Play interactive tour

Edit tour

Analysis Report PO-75013.scr

Overview

General Information

Sample Name:	PO-75013.scr (renamed file extension from scr to exe)
Analysis ID:	338942
MD5:	e7e6ee6ef97ff797562c91e0ff401ac4
SHA1:	d1ec737c87a9c0a91456f1019106b77ee2e03980
SHA256:	7eb2de2bfd05ee1e83980aa914486789d2e8f3fb3cc6e166f140302fdaf40cd9
Tags:	scr
Most interesting Screenshot:

Detection

Snake Keylogger

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected MultiObfuscated

Yara detected Snake Keylogger

Allocates memory in foreign processes

Drops PE files to the user root directory

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

May check the online IP address of the machine

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Writes to foreign memory regions

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the user directory

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains strange resources

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Uses reg.exe to modify the Windows registry

Classification

Startup

System is w10x64

PO-75013.exe (PID: 6904 cmdline: 'C:\Users\user\Desktop\PO-75013.exe' MD5: E7E6EE6EF97FF797562C91E0FF401AC4)

cmd.exe (PID: 6992 cmdline: 'cmd.exe' /c REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' /f /v 'explore' /t REG_SZ /d 'C:\Users\user\explore.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 7000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

reg.exe (PID: 7048 cmdline: REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' /f /v 'explore' /t REG_SZ /d 'C:\Users\user\explore.exe' MD5: CEE2A7E57DF2A159A065A34913A055C2)

MpCmdRun.exe (PID: 7104 cmdline: 'C:\Program Files\Windows Defender\mpcmdrun.exe' -wdenable MD5: A267555174BFA53844371226F482B86B)

conhost.exe (PID: 5948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

explore.exe (PID: 6200 cmdline: 'C:\Users\user\explore.exe' MD5: E7E6EE6EF97FF797562C91E0FF401AC4)

explore.exe (PID: 2152 cmdline: 'C:\Users\user\explore.exe' MD5: E7E6EE6EF97FF797562C91E0FF401AC4)

explore.exe (PID: 6968 cmdline: 'C:\Users\user\explore.exe' MD5: E7E6EE6EF97FF797562C91E0FF401AC4)

InstallUtil.exe (PID: 6316 cmdline: C:\Users\user~1\AppData\Local\Temp\InstallUtil.exe MD5: EFEC8C379D165E3F33B536739AEE26A3)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.277366713.0000000003C9C000.00000004.00000001.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.276366606.0000000003AB1000.00000004.00000001.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: PO-75013.exe PID: 6904	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: PO-75013.exe PID: 6904	JoeSecurity_MultiObfuscated	Yara detected MultiObfuscated	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

Source: PO-75013.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: unknown

HTTPS traffic detected: 104.28.4.151:443 -> 192.168.2.7:49744 version: TLS 1.0

Source: PO-75013.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source:	Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: InstallUtil.exe, 00000011.00000000.318356080.00000000003E2000.00000002.00020000.sdmp, InstallUtil.exe.0.dr
Source:	Binary string: InstallUtil.pdb source: InstallUtil.exe, 00000011.00000000.318356080.00000000003E2000.00000002.00020000.sdmp, InstallUtil.exe.0.dr

Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 4x nop then jmp 00C2F626h	0_2_00C2EE1A
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 4x nop then jmp 00C2F626h	0_2_00C2EE50
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 4x nop then mov esp, ebp	0_2_04EAC6A0
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	0_2_04EADAA9
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 4x nop then push dword ptr [ebp-20h]	0_2_04EA46AB
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	0_2_04EA46AB
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 4x nop then push dword ptr [ebp-20h]	0_2_04EA46B0
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	0_2_04EA46B0
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	0_2_04EA41D7
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	0_2_04EA5C68
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	0_2_04EA3C14
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	0_2_04EAAF50
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 4x nop then xor edx, edx	0_2_04EA48FD
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 4x nop then push dword ptr [ebp-24h]	0_2_04EA49C4
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	0_2_04EA49C4
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 4x nop then push dword ptr [ebp-24h]	0_2_04EA49D0
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	0_2_04EA49D0
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 4x nop then xor edx, edx	0_2_04EA4908

Networking:

May check the online IP address of the machine

Show sources

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: checkip.dyndns.org

Source: Joe Sandbox View	IP Address: 162.88.193.70 162.88.193.70
Source: Joe Sandbox View	IP Address: 104.28.4.151 104.28.4.151

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown

HTTPS traffic detected: 104.28.4.151:443 -> 192.168.2.7:49744 version: TLS 1.0

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown

DNS traffic detected: queries for: checkip.dyndns.org

Source: PO-75013.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: PO-75013.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: PO-75013.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: PO-75013.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: PO-75013.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: PO-75013.exe	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: PO-75013.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: PO-75013.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: PO-75013.exe	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: PO-75013.exe, 00000000.00000003.272434959.0000000000FC9000.00000004.00000001.sdmp	String found in binary or memory: http://iptc.org/mpCore
Source: PO-75013.exe, 00000000.00000003.272434959.0000000000FC9000.00000004.00000001.sdmp	String found in binary or memory: http://n._
Source: PO-75013.exe, 00000000.00000003.272434959.0000000000FC9000.00000004.00000001.sdmp	String found in binary or memory: http://ns.adp/1.0/
Source: PO-75013.exe, 00000000.00000003.272434959.0000000000FC9000.00000004.00000001.sdmp	String found in binary or memory: http://ns.ao
Source: PO-75013.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: PO-75013.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: PO-75013.exe	String found in binary or memory: http://ocsp.digicert.com0H
Source: PO-75013.exe	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: PO-75013.exe	String found in binary or memory: https://www.digicert.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443

Source: explore.exe, 00000005.00000002.277648767.0000000000B69000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_00C299F8	0_2_00C299F8
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_00C2A4F0	0_2_00C2A4F0
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_00C2BC20	0_2_00C2BC20
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_00C2D6E0	0_2_00C2D6E0
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_00C276F0	0_2_00C276F0
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_00C2F650	0_2_00C2F650
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_00C2EE1A	0_2_00C2EE1A
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_00C23FD8	0_2_00C23FD8
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_00C2F64F	0_2_00C2F64F
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_00C2EE50	0_2_00C2EE50
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_04EAB5F1	0_2_04EAB5F1
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_04EAB600	0_2_04EAB600
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_04EA572A	0_2_04EA572A
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_04EA5738	0_2_04EA5738
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_04EA0188	0_2_04EA0188
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_04EA5188	0_2_04EA5188
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_04EA5178	0_2_04EA5178
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_04EA517F	0_2_04EA517F
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_04EAC110	0_2_04EAC110
Source: C:\Users\user\explore.exe	Code function: 5_2_00EE9A08	5_2_00EE9A08
Source: C:\Users\user\explore.exe	Code function: 5_2_00EEBC30	5_2_00EEBC30
Source: C:\Users\user\explore.exe	Code function: 5_2_00EEA500	5_2_00EEA500
Source: C:\Users\user\explore.exe	Code function: 5_2_00EED6F0	5_2_00EED6F0
Source: C:\Users\user\explore.exe	Code function: 5_2_00EE3FD8	5_2_00EE3FD8
Source: C:\Users\user\explore.exe	Code function: 5_2_00EE99F8	5_2_00EE99F8
Source: C:\Users\user\explore.exe	Code function: 5_2_00EEA4F0	5_2_00EEA4F0
Source: C:\Users\user\explore.exe	Code function: 5_2_00EEBC20	5_2_00EEBC20
Source: C:\Users\user\explore.exe	Code function: 5_2_00EED6E0	5_2_00EED6E0
Source: C:\Users\user\explore.exe	Code function: 6_2_012A9A08	6_2_012A9A08
Source: C:\Users\user\explore.exe	Code function: 6_2_012AA500	6_2_012AA500
Source: C:\Users\user\explore.exe	Code function: 6_2_012ABC30	6_2_012ABC30
Source: C:\Users\user\explore.exe	Code function: 6_2_012A3FD8	6_2_012A3FD8
Source: C:\Users\user\explore.exe	Code function: 6_2_012A76F0	6_2_012A76F0
Source: C:\Users\user\explore.exe	Code function: 6_2_012AD6F0	6_2_012AD6F0
Source: C:\Users\user\explore.exe	Code function: 6_2_012A99F8	6_2_012A99F8
Source: C:\Users\user\explore.exe	Code function: 6_2_012ABC20	6_2_012ABC20
Source: C:\Users\user\explore.exe	Code function: 6_2_012AA4F0	6_2_012AA4F0
Source: C:\Users\user\explore.exe	Code function: 6_2_012AD6E0	6_2_012AD6E0

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\InstallUtil.exe 46DEE184523A584E56DF93389F81992911A1BA6B1F05AD7D803C6AB1450E18CB

Source: PO-75013.exe

Static PE information: invalid certificate

Source: PO-75013.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: explore.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: PO-75013.exe, 00000000.00000002.274910073.0000000002890000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSHCore1.dll0 vs PO-75013.exe
Source: PO-75013.exe, 00000000.00000002.281922390.0000000005890000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs PO-75013.exe
Source: PO-75013.exe, 00000000.00000002.281922390.0000000005890000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs PO-75013.exe
Source: PO-75013.exe, 00000000.00000002.276366606.0000000003AB1000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameRICSSWYL.exe4 vs PO-75013.exe
Source: PO-75013.exe, 00000000.00000002.274615352.0000000002780000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs PO-75013.exe
Source: PO-75013.exe, 00000000.00000002.281061800.0000000005700000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs PO-75013.exe

Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe

Section loaded: dwmapi.dll

Jump to behavior

Source: PO-75013.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: unknown

Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' /f /v 'explore' /t REG_SZ /d 'C:\Users\user\explore.exe'

