6034E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6034c0000_Salinewin.jbxd

Similarity

API ID: AddressErrorLastProc$FreeFromInstallLibraryPath
String ID: MSPDB140$VCRUNTIME140D.dll
API String ID: 3575457754-1916464790
Opcode ID: 0c7957e02e5c95d1d88736b59ceefa93d151f6521933437dcc39f3afb345d3b3
Instruction ID: c2b0e05c98858527cbf6c7bdba74b323c2a820886a544ae214e2085752d5b102
Opcode Fuzzy Hash: 0c7957e02e5c95d1d88736b59ceefa93d151f6521933437dcc39f3afb345d3b3
Instruction Fuzzy Hash: A3314F61F1C68251FFB0E722A4933B92290AFA5746FA45035D98DEEBD6EE7CE104C710

Function 00007FF6034D109F Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 48COMMON

Download Yara Rule

APIs

failwithmessage.LIBCMTD ref: 00007FF6034D2D8F

Strings

' is being used without being initialized., xrefs: 00007FF6034D2D5B
A variable is being used without being initialized., xrefs: 00007FF6034D2D78
The variable ', xrefs: 00007FF6034D2D33

Memory Dump Source

Source File: 00000000.00000002.2614569903.00007FF6034D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6034C0000, based on PE: true

Associated: 00000000.00000002.2614550947.00007FF6034C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614569903.00007FF6034D8000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614600473.00007FF6034DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614616374.00007FF6034DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614631371.00007FF6034E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614645863.00007FF6034E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2614660755.00007FF6034E5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6034c0000_Salinewin.jbxd

Similarity

API ID: failwithmessage
String ID: ' is being used without being initialized.$A variable is being used without being initialized.$The variable '
API String ID: 2105582474-1190422910
Opcode ID: 340423407e9d8b663238c9d4e33a229077a71e6a287aafd0c86197b95826798f
Instruction ID: 3979450f2de0b5fa8872987053ad79dad0d15ec0999ddbaef0662180bedc4217
Opcode Fuzzy Hash: 340423407e9d8b663238c9d4e33a229077a71e6a287aafd0c86197b95826798f
Instruction Fuzzy Hash: 79115151B0C68242E7609B10E4123F92360AF8975AFA40532DB8DEB69ACE3CD5468744

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Salinewin.exe-LikePayload.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: Salinewin.exe-LikePayload.exePID: 7648, Parent PID: 3084

General

File Activities

File Opened

File Created

File Attributes Queried

Volume Information Queried

Device IO

Section Activities

Sections loaded by Windows

Registry Activities

Key Opened

Windows Analysis Report
Salinewin.exe-LikePayload.exe