Source: classification engine

Classification label: mal88.troj.spyw.evad.winEXE@14/6@3/3

Source: C:\Users\user\Desktop\PO-75013.exe

File created: C:\Users\user\explore.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7000:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5948:120:WilError_01

Source: C:\Users\user\Desktop\PO-75013.exe

File created: C:\Users\user~1\AppData\Local\Temp\InstallUtil.exe

Jump to behavior

Source: PO-75013.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PO-75013.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\explore.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\explore.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\explore.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: C:\Users\user\Desktop\PO-75013.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\PO-75013.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Users\user\Desktop\PO-75013.exe

File read: C:\Users\user\Desktop\PO-75013.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PO-75013.exe 'C:\Users\user\Desktop\PO-75013.exe'
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe 'cmd.exe' /c REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' /f /v 'explore' /t REG_SZ /d 'C:\Users\user\explore.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' /f /v 'explore' /t REG_SZ /d 'C:\Users\user\explore.exe'
Source: unknown	Process created: C:\Users\user\explore.exe 'C:\Users\user\explore.exe'
Source: unknown	Process created: C:\Users\user\explore.exe 'C:\Users\user\explore.exe'
Source: unknown	Process created: C:\Users\user\explore.exe 'C:\Users\user\explore.exe'
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\InstallUtil.exe C:\Users\user~1\AppData\Local\Temp\InstallUtil.exe
Source: unknown	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe 'C:\Program Files\Windows Defender\mpcmdrun.exe' -wdenable
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PO-75013.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'cmd.exe' /c REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' /f /v 'explore' /t REG_SZ /d 'C:\Users\user\explore.exe'	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process created: C:\Users\user\explore.exe 'C:\Users\user\explore.exe'	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' /f /v 'explore' /t REG_SZ /d 'C:\Users\user\explore.exe'	Jump to behavior
Source: C:\Users\user\explore.exe	Process created: C:\Users\user\AppData\Local\Temp\InstallUtil.exe C:\Users\user~1\AppData\Local\Temp\InstallUtil.exe	Jump to behavior

Source: C:\Users\user\Desktop\PO-75013.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\PO-75013.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: PO-75013.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: PO-75013.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: PO-75013.exe

Static file information: File size 1634760 > 1048576

Source: PO-75013.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x162e00

Source: PO-75013.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source:	Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: InstallUtil.exe, 00000011.00000000.318356080.00000000003E2000.00000002.00020000.sdmp, InstallUtil.exe.0.dr
Source:	Binary string: InstallUtil.pdb source: InstallUtil.exe, 00000011.00000000.318356080.00000000003E2000.00000002.00020000.sdmp, InstallUtil.exe.0.dr

Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_00348136 pushfd ; ret	0_2_0034814C
Source: C:\Users\user\Desktop\PO-75013.exe	Code function: 0_2_00C27494 pushad ; retf	0_2_00C27495
Source: C:\Users\user\explore.exe	Code function: 5_2_002D8136 pushfd ; ret	5_2_002D814C
Source: C:\Users\user\explore.exe	Code function: 5_2_00EE8980 push 84027BEDh; retf 00E7h	5_2_00EE8ADD
Source: C:\Users\user\explore.exe	Code function: 6_2_00768136 pushfd ; ret	6_2_0076814C
Source: C:\Users\user\explore.exe	Code function: 6_2_012A8980 push 840509EDh; retf 00FBh	6_2_012A8ADD

Source: C:\Users\user\Desktop\PO-75013.exe	File created: C:\Users\user\explore.exe			Jump to dropped file
Source: C:\Users\user\Desktop\PO-75013.exe	File created: C:\Users\user\AppData\Local\Temp\InstallUtil.exe			Jump to dropped file

Source: C:\Users\user\Desktop\PO-75013.exe

File created: C:\Users\user\explore.exe

Jump to dropped file

Boot Survival:

Drops PE files to the user root directory

Show sources

Source: C:\Users\user\Desktop\PO-75013.exe

File created: C:\Users\user\explore.exe

Jump to dropped file

Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run explore			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run explore			Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Users\user\Desktop\PO-75013.exe	File opened: C:\Users\user\Desktop\PO-75013.exe\:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Users\user\explore.exe	File opened: C:\Users\user\explore.exe\:Zone.Identifier read attributes \| delete			Jump to behavior

Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\explore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\PO-75013.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\Desktop\PO-75013.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\explore.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\explore.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\explore.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\explore.exe	Window / User API: threadDelayed 834			Jump to behavior
Source: C:\Users\user\explore.exe	Window / User API: threadDelayed 4100			Jump to behavior

Source: C:\Users\user\Desktop\PO-75013.exe TID: 7084	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe TID: 7096	Thread sleep count: 69 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe TID: 7096	Thread sleep count: 102 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe TID: 6924	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\explore.exe TID: 6256	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\explore.exe TID: 5996	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\explore.exe TID: 5424	Thread sleep count: 195 > 30	Jump to behavior
Source: C:\Users\user\explore.exe TID: 5424	Thread sleep time: -195000s >= -30000s	Jump to behavior
Source: C:\Users\user\explore.exe TID: 2848	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Users\user\explore.exe TID: 4812	Thread sleep count: 834 > 30	Jump to behavior
Source: C:\Users\user\explore.exe TID: 4812	Thread sleep count: 4100 > 30	Jump to behavior
Source: C:\Users\user\explore.exe TID: 976	Thread sleep count: 180 > 30	Jump to behavior
Source: C:\Users\user\explore.exe TID: 976	Thread sleep time: -180000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: explore.exe, 00000006.00000002.279631204.0000000003BB1000.00000004.00000001.sdmp	Binary or memory string: VMware
Source: explore.exe, 00000006.00000002.279631204.0000000003BB1000.00000004.00000001.sdmp	Binary or memory string: vmware svga
Source: PO-75013.exe, 00000000.00000002.281061800.0000000005700000.00000002.00000001.sdmp, reg.exe, 00000003.00000002.245256089.0000000002E00000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explore.exe, 00000006.00000002.279631204.0000000003BB1000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: PO-75013.exe, 00000000.00000002.274910073.0000000002890000.00000004.00000001.sdmp, explore.exe, 00000005.00000002.278748395.00000000038E1000.00000004.00000001.sdmp, explore.exe, 00000006.00000002.279631204.0000000003BB1000.00000004.00000001.sdmp	Binary or memory string: tpautoconnsvc#Microsoft Hyper-V
Source: PO-75013.exe, 00000000.00000002.274910073.0000000002890000.00000004.00000001.sdmp, explore.exe, 00000005.00000002.278748395.00000000038E1000.00000004.00000001.sdmp, explore.exe, 00000006.00000002.279631204.0000000003BB1000.00000004.00000001.sdmp	Binary or memory string: cmd.txtQEMUqemu
Source: PO-75013.exe, 00000000.00000002.274910073.0000000002890000.00000004.00000001.sdmp, explore.exe, 00000005.00000002.278748395.00000000038E1000.00000004.00000001.sdmp, explore.exe, 00000006.00000002.279631204.0000000003BB1000.00000004.00000001.sdmp	Binary or memory string: vmusrvc
Source: explore.exe, 00000006.00000002.279631204.0000000003BB1000.00000004.00000001.sdmp	Binary or memory string: vmsrvc
Source: explore.exe, 00000006.00000002.279631204.0000000003BB1000.00000004.00000001.sdmp	Binary or memory string: vmtools
Source: explore.exe, 00000006.00000002.279631204.0000000003BB1000.00000004.00000001.sdmp	Binary or memory string: vmware sata5vmware usb pointing device-vmware vmci bus deviceCvmware virtual s scsi disk device
Source: explore.exe, 00000006.00000002.279631204.0000000003BB1000.00000004.00000001.sdmp	Binary or memory string: vboxservicevbox)Microsoft Virtual PC
Source: PO-75013.exe, 00000000.00000002.281061800.0000000005700000.00000002.00000001.sdmp, reg.exe, 00000003.00000002.245256089.0000000002E00000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: PO-75013.exe, 00000000.00000002.281061800.0000000005700000.00000002.00000001.sdmp, reg.exe, 00000003.00000002.245256089.0000000002E00000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explore.exe, 00000006.00000002.279631204.0000000003BB1000.00000004.00000001.sdmp	Binary or memory string: virtual-vmware pointing device
Source: PO-75013.exe, 00000000.00000002.281061800.0000000005700000.00000002.00000001.sdmp, reg.exe, 00000003.00000002.245256089.0000000002E00000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\PO-75013.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\PO-75013.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\explore.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\explore.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\explore.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\PO-75013.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Allocates memory in foreign processes

Show sources

Source: C:\Users\user\explore.exe

Memory allocated: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 7B0000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\explore.exe

Memory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 7B0000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Show sources

Source: C:\Users\user\explore.exe	Memory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 7B0000	Jump to behavior
Source: C:\Users\user\explore.exe	Memory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 7B2000	Jump to behavior
Source: C:\Users\user\explore.exe	Memory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 814000	Jump to behavior
Source: C:\Users\user\explore.exe	Memory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 816000	Jump to behavior
Source: C:\Users\user\explore.exe	Memory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 4AA008	Jump to behavior

Source: C:\Users\user\Desktop\PO-75013.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'cmd.exe' /c REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' /f /v 'explore' /t REG_SZ /d 'C:\Users\user\explore.exe'	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Process created: C:\Users\user\explore.exe 'C:\Users\user\explore.exe'	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' /f /v 'explore' /t REG_SZ /d 'C:\Users\user\explore.exe'	Jump to behavior
Source: C:\Users\user\explore.exe	Process created: C:\Users\user\AppData\Local\Temp\InstallUtil.exe C:\Users\user~1\AppData\Local\Temp\InstallUtil.exe	Jump to behavior

Source: C:\Users\user\Desktop\PO-75013.exe	Queries volume information: C:\Users\user\Desktop\PO-75013.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-75013.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\explore.exe	Queries volume information: C:\Users\user\explore.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\explore.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\explore.exe	Queries volume information: C:\Users\user\explore.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\explore.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\explore.exe	Queries volume information: C:\Users\user\explore.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\explore.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\explore.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PO-75013.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\SysWOW64\reg.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\SysWOW64\reg.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\SysWOW64\reg.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\SysWOW64\reg.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct

Stealing of Sensitive Information:

Yara detected Snake Keylogger

Show sources

Source: Yara match	File source: 00000000.00000002.277366713.0000000003C9C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.276366606.0000000003AB1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO-75013.exe PID: 6904, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies			Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Remote Access Functionality:

Yara detected Snake Keylogger

Show sources

Source: Yara match	File source: 00000000.00000002.277366713.0000000003C9C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.276366606.0000000003AB1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO-75013.exe PID: 6904, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation1	DLL Side-Loading1	DLL Side-Loading1	Disable or Modify Tools1	OS Credential Dumping1	File and Directory Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Registry Run Keys / Startup Folder1	Process Injection311	Obfuscated Files or Information2	Input Capture1	System Information Discovery13	Remote Desktop Protocol	Data from Local System1	Exfiltration Over Bluetooth	Encrypted Channel12	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Registry Run Keys / Startup Folder1	DLL Side-Loading1	Security Account Manager	Security Software Discovery21	SMB/Windows Admin Shares	Email Collection1	Automated Exfiltration	Non-Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Masquerading111	NTDS	Virtualization/Sandbox Evasion3	Distributed Component Object Model	Input Capture1	Scheduled Transfer	Application Layer Protocol13	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Modify Registry1	LSA Secrets	Process Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Virtualization/Sandbox Evasion3	Cached Domain Credentials	Application Window Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Process Injection311	DCSync	Remote System Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Hidden Files and Directories1	Proc Filesystem	System Network Configuration Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\InstallUtil.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\InstallUtil.exe	0%	ReversingLabs

Unpacked PE Files

No Antivirus matches

Domains

Source	Detection	Scanner	Link
freegeoip.app	1%	Virustotal	Browse
checkip.dyndns.com	0%	Virustotal	Browse
checkip.dyndns.org	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
http://iptc.org/mpCore	0%	Avira URL Cloud	safe
http://checkip.dyndns.org/	0%	Avira URL Cloud	safe
http://ns.ao	0%	Avira URL Cloud	safe
http://n._	0%	Avira URL Cloud	safe
http://ns.adp/1.0/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
freegeoip.app	104.28.4.151	true	false	1%, Virustotal, Browse	unknown
checkip.dyndns.com	162.88.193.70	true	false	0%, Virustotal, Browse	unknown
checkip.dyndns.org	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://iptc.org/mpCore	PO-75013.exe, 00000000.00000003.272434959.0000000000FC9000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://ns.ao	PO-75013.exe, 00000000.00000003.272434959.0000000000FC9000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://n._	PO-75013.exe, 00000000.00000003.272434959.0000000000FC9000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://ns.adp/1.0/	PO-75013.exe, 00000000.00000003.272434959.0000000000FC9000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
162.88.193.70	unknown	United States		33517	DYNDNSUS	false
104.28.4.151	unknown	United States		13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	31.0.0 Red Diamond
Analysis ID:	338942
Start date:	13.01.2021
Start time:	08:04:54
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	PO-75013.scr (renamed file extension from scr to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	32
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal88.troj.spyw.evad.winEXE@14/6@3/3
EGA Information:	Failed
HDC Information:	Successful, ratio: 0% (good quality ratio 0%) Quality average: 82% Quality standard deviation: 0%
HCA Information:	Successful, ratio: 99% Number of executed functions: 30 Number of non-executed functions: 19
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 168.61.161.212, 52.147.198.201, 104.42.151.234, 92.122.144.200, 51.104.144.132, 92.122.213.247, 92.122.213.194, 93.184.221.240, 51.103.5.186, 52.155.217.156, 20.54.26.129, 51.11.168.160 Excluded domains from analysis (whitelisted): arc.msn.com.nsatc.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, wns.notify.windows.com.akadns.net, arc.msn.com, wu.azureedge.net, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, par02p.wns.notify.windows.com.akadns.net, emea1.notify.windows.com.akadns.net, audownload.windowsupdate.nsatc.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, wu.wpc.apr-52dd2.edgecastdns.net, au-bg-shim.trafficmanager.net, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, client.wns.windows.com, fs.microsoft.com, wu.ec.azureedge.net, db3p-ris-pf-prod-atm.trafficmanager.net, displaycatalog.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, skypedataprdcolcus17.cloudapp.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus16.cloudapp.net Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:05:54	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run explore C:\Users\user\explore.exe
08:06:03	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run explore C:\Users\user\explore.exe
08:07:16	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
162.88.193.70	TD-10057.doc	Get hash	malicious	Browse	checkip.dyndns.org/
	wCRnCAMZ3yT8BQ2.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	PO_RFQ_2021_12_01 - s.doc	Get hash	malicious	Browse	checkip.dyndns.org/
	al9LrOC8eM.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	M4FBPQPaus.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	XaAUv98B2a.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	Su #U00faltima factura de DHL CMBR000563391.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	090-0000000000900.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	4G5zLURjk4.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	GF-6037.doc	Get hash	malicious	Browse	checkip.dyndns.org/
	6hE7zSMErZ.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	IKWSLxGlrQ.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	DSj7ak0N6I.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	n1hou07jRi.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	SZOSVrCvEl.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	iRldab2YJj.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	KGBnXF7AdP.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	Quotation 7339.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	COT26606 (1).pdf.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	00000000808000.exe	Get hash	malicious	Browse	checkip.dyndns.org/
104.28.4.151	wjSwL3KItA.exe	Get hash	malicious	Browse
	ndSscoDob9.exe	Get hash	malicious	Browse
	DXXJmIDl3C.exe	Get hash	malicious	Browse
	00000000000900SA.exe	Get hash	malicious	Browse
	090-0000000000900.exe	Get hash	malicious	Browse
	4G5zLURjk4.exe	Get hash	malicious	Browse
	TGS-1027.doc	Get hash	malicious	Browse
	SEe64c0h6A.exe	Get hash	malicious	Browse
	Quotation.exe	Get hash	malicious	Browse
	bank Acct Numbr-pdf.exe	Get hash	malicious	Browse
	PO# 2366.exe	Get hash	malicious	Browse
	n1hou07jRi.exe	Get hash	malicious	Browse
	lKRxa2Vb4W.exe	Get hash	malicious	Browse
	1hv5th1EwE.exe	Get hash	malicious	Browse
	JgDf7rDw7g.exe	Get hash	malicious	Browse
	9tSTgF9a3E.exe	Get hash	malicious	Browse
	iRldab2YJj.exe	Get hash	malicious	Browse
	Tax Invoices IN102738 IN102739 IN102740.exe	Get hash	malicious	Browse
	Quotation 7339.exe	Get hash	malicious	Browse
	kart bilgisizzz.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
freegeoip.app	ZwFwevQtlv.exe	Get hash	malicious	Browse	172.67.188.154
	ssDV3d9O9o.exe	Get hash	malicious	Browse	172.67.188.154
	wjSwL3KItA.exe	Get hash	malicious	Browse	104.28.4.151
	SecuriteInfo.com.Generic.mg.5a4b41327cabca49.exe	Get hash	malicious	Browse	104.28.5.151
	TD-10057.exe	Get hash	malicious	Browse	172.67.188.154
	NKP210102-NIT-SC2.exe	Get hash	malicious	Browse	172.67.188.154
	FedExAWB 772584418730.doc	Get hash	malicious	Browse	172.67.188.154
	TD-10057.doc	Get hash	malicious	Browse	172.67.188.154
	ndSscoDob9.exe	Get hash	malicious	Browse	104.28.4.151
	DXXJmIDl3C.exe	Get hash	malicious	Browse	104.28.4.151
	0YdVJ6vqhO.exe	Get hash	malicious	Browse	104.28.5.151
	ku7PCBVgfP.exe	Get hash	malicious	Browse	172.67.188.154
	00000000000900SA.exe	Get hash	malicious	Browse	104.28.4.151
	wCRnCAMZ3yT8BQ2.exe	Get hash	malicious	Browse	172.67.188.154
	PO_RFQ_2021_12_01.exe	Get hash	malicious	Browse	172.67.188.154
	BxiS9KHIxj.exe	Get hash	malicious	Browse	172.67.188.154
	PO_RFQ_2021_12_01 - s.doc	Get hash	malicious	Browse	172.67.188.154
	al9LrOC8eM.exe	Get hash	malicious	Browse	104.28.5.151
	M4FBPQPaus.exe	Get hash	malicious	Browse	104.28.5.151
	hcL39YT1CR.exe	Get hash	malicious	Browse	104.28.5.151
checkip.dyndns.com	ZwFwevQtlv.exe	Get hash	malicious	Browse	216.146.43.71
	ssDV3d9O9o.exe	Get hash	malicious	Browse	216.146.43.71
	wjSwL3KItA.exe	Get hash	malicious	Browse	131.186.161.70
	SecuriteInfo.com.Generic.mg.5a4b41327cabca49.exe	Get hash	malicious	Browse	216.146.43.70
	TD-10057.exe	Get hash	malicious	Browse	216.146.43.70
	NKP210102-NIT-SC2.exe	Get hash	malicious	Browse	131.186.161.70
	FedExAWB 772584418730.doc	Get hash	malicious	Browse	131.186.113.70
	TD-10057.doc	Get hash	malicious	Browse	162.88.193.70
	ndSscoDob9.exe	Get hash	malicious	Browse	216.146.43.71
	DXXJmIDl3C.exe	Get hash	malicious	Browse	131.186.113.70
	0YdVJ6vqhO.exe	Get hash	malicious	Browse	131.186.113.70
	ku7PCBVgfP.exe	Get hash	malicious	Browse	216.146.43.71
	00000000000900SA.exe	Get hash	malicious	Browse	216.146.43.70
	PV6wHTR7Q0.exe	Get hash	malicious	Browse	131.186.113.70
	wCRnCAMZ3yT8BQ2.exe	Get hash	malicious	Browse	162.88.193.70
	PO_RFQ_2021_12_01.exe	Get hash	malicious	Browse	131.186.161.70
	BxiS9KHIxj.exe	Get hash	malicious	Browse	131.186.161.70
	PO_RFQ_2021_12_01 - s.doc	Get hash	malicious	Browse	162.88.193.70
	al9LrOC8eM.exe	Get hash	malicious	Browse	162.88.193.70
	M4FBPQPaus.exe	Get hash	malicious	Browse	162.88.193.70

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CLOUDFLARENETUS	BSL 01321 PYT.xlsx	Get hash	malicious	Browse	66.235.200.145
	mssecsvc.exe	Get hash	malicious	Browse	104.17.244.81
	ZwFwevQtlv.exe	Get hash	malicious	Browse	172.67.188.154
	ssDV3d9O9o.exe	Get hash	malicious	Browse	172.67.188.154
	wjSwL3KItA.exe	Get hash	malicious	Browse	104.28.4.151
	Invoice-ID43739424297.vbs	Get hash	malicious	Browse	104.28.30.67
	Company Docs.exe	Get hash	malicious	Browse	104.23.98.190
	SecuriteInfo.com.Generic.mg.5a4b41327cabca49.exe	Get hash	malicious	Browse	104.28.5.151
	#U266b Audio_47720.wavv - - Copy.htm	Get hash	malicious	Browse	104.18.54.96
	PortionPac Chemical Corp..html	Get hash	malicious	Browse	104.16.19.94
	TD-10057.exe	Get hash	malicious	Browse	172.67.188.154
	NKP210102-NIT-SC2.exe	Get hash	malicious	Browse	172.67.188.154
	Listings.exe	Get hash	malicious	Browse	162.159.134.233
	quotation.exe	Get hash	malicious	Browse	23.227.38.74
	Doc_74657456348374.xlsx.exe	Get hash	malicious	Browse	23.227.38.74
	FedExAWB 772584418730.doc	Get hash	malicious	Browse	172.67.188.154
	TD-10057.doc	Get hash	malicious	Browse	172.67.188.154
	ndSscoDob9.exe	Get hash	malicious	Browse	104.28.4.151
	Consignment Details.exe	Get hash	malicious	Browse	104.27.180.10
	COMFAM INVOICE.htm	Get hash	malicious	Browse	104.27.190.143
DYNDNSUS	ZwFwevQtlv.exe	Get hash	malicious	Browse	216.146.43.71
	ssDV3d9O9o.exe	Get hash	malicious	Browse	216.146.43.71
	wjSwL3KItA.exe	Get hash	malicious	Browse	131.186.161.70
	SecuriteInfo.com.Generic.mg.5a4b41327cabca49.exe	Get hash	malicious	Browse	216.146.43.70
	TD-10057.exe	Get hash	malicious	Browse	216.146.43.70
	NKP210102-NIT-SC2.exe	Get hash	malicious	Browse	131.186.161.70
	FedExAWB 772584418730.doc	Get hash	malicious	Browse	131.186.113.70
	TD-10057.doc	Get hash	malicious	Browse	162.88.193.70
	ndSscoDob9.exe	Get hash	malicious	Browse	216.146.43.71
	DXXJmIDl3C.exe	Get hash	malicious	Browse	131.186.113.70
	0YdVJ6vqhO.exe	Get hash	malicious	Browse	131.186.113.70
	ku7PCBVgfP.exe	Get hash	malicious	Browse	216.146.43.71
	00000000000900SA.exe	Get hash	malicious	Browse	216.146.43.70
	PV6wHTR7Q0.exe	Get hash	malicious	Browse	216.146.43.71
	wCRnCAMZ3yT8BQ2.exe	Get hash	malicious	Browse	162.88.193.70
	PO_RFQ_2021_12_01.exe	Get hash	malicious	Browse	131.186.161.70
	BxiS9KHIxj.exe	Get hash	malicious	Browse	131.186.161.70
	PO_RFQ_2021_12_01 - s.doc	Get hash	malicious	Browse	162.88.193.70
	al9LrOC8eM.exe	Get hash	malicious	Browse	162.88.193.70
	M4FBPQPaus.exe	Get hash	malicious	Browse	162.88.193.70

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	ZwFwevQtlv.exe	Get hash	malicious	Browse	104.28.4.151
	ssDV3d9O9o.exe	Get hash	malicious	Browse	104.28.4.151
	wjSwL3KItA.exe	Get hash	malicious	Browse	104.28.4.151
	Invoice-ID43739424297.vbs	Get hash	malicious	Browse	104.28.4.151
	Company Docs.exe	Get hash	malicious	Browse	104.28.4.151
	SecuriteInfo.com.Generic.mg.5a4b41327cabca49.exe	Get hash	malicious	Browse	104.28.4.151
	TD-10057.exe	Get hash	malicious	Browse	104.28.4.151
	NKP210102-NIT-SC2.exe	Get hash	malicious	Browse	104.28.4.151
	ndSscoDob9.exe	Get hash	malicious	Browse	104.28.4.151
	DXXJmIDl3C.exe	Get hash	malicious	Browse	104.28.4.151
	0YdVJ6vqhO.exe	Get hash	malicious	Browse	104.28.4.151
	SF24.vbs	Get hash	malicious	Browse	104.28.4.151
	ku7PCBVgfP.exe	Get hash	malicious	Browse	104.28.4.151
	00000000000900SA.exe	Get hash	malicious	Browse	104.28.4.151
	QT55.vbs	Get hash	malicious	Browse	104.28.4.151
	VN55.vbs	Get hash	malicious	Browse	104.28.4.151
	VP57.vbs	Get hash	malicious	Browse	104.28.4.151
	wCRnCAMZ3yT8BQ2.exe	Get hash	malicious	Browse	104.28.4.151
	PO_RFQ_2021_12_01.exe	Get hash	malicious	Browse	104.28.4.151
	BxiS9KHIxj.exe	Get hash	malicious	Browse	104.28.4.151

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\InstallUtil.exe	MV. Double Miracle.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Generic.mg.5a4b41327cabca49.exe	Get hash	malicious	Browse
	SecuriteInfo.com.FileRepMalware.exe	Get hash	malicious	Browse
	MV Double Miracle.exe	Get hash	malicious	Browse
	TD-10057.exe	Get hash	malicious	Browse
	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	Browse
	ndSscoDob9.exe	Get hash	malicious	Browse
	DXXJmIDl3C.exe	Get hash	malicious	Browse
	0YdVJ6vqhO.exe	Get hash	malicious	Browse
	TT Payment Invoice.exe	Get hash	malicious	Browse
	al9LrOC8eM.exe	Get hash	malicious	Browse
	M4FBPQPaus.exe	Get hash	malicious	Browse
	hcL39YT1CR.exe	Get hash	malicious	Browse
	XaAUv98B2a.exe	Get hash	malicious	Browse
	04XP8gXrF7.exe	Get hash	malicious	Browse
	zosFl3kiAK.exe	Get hash	malicious	Browse
	4G5zLURjk4.exe	Get hash	malicious	Browse
	New Order 54380 pdf.exe	Get hash	malicious	Browse
	6hE7zSMErZ.exe	Get hash	malicious	Browse
	Invoice - Payment_Advice_pdf.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO-75013.exe.log Download File
Process:	C:\Users\user\Desktop\PO-75013.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1451
Entropy (8bit):	5.345862727722058
Encrypted:	false
SSDEEP:	24:ML9E4Ks2eE4O1lEE4UVwPKDE4KhK3VZ9pKhuE4IWUAE4KI6no84G1qE4j:MxHKXeHKlEHU0YHKhQnouHIW7HKjovGm
MD5:	06F54CDBFEF62849AF5AE052722BD7B6
SHA1:	FB0250AAC2057D0B5BCE4CE130891E428F28DA05
SHA-256:	4C039B93A728B546F49C47ED8B448D40A3553CDAABB147067AEE3958133CB446
SHA-512:	34EF5F6D5EAB0E5B11AC81F0D72FC56304291EDEEF6D19DF7145FDECAB5D342767DBBC0B4384B8DECB5741E6B85A4B431DF14FBEB5DDF2DEE103064D2895EABB
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\820a27781e8540ca263d835ec155f1a5\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\889128adc9a7c9370e5e293f65060164\PresentationFramework.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Wi

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\explore.exe.log Download File
Process:	C:\Users\user\explore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1362
Entropy (8bit):	5.343186145897752
Encrypted:	false
SSDEEP:	24:ML9E4Ks2eE4O1lEE4UVwPKDE4KhK3VZ9pKhuE4IWUAE4KI6no84j:MxHKXeHKlEHU0YHKhQnouHIW7HKjovj
MD5:	1249251E90A1C28AB8F7235F30056DEB
SHA1:	166BA6B64E9B0D9BA7B856334F7D7EC027030BA1
SHA-256:	B5D65BF3581136CD5368BC47FA3972E06F526EED407BC6571D11D9CD4B5C4D83
SHA-512:	FD880C5B12B22241F67139ABD09B99ACE7A4DD24635FC6B340A3E7C463E2AEF3FA68EF647352132934BC1F8CA134F46064049449ACB67954BEDDEA9AA9670885
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\820a27781e8540ca263d835ec155f1a5\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\889128adc9a7c9370e5e293f65060164\PresentationFramework.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Wi

C:\Users\user\AppData\Local\Temp\InstallUtil.exe Download File
Process:	C:\Users\user\Desktop\PO-75013.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41064
Entropy (8bit):	6.164873449128079
Encrypted:	false
SSDEEP:	384:FtpFVLK0MsihB9VKS7xdgE7KJ9Yl6dnPU3SERztmbqCJstdMardz/JikPZ+sPZTd:ZBMs2SqdD86Iq8gZZFyViML3an
MD5:	EFEC8C379D165E3F33B536739AEE26A3
SHA1:	C875908ACBA5CAC1E0B40F06A83F0F156A2640FA
SHA-256:	46DEE184523A584E56DF93389F81992911A1BA6B1F05AD7D803C6AB1450E18CB
SHA-512:	497847EC115D9AF78899E6DC20EC32A60B16954F83CF5169A23DD3F1459CB632DAC95417BD898FD1895C9FE2262FCBF7838FCF6919FB3B851A0557FBE07CCFFA
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: MV. Double Miracle.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Generic.mg.5a4b41327cabca49.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.FileRepMalware.exe, Detection: malicious, Browse Filename: MV Double Miracle.exe, Detection: malicious, Browse Filename: TD-10057.exe, Detection: malicious, Browse Filename: Ziraat Bankasi Swift Mesaji.exe, Detection: malicious, Browse Filename: ndSscoDob9.exe, Detection: malicious, Browse Filename: DXXJmIDl3C.exe, Detection: malicious, Browse Filename: 0YdVJ6vqhO.exe, Detection: malicious, Browse Filename: TT Payment Invoice.exe, Detection: malicious, Browse Filename: al9LrOC8eM.exe, Detection: malicious, Browse Filename: M4FBPQPaus.exe, Detection: malicious, Browse Filename: hcL39YT1CR.exe, Detection: malicious, Browse Filename: XaAUv98B2a.exe, Detection: malicious, Browse Filename: 04XP8gXrF7.exe, Detection: malicious, Browse Filename: zosFl3kiAK.exe, Detection: malicious, Browse Filename: 4G5zLURjk4.exe, Detection: malicious, Browse Filename: New Order 54380 pdf.exe, Detection: malicious, Browse Filename: 6hE7zSMErZ.exe, Detection: malicious, Browse Filename: Invoice - Payment_Advice_pdf.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Z.Z..............0..T...........r... ........@.. ....................................`.................................4r..O....................b..h>...........p............................................... ............... ..H............text....R... ...T.................. ..`.rsrc................V..............@..@.reloc...............`..............@..B................hr......H........"..\|J..........lm.......o......................................2~.....o.....r...p(....VrK..p(....s...........0..........(....(....o....o....(....o.... .....T(....o....(....o....o ...o!....4(....o....(....o....o ...o".....(....rm..ps#...o....($........(%....o&....ry..p......%.r...p.%.(.....(....('....((.......o)...('........................."..(.....{Q...-...}Q.....(+...(....(,....(+..."..(-.....(......(.....r...p.(/...o0...s....}T...*....0.. .......~S...-.s

C:\Users\user\explore.exe Download File
Process:	C:\Users\user\Desktop\PO-75013.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1634760
Entropy (8bit):	5.321970744701331
Encrypted:	false
SSDEEP:	12288:ExdSeNxzbNj6uBs9U5oATtc1XOuC3J3f14nRP3kB:eP7vNjnzo9XOu+6Nw
MD5:	E7E6EE6EF97FF797562C91E0FF401AC4
SHA1:	D1EC737C87A9C0A91456F1019106B77EE2E03980
SHA-256:	7EB2DE2BFD05EE1E83980AA914486789D2E8F3FB3CC6E166F140302FDAF40CD9
SHA-512:	1B84AF0412DC0AFBC19F894D2AEC326F0F11C12DC9921AC817DAB08415051F841B77AEC5ED7BF5B53B0665E68B68AB53392EA731243A4630125FC158B3FD7743
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5...............................M... ........@.. .......................@............`..................................L..O....`....................... ....................................................... ............... ..H............text...4-... ...................... ..`.rsrc........`.......0..............@..@.reloc....... ......................@..B.................M......H.......,%...'......U................................................... .........%.....(......... .........%.....(.........*...0..h.......................(....t....&.............(....t........ .Yt(9...t.... .:.`(9...t......... ..ZW(9...t....(9...t....&..................f.+R.......... ....(9...t....&.5&.....................(....t....(9...t.............................-..........................-](....t..... ..P.(....t.... VR..(....t....\.(9...t........ .dOz(9...t....(....t

C:\Users\user\explore.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\PO-75013.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log Download File
Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	data
Category:	modified
Size (bytes):	906
Entropy (8bit):	3.148604036726612
Encrypted:	false
SSDEEP:	12:58KRBubdpkoF1AG3rls80A2wZk9+MlWlLehB4yAq7ejCEs80Af:OaqdmuF3rlbB++kWReH4yJ7MNbf
MD5:	1E83BEAE95CA3AAEDFB47D5C88DCB8EE
SHA1:	26F4315375C4F29B47052A47B8E33D84A5382848
SHA-256:	286E4A1CEC45AB8B54070B8CDDB3858A9F08B35F8443EE45A9FF8E577569CDD0
SHA-512:	2541F18552847BF18BC4CC7C20CF779C9E31435A61F708F9A676342B763A6B779FB89208237DEC4DAF93EE21CD9D01F92F1AA155BEBC7A34D9E0FB800EC7D87C
Malicious:	false
Preview:	........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. W.e.d. .. J.a.n. .. 1.3. .. 2.0.2.1. .0.8.:.0.7.:.1.5.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e.....E.R.R.O.R.:. .M.p.W.D.E.n.a.b.l.e.(.T.R.U.E.). .f.a.i.l.e.d. .(.8.0.0.7.0.4.E.C.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. W.e.d. .. J.a.n. .. 1.3. .. 2.0.2.1. .0.8.:.0.7.:.1.6.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.321970744701331
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PO-75013.exe
File size:	1634760
MD5:	e7e6ee6ef97ff797562c91e0ff401ac4
SHA1:	d1ec737c87a9c0a91456f1019106b77ee2e03980
SHA256:	7eb2de2bfd05ee1e83980aa914486789d2e8f3fb3cc6e166f140302fdaf40cd9
SHA512:	1b84af0412dc0afbc19f894d2aec326f0f11c12dc9921ac817dab08415051f841b77aec5ed7bf5b53b0665e68b68ab53392ea731243a4630125fc158b3fd7743
SSDEEP:	12288:ExdSeNxzbNj6uBs9U5oATtc1XOuC3J3f14nRP3kB:eP7vNjnzo9XOu+6Nw
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5...............................M... ........@.. .......................@............`................................

File Icon


Icon Hash:	f0d2f8ccc4f0d470

Static PE Info

General
Entrypoint:	0x564d2e
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Time Stamp:	0x5FD35A7 [Thu Mar 8 23:13:43 1973 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert EV Code Signing CA (SHA2), OU=www.digicert.com, O=DigiCert Inc, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	5/28/2020 5:00:00 PM 6/3/2021 5:00:00 AM
Subject Chain	CN=LLC Mail.Ru, O=LLC Mail.Ru, L=ÐÐ¾ÑÐºÐ²Ð°, C=RU, SERIALNUMBER=1027739850962, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=RU
Version:	3
Thumbprint MD5:	CE53364B33A1C9E4BA3F1F1FCA294406
Thumbprint SHA-1:	21DACC55B6E0B3B0E761BE03ED6EDD713489B6CE
Thumbprint SHA-256:	7F03209D02816C136F811D1BF8CC3E23EA011CE37E3F0C45E277EE3DD67018E0
Serial:	0DEB004E56D7FCEC1CAA8F2928D4E768

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x164cdc	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x166000	0x2a78a	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x18da00	0x17c8	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x192000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x162d34	0x162e00	False	0.357161137284	data	5.30841128128	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x166000	0x2a78a	0x2a800	False	0.154451976103	data	3.69111595242	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x192000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x1662b0	0x26ef	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON	0x1689a0	0x10828	dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 0, next used block 0
RT_ICON	0x1791c8	0x94a8	data
RT_ICON	0x182670	0x5488	data
RT_ICON	0x187af8	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 64767, next used block 4282318848
RT_ICON	0x18bd20	0x25a8	data
RT_ICON	0x18e2c8	0x10a8	data
RT_ICON	0x18f370	0x988	data
RT_ICON	0x18fcf8	0x468	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x190160	0x84	data
RT_VERSION	0x1901e4	0x3bc	data
RT_MANIFEST	0x1905a0	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2018 E;E3=@36=DC:44BD2><FB7?3
Assembly Version	1.0.0.0
InternalName	PO-75013.exe
FileVersion	9.14.19.23
CompanyName	E;E3=@36=DC:44BD2><FB7?3
Comments	2?DG<?=:54J2B79JG7
ProductName	7BCA:=H?E=9C79J7DI29@:C
ProductVersion	9.14.19.23
FileDescription	7BCA:=H?E=9C79J7DI29@:C
OriginalFilename	PO-75013.exe

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2021 08:06:37.601216078 CET	49737	80	192.168.2.7	162.88.193.70
Jan 13, 2021 08:06:37.732170105 CET	80	49737	162.88.193.70	192.168.2.7
Jan 13, 2021 08:06:37.732378960 CET	49737	80	192.168.2.7	162.88.193.70
Jan 13, 2021 08:06:37.799284935 CET	49737	80	192.168.2.7	162.88.193.70
Jan 13, 2021 08:06:37.930200100 CET	80	49737	162.88.193.70	192.168.2.7
Jan 13, 2021 08:06:37.930265903 CET	80	49737	162.88.193.70	192.168.2.7
Jan 13, 2021 08:06:37.930283070 CET	80	49737	162.88.193.70	192.168.2.7
Jan 13, 2021 08:06:37.930350065 CET	49737	80	192.168.2.7	162.88.193.70
Jan 13, 2021 08:06:37.931005955 CET	49737	80	192.168.2.7	162.88.193.70
Jan 13, 2021 08:06:38.063564062 CET	80	49737	162.88.193.70	192.168.2.7
Jan 13, 2021 08:06:38.172872066 CET	49738	80	192.168.2.7	162.88.193.70
Jan 13, 2021 08:06:38.303222895 CET	80	49738	162.88.193.70	192.168.2.7
Jan 13, 2021 08:06:38.303317070 CET	49738	80	192.168.2.7	162.88.193.70
Jan 13, 2021 08:06:38.303822994 CET	49738	80	192.168.2.7	162.88.193.70
Jan 13, 2021 08:06:38.434389114 CET	80	49738	162.88.193.70	192.168.2.7
Jan 13, 2021 08:06:38.434467077 CET	80	49738	162.88.193.70	192.168.2.7
Jan 13, 2021 08:06:38.434489012 CET	80	49738	162.88.193.70	192.168.2.7
Jan 13, 2021 08:06:38.434609890 CET	49738	80	192.168.2.7	162.88.193.70
Jan 13, 2021 08:06:38.434940100 CET	49738	80	192.168.2.7	162.88.193.70
Jan 13, 2021 08:06:38.564349890 CET	80	49738	162.88.193.70	192.168.2.7
Jan 13, 2021 08:06:41.164613008 CET	49744	443	192.168.2.7	104.28.4.151
Jan 13, 2021 08:06:41.217269897 CET	443	49744	104.28.4.151	192.168.2.7
Jan 13, 2021 08:06:41.217398882 CET	49744	443	192.168.2.7	104.28.4.151
Jan 13, 2021 08:06:41.355159998 CET	49744	443	192.168.2.7	104.28.4.151
Jan 13, 2021 08:06:41.408828020 CET	443	49744	104.28.4.151	192.168.2.7
Jan 13, 2021 08:06:41.408874989 CET	443	49744	104.28.4.151	192.168.2.7
Jan 13, 2021 08:06:41.408896923 CET	443	49744	104.28.4.151	192.168.2.7
Jan 13, 2021 08:06:41.409111977 CET	49744	443	192.168.2.7	104.28.4.151
Jan 13, 2021 08:06:41.416810036 CET	49744	443	192.168.2.7	104.28.4.151
Jan 13, 2021 08:06:41.467134953 CET	443	49744	104.28.4.151	192.168.2.7
Jan 13, 2021 08:06:41.467266083 CET	443	49744	104.28.4.151	192.168.2.7
Jan 13, 2021 08:06:41.585115910 CET	49744	443	192.168.2.7	104.28.4.151
Jan 13, 2021 08:06:41.802016020 CET	49744	443	192.168.2.7	104.28.4.151
Jan 13, 2021 08:06:41.854278088 CET	443	49744	104.28.4.151	192.168.2.7
Jan 13, 2021 08:06:41.870359898 CET	443	49744	104.28.4.151	192.168.2.7
Jan 13, 2021 08:06:42.085163116 CET	49744	443	192.168.2.7	104.28.4.151
Jan 13, 2021 08:08:22.036802053 CET	49744	443	192.168.2.7	104.28.4.151
Jan 13, 2021 08:08:22.087850094 CET	443	49744	104.28.4.151	192.168.2.7
Jan 13, 2021 08:08:22.089215040 CET	49744	443	192.168.2.7	104.28.4.151

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2021 08:05:39.186192036 CET	54008	53	192.168.2.7	8.8.8.8
Jan 13, 2021 08:05:39.242461920 CET	53	54008	8.8.8.8	192.168.2.7
Jan 13, 2021 08:05:41.147752047 CET	59451	53	192.168.2.7	8.8.8.8
Jan 13, 2021 08:05:41.195627928 CET	53	59451	8.8.8.8	192.168.2.7
Jan 13, 2021 08:05:42.022713900 CET	52914	53	192.168.2.7	8.8.8.8
Jan 13, 2021 08:05:42.078947067 CET	53	52914	8.8.8.8	192.168.2.7
Jan 13, 2021 08:05:43.416457891 CET	64569	53	192.168.2.7	8.8.8.8
Jan 13, 2021 08:05:43.475699902 CET	53	64569	8.8.8.8	192.168.2.7
Jan 13, 2021 08:05:44.506170034 CET	52816	53	192.168.2.7	8.8.8.8
Jan 13, 2021 08:05:44.562360048 CET	53	52816	8.8.8.8	192.168.2.7
Jan 13, 2021 08:05:46.777287006 CET	50781	53	192.168.2.7	8.8.8.8
Jan 13, 2021 08:05:46.825280905 CET	53	50781	8.8.8.8	192.168.2.7
Jan 13, 2021 08:05:48.668596029 CET	54230	53	192.168.2.7	8.8.8.8
Jan 13, 2021 08:05:48.716594934 CET	53	54230	8.8.8.8	192.168.2.7
Jan 13, 2021 08:05:50.513652086 CET	54911	53	192.168.2.7	8.8.8.8
Jan 13, 2021 08:05:50.564397097 CET	53	54911	8.8.8.8	192.168.2.7
Jan 13, 2021 08:05:51.454158068 CET	49958	53	192.168.2.7	8.8.8.8
Jan 13, 2021 08:05:51.502022028 CET	53	49958	8.8.8.8	192.168.2.7
Jan 13, 2021 08:05:53.022725105 CET	50860	53	192.168.2.7	8.8.8.8
Jan 13, 2021 08:05:53.070591927 CET	53	50860	8.8.8.8	192.168.2.7
Jan 13, 2021 08:05:53.880767107 CET	50452	53	192.168.2.7	8.8.8.8
Jan 13, 2021 08:05:53.931565046 CET	53	50452	8.8.8.8	192.168.2.7
Jan 13, 2021 08:05:54.702575922 CET	59730	53	192.168.2.7	8.8.8.8
Jan 13, 2021 08:05:54.753441095 CET	53	59730	8.8.8.8	192.168.2.7
Jan 13, 2021 08:05:55.839174032 CET	59310	53	192.168.2.7	8.8.8.8
Jan 13, 2021 08:05:55.887213945 CET	53	59310	8.8.8.8	192.168.2.7
Jan 13, 2021 08:06:01.753551006 CET	51919	53	192.168.2.7	8.8.8.8
Jan 13, 2021 08:06:01.814402103 CET	53	51919	8.8.8.8	192.168.2.7
Jan 13, 2021 08:06:09.444165945 CET	64296	53	192.168.2.7	8.8.8.8
Jan 13, 2021 08:06:09.494875908 CET	53	64296	8.8.8.8	192.168.2.7
Jan 13, 2021 08:06:23.483999014 CET	56680	53	192.168.2.7	8.8.8.8
Jan 13, 2021 08:06:23.544560909 CET	53	56680	8.8.8.8	192.168.2.7
Jan 13, 2021 08:06:27.538366079 CET	58820	53	192.168.2.7	8.8.8.8
Jan 13, 2021 08:06:27.597732067 CET	53	58820	8.8.8.8	192.168.2.7
Jan 13, 2021 08:06:28.997098923 CET	60983	53	192.168.2.7	8.8.8.8
Jan 13, 2021 08:06:29.053458929 CET	53	60983	8.8.8.8	192.168.2.7
Jan 13, 2021 08:06:36.426105976 CET	49247	53	192.168.2.7	8.8.8.8
Jan 13, 2021 08:06:36.474499941 CET	53	49247	8.8.8.8	192.168.2.7
Jan 13, 2021 08:06:36.491914034 CET	52286	53	192.168.2.7	8.8.8.8
Jan 13, 2021 08:06:36.539860964 CET	53	52286	8.8.8.8	192.168.2.7
Jan 13, 2021 08:06:39.655924082 CET	56064	53	192.168.2.7	8.8.8.8
Jan 13, 2021 08:06:39.717487097 CET	53	56064	8.8.8.8	192.168.2.7
Jan 13, 2021 08:06:41.108841896 CET	63744	53	192.168.2.7	8.8.8.8
Jan 13, 2021 08:06:41.159249067 CET	53	63744	8.8.8.8	192.168.2.7
Jan 13, 2021 08:06:48.026561022 CET	61457	53	192.168.2.7	8.8.8.8
Jan 13, 2021 08:06:48.086368084 CET	53	61457	8.8.8.8	192.168.2.7
Jan 13, 2021 08:06:49.175085068 CET	58367	53	192.168.2.7	8.8.8.8
Jan 13, 2021 08:06:49.231472969 CET	53	58367	8.8.8.8	192.168.2.7
Jan 13, 2021 08:06:49.910309076 CET	60599	53	192.168.2.7	8.8.8.8
Jan 13, 2021 08:06:49.958420038 CET	53	60599	8.8.8.8	192.168.2.7
Jan 13, 2021 08:06:50.294464111 CET	59571	53	192.168.2.7	8.8.8.8
Jan 13, 2021 08:06:50.342649937 CET	53	59571	8.8.8.8	192.168.2.7
Jan 13, 2021 08:06:50.501507044 CET	52689	53	192.168.2.7	8.8.8.8
Jan 13, 2021 08:06:50.557981968 CET	53	52689	8.8.8.8	192.168.2.7
Jan 13, 2021 08:06:51.139693975 CET	50290	53	192.168.2.7	8.8.8.8
Jan 13, 2021 08:06:51.196258068 CET	53	50290	8.8.8.8	192.168.2.7
Jan 13, 2021 08:06:52.021470070 CET	60427	53	192.168.2.7	8.8.8.8
Jan 13, 2021 08:06:52.069477081 CET	53	60427	8.8.8.8	192.168.2.7
Jan 13, 2021 08:06:53.641933918 CET	56209	53	192.168.2.7	8.8.8.8
Jan 13, 2021 08:06:53.701103926 CET	53	56209	8.8.8.8	192.168.2.7
Jan 13, 2021 08:06:55.028098106 CET	59582	53	192.168.2.7	8.8.8.8
Jan 13, 2021 08:06:55.084656000 CET	53	59582	8.8.8.8	192.168.2.7
Jan 13, 2021 08:06:56.958580017 CET	60949	53	192.168.2.7	8.8.8.8
Jan 13, 2021 08:06:57.014760971 CET	53	60949	8.8.8.8	192.168.2.7
Jan 13, 2021 08:06:57.770443916 CET	58542	53	192.168.2.7	8.8.8.8
Jan 13, 2021 08:06:57.829873085 CET	53	58542	8.8.8.8	192.168.2.7
Jan 13, 2021 08:07:13.888972998 CET	59179	53	192.168.2.7	8.8.8.8
Jan 13, 2021 08:07:13.937019110 CET	53	59179	8.8.8.8	192.168.2.7
Jan 13, 2021 08:07:15.876265049 CET	60927	53	192.168.2.7	8.8.8.8
Jan 13, 2021 08:07:15.950372934 CET	53	60927	8.8.8.8	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 13, 2021 08:06:36.426105976 CET	192.168.2.7	8.8.8.8	0x7a10	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)
Jan 13, 2021 08:06:36.491914034 CET	192.168.2.7	8.8.8.8	0x98fd	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)
Jan 13, 2021 08:06:41.108841896 CET	192.168.2.7	8.8.8.8	0xd013	Standard query (0)	freegeoip.app	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 13, 2021 08:06:36.474499941 CET	8.8.8.8	192.168.2.7	0x7a10	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)
Jan 13, 2021 08:06:36.474499941 CET	8.8.8.8	192.168.2.7	0x7a10	No error (0)	checkip.dyndns.com		162.88.193.70	A (IP address)	IN (0x0001)
Jan 13, 2021 08:06:36.474499941 CET	8.8.8.8	192.168.2.7	0x7a10	No error (0)	checkip.dyndns.com		216.146.43.71	A (IP address)	IN (0x0001)
Jan 13, 2021 08:06:36.474499941 CET	8.8.8.8	192.168.2.7	0x7a10	No error (0)	checkip.dyndns.com		216.146.43.70	A (IP address)	IN (0x0001)
Jan 13, 2021 08:06:36.474499941 CET	8.8.8.8	192.168.2.7	0x7a10	No error (0)	checkip.dyndns.com		131.186.113.70	A (IP address)	IN (0x0001)
Jan 13, 2021 08:06:36.474499941 CET	8.8.8.8	192.168.2.7	0x7a10	No error (0)	checkip.dyndns.com		131.186.161.70	A (IP address)	IN (0x0001)
Jan 13, 2021 08:06:36.539860964 CET	8.8.8.8	192.168.2.7	0x98fd	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)
Jan 13, 2021 08:06:36.539860964 CET	8.8.8.8	192.168.2.7	0x98fd	No error (0)	checkip.dyndns.com		216.146.43.70	A (IP address)	IN (0x0001)
Jan 13, 2021 08:06:36.539860964 CET	8.8.8.8	192.168.2.7	0x98fd	No error (0)	checkip.dyndns.com		131.186.161.70	A (IP address)	IN (0x0001)
Jan 13, 2021 08:06:36.539860964 CET	8.8.8.8	192.168.2.7	0x98fd	No error (0)	checkip.dyndns.com		131.186.113.70	A (IP address)	IN (0x0001)
Jan 13, 2021 08:06:36.539860964 CET	8.8.8.8	192.168.2.7	0x98fd	No error (0)	checkip.dyndns.com		216.146.43.71	A (IP address)	IN (0x0001)
Jan 13, 2021 08:06:36.539860964 CET	8.8.8.8	192.168.2.7	0x98fd	No error (0)	checkip.dyndns.com		162.88.193.70	A (IP address)	IN (0x0001)
Jan 13, 2021 08:06:41.159249067 CET	8.8.8.8	192.168.2.7	0xd013	No error (0)	freegeoip.app		104.28.4.151	A (IP address)	IN (0x0001)
Jan 13, 2021 08:06:41.159249067 CET	8.8.8.8	192.168.2.7	0xd013	No error (0)	freegeoip.app		172.67.188.154	A (IP address)	IN (0x0001)
Jan 13, 2021 08:06:41.159249067 CET	8.8.8.8	192.168.2.7	0xd013	No error (0)	freegeoip.app		104.28.5.151	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.7	49737	162.88.193.70	80	C:\Users\user\AppData\Local\Temp\InstallUtil.exe

Timestamp	kBytes transferred	Direction	Data
Jan 13, 2021 08:06:37.799284935 CET	310	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 13, 2021 08:06:37.930265903 CET	310	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 103 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 34 2e 31 37 2e 35 32 2e 37 34 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 84.17.52.74</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.7	49738	162.88.193.70	80	C:\Users\user\AppData\Local\Temp\InstallUtil.exe

Timestamp	kBytes transferred	Direction	Data
Jan 13, 2021 08:06:38.303822994 CET	312	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 13, 2021 08:06:38.434467077 CET	344	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 103 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 34 2e 31 37 2e 35 32 2e 37 34 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 84.17.52.74</body></html>

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Jan 13, 2021 08:06:41.408896923 CET	104.28.4.151	443	192.168.2.7	49744	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Aug 10 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Tue Aug 10 14:00:00 CEST 2021 Wed Jan 01 00:59:59 CET 2025	769,49162-49161-49172-49171-53-47-10,0-10-11-35-23-65281,29-23-24,0	54328bd36c14bd82ddaa0c04b25ed9ad
Jan 13, 2021 08:06:41.408896923 CET	104.28.4.151	443	192.168.2.7	49744	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		54328bd36c14bd82ddaa0c04b25ed9ad

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: PO-75013.exe PID: 6904 Parent PID: 5864

General

Start time:	08:05:43
Start date:	13/01/2021
Path:	C:\Users\user\Desktop\PO-75013.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\PO-75013.exe'
Imagebase:	0x340000
File size:	1634760 bytes
MD5 hash:	E7E6EE6EF97FF797562C91E0FF401AC4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.277366713.0000000003C9C000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.276366606.0000000003AB1000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 6992 Parent PID: 6904

General

Start time:	08:05:50
Start date:	13/01/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	'cmd.exe' /c REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' /f /v 'explore' /t REG_SZ /d 'C:\Users\user\explore.exe'
Imagebase:	0x870000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 7000 Parent PID: 6992

General

Start time:	08:05:50
Start date:	13/01/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: reg.exe PID: 7048 Parent PID: 6992

General

Start time:	08:05:50
Start date:	13/01/2021
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' /f /v 'explore' /t REG_SZ /d 'C:\Users\user\explore.exe'
Imagebase:	0x800000
File size:	59392 bytes
MD5 hash:	CEE2A7E57DF2A159A065A34913A055C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: explore.exe PID: 2152 Parent PID: 3292

General

Start time:	08:06:03
Start date:	13/01/2021
Path:	C:\Users\user\explore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\explore.exe'
Imagebase:	0x2d0000
File size:	1634760 bytes
MD5 hash:	E7E6EE6EF97FF797562C91E0FF401AC4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Chronological Activities

Analysis Process: explore.exe PID: 6200 Parent PID: 6904

General

Start time:	08:06:03
Start date:	13/01/2021
Path:	C:\Users\user\explore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\explore.exe'
Imagebase:	0x760000
File size:	1634760 bytes
MD5 hash:	E7E6EE6EF97FF797562C91E0FF401AC4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Chronological Activities

Analysis Process: explore.exe PID: 6968 Parent PID: 3292

General

Start time:	08:06:11
Start date:	13/01/2021
Path:	C:\Users\user\explore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\explore.exe'
Imagebase:	0x530000
File size:	1634760 bytes
MD5 hash:	E7E6EE6EF97FF797562C91E0FF401AC4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Chronological Activities

Analysis Process: InstallUtil.exe PID: 6316 Parent PID: 6968

General

Start time:	08:06:25
Start date:	13/01/2021
Path:	C:\Users\user\AppData\Local\Temp\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\InstallUtil.exe
Imagebase:	0x3e0000
File size:	41064 bytes
MD5 hash:	EFEC8C379D165E3F33B536739AEE26A3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 0%, Metadefender, Browse Detection: 0%, ReversingLabs
Reputation:	moderate

Chronological Activities

Analysis Process: MpCmdRun.exe PID: 7104 Parent PID: 7048

General

Start time:	08:07:15
Start date:	13/01/2021
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Windows Defender\mpcmdrun.exe' -wdenable
Imagebase:	0x7ff68a700000
File size:	455656 bytes
MD5 hash:	A267555174BFA53844371226F482B86B
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 5948 Parent PID: 7104

General

Start time:	08:07:15
Start date:	13/01/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: PO-75013.exe PID: 6904 Parent PID: 5864 PO-75013.exeCOMMON

Executed Functions

Function 00C2EE1A, Relevance: 5.5, Strings: 4, Instructions: 466COMMON

Download Yara Rule

Strings

x/l, xrefs: 00C2F418
x/l, xrefs: 00C2F556
C=ll^, xrefs: 00C2F53E, 00C2F543
S=ll^, xrefs: 00C2F400, 00C2F405

Memory Dump Source

Source File: 00000000.00000002.274004871.0000000000C20000.00000040.00000001.sdmp, Offset: 00C20000, based on PE: false

Similarity

API ID:
String ID: x/l$x/l$C=ll^$S=ll^
API String ID: 0-1103918437
Opcode ID: 77b883afa274a78fe811e8b9f9e91b8256c6b0494d6b491d8bf94a4751ce75e7
Instruction ID: a9e9b006342f9ffbb70f974f391f399b2d64bf064bf63efa40df0592529eb0ea
Opcode Fuzzy Hash: 77b883afa274a78fe811e8b9f9e91b8256c6b0494d6b491d8bf94a4751ce75e7
Instruction Fuzzy Hash: B322F474D01228CFDB69DF65E984BADBBB2BF49301F1081E9D40AA7361DB349A81DF10

Uniqueness

Uniqueness Score: -1.00%

Function 00C2EE50, Relevance: 5.4, Strings: 4, Instructions: 446COMMON

Download Yara Rule

Strings

x/l, xrefs: 00C2F418
x/l, xrefs: 00C2F556
C=ll^, xrefs: 00C2F53E, 00C2F543
S=ll^, xrefs: 00C2F400, 00C2F405

Memory Dump Source

Source File: 00000000.00000002.274004871.0000000000C20000.00000040.00000001.sdmp, Offset: 00C20000, based on PE: false

Similarity

API ID:
String ID: x/l$x/l$C=ll^$S=ll^
API String ID: 0-1103918437
Opcode ID: cd592c9e585371f0aefd26a3581f3ef4b4104ec1311bd211e5dde9836f197ca8
Instruction ID: 354bd2bc4fc1ad44e58fcedd700782b1bbb9ad4d45e817f8aaf68c9328f7fb66
Opcode Fuzzy Hash: cd592c9e585371f0aefd26a3581f3ef4b4104ec1311bd211e5dde9836f197ca8
Instruction Fuzzy Hash: 1222F274D01228CFDB29DF64E984BADBBB2FB49301F1085E9D40AA7355DB35AA81DF10

Uniqueness

Uniqueness Score: -1.00%

Function 00C2D6E0, Relevance: 4.8, Strings: 3, Instructions: 1003COMMON

Download Yara Rule

Strings

<, xrefs: 00C2D90C
(, xrefs: 00C2DD76
ntin, xrefs: 00C2E14F

Memory Dump Source

Source File: 00000000.00000002.274004871.0000000000C20000.00000040.00000001.sdmp, Offset: 00C20000, based on PE: false

Similarity

API ID:
String ID: ($<$ntin
API String ID: 0-2777557274
Opcode ID: 6b7bd88ca0e81297032d88a3792de5014caabc5b56b3b7ba994827bc1c4898c7
Instruction ID: 24877157dd39d5101686be6140d3bf270857a1eba0ebd8394675fe34ac8bc6cc
Opcode Fuzzy Hash: 6b7bd88ca0e81297032d88a3792de5014caabc5b56b3b7ba994827bc1c4898c7
Instruction Fuzzy Hash: 5FA2D374E042288FDB14CF99C981A9DFBF2BF89304F2581A5D509AB655D734AE82CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00C23FD8, Relevance: 4.6, Strings: 3, Instructions: 893COMMON

Download Yara Rule

Strings

D04l, xrefs: 00C244AD
D04l, xrefs: 00C245AD
D04l, xrefs: 00C24420

Memory Dump Source

Source File: 00000000.00000002.274004871.0000000000C20000.00000040.00000001.sdmp, Offset: 00C20000, based on PE: false

Similarity

API ID:
String ID: D04l$D04l$D04l
API String ID: 0-1532720256
Opcode ID: cfa38ee87d86ef8e3f4abe84c207d9544d1a69ca39f72e016a14322626f12304
Instruction ID: a7484bd9542cf561c0065ba257a64d4d4517f2a430a297aabf7da683c32ba053
Opcode Fuzzy Hash: cfa38ee87d86ef8e3f4abe84c207d9544d1a69ca39f72e016a14322626f12304
Instruction Fuzzy Hash: B7727F71A002298FCB18DF69D894AAEBBF2BF89304F158169E415DB7A5DB30DD41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00C299F8, Relevance: 3.2, Strings: 2, Instructions: 650COMMON

Download Yara Rule

Strings

<, xrefs: 00C29B2D
@, xrefs: 00C2A30D

Memory Dump Source

Source File: 00000000.00000002.274004871.0000000000C20000.00000040.00000001.sdmp, Offset: 00C20000, based on PE: false

Similarity

API ID:
String ID: <$@
API String ID: 0-1426351568
Opcode ID: f76dcda9d97d6f35c67cd1e644037ef559b568125ad5bd0e8d0d246fc1e6b161
Instruction ID: af971c82bd72478456383623a883db266bd23aeb50e3dc8e2062a02e3ac4f74e
Opcode Fuzzy Hash: f76dcda9d97d6f35c67cd1e644037ef559b568125ad5bd0e8d0d246fc1e6b161
Instruction Fuzzy Hash: 0462CB74A00229CFDB64DFA9C980A8DFBF2FF49304F16C1A9D518AB611D734AA81CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00C276F0, Relevance: .9, Instructions: 906COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274004871.0000000000C20000.00000040.00000001.sdmp, Offset: 00C20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 458381993e2c1db1431504888b1a21100a2c93101350b8718f45bfc6d218e341
Instruction ID: 5194e76aa2b60a48d0d3006890d32e75c21984a27cd01f71feb7ca1e70e88f8e
Opcode Fuzzy Hash: 458381993e2c1db1431504888b1a21100a2c93101350b8718f45bfc6d218e341
Instruction Fuzzy Hash: 7C82A134A04229CFCB15CF64E884AAEBBF2FF48304F158669E415DB6A1DB31ED45CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00C2BC20, Relevance: .5, Instructions: 513COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274004871.0000000000C20000.00000040.00000001.sdmp, Offset: 00C20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 815030f0755f4a6c5067ef5b4195245d2c1899796d47604857661f33ce79864e
Instruction ID: 2610483453f495a8cd3729decabbffaa130013636ebf620fcbb50b1e7cd24adc
Opcode Fuzzy Hash: 815030f0755f4a6c5067ef5b4195245d2c1899796d47604857661f33ce79864e
Instruction Fuzzy Hash: F3429F74E01229CFDB24DFA9D984B9DBBB2BF48300F1582A9D809A7355D734AE81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00C2A4F0, Relevance: .5, Instructions: 509COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274004871.0000000000C20000.00000040.00000001.sdmp, Offset: 00C20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf5a0a1fb87cfd44544e8a812a35fe141a5c39f69afaf818b6b3f0d0689cbf30
Instruction ID: a990a7a12813177fd2c8bbcd7e499347dc0c0e12f013584a7319f8cbb229a219
Opcode Fuzzy Hash: bf5a0a1fb87cfd44544e8a812a35fe141a5c39f69afaf818b6b3f0d0689cbf30
Instruction Fuzzy Hash: D432D274900229CFDB50DFA9C980A8DFBB2BF49709F56C195D508AB612CB30DE85CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C2F650, Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274004871.0000000000C20000.00000040.00000001.sdmp, Offset: 00C20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e68bbcb5614a8ae9a91983da7a8afaab61120c4e789f226799cb7f4f3422b20
Instruction ID: 57d7535872361e9637204f69245191c899186abaafe851b3bf3b1a1a190eecbf
Opcode Fuzzy Hash: 6e68bbcb5614a8ae9a91983da7a8afaab61120c4e789f226799cb7f4f3422b20
Instruction Fuzzy Hash: 76D1B074E00228CFDB54DFA9D984B9DBBB2BF88304F1085AAD909A7355DB305A86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00C2F64F, Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.274004871.0000000000C20000.00000040.00000001.sdmp, Offset: 00C20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fad6a89261ab9f273a3488a0e3a94f26ab511a822c27bd16afec764c29211094
Instruction ID: 8bc6b84abe6bfdc9944bb73e65214683c7450a5570b81239877ac6043e168253
Opcode Fuzzy Hash: fad6a89261ab9f273a3488a0e3a94f26ab511a822c27bd16afec764c29211094
Instruction Fuzzy Hash: 4FA1E174E00628CFDB54DFAAD984B9DBBB2FF88300F1085AAD449A7265DB305A95CF11

Uniqueness

Uniqueness Score: -1.00%

Function 04EADAA9, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.280679702.0000000004EA0000.00000040.00000001.sdmp, Offset: 04EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2196f1460ae490f53434c2943b8d240cf9bf1a956fc9d00dc6ed47e049b8c41d
Instruction ID: 874682ce22a3b2e3164b542155586f1f00fb9912278d0d77953fd99d07a2789c
Opcode Fuzzy Hash: 2196f1460ae490f53434c2943b8d240cf9bf1a956fc9d00dc6ed47e049b8c41d
Instruction Fuzzy Hash: A3213D71D052598FDB04DFA4DC587EEBBB1FB89315F00516AC016B72A0DB782945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 04EAC6A0, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.280679702.0000000004EA0000.00000040.00000001.sdmp, Offset: 04EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba1f807cd568aff43e70776f0e4e6d3ed433a5e8418de16ab11a1f4f883789fd
Instruction ID: bf3d68939017fc01093fd0ccee1d54e03e51fb44c51ce92a8c9501dba0d577c9
Opcode Fuzzy Hash: ba1f807cd568aff43e70776f0e4e6d3ed433a5e8418de16ab11a1f4f883789fd
Instruction Fuzzy Hash: 10010070D05258AFCB41DFB8C8947AEBFF0AF0A204F2055AAC459AB290E7701A06DF50

Uniqueness

Uniqueness Score: -1.00%

Function 04EA5E4C, Relevance: 1.8, APIs: 1, Instructions: 273COMMON

Download Yara Rule

APIs

CopyFileExW.KERNELBASE(?,?,?,?,?,?), ref: 04EACA41

Memory Dump Source

Source File: 00000000.00000002.280679702.0000000004EA0000.00000040.00000001.sdmp, Offset: 04EA0000, based on PE: false

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 356af32ac01c283a8809e89d8631782091f3e6f67d1e8d09c09df153772237e0
Instruction ID: d10e22d9f4d574e640ca766785ba60d9cb7979893c3e3a1865d34cbbfe57e0cf
Opcode Fuzzy Hash: 356af32ac01c283a8809e89d8631782091f3e6f67d1e8d09c09df153772237e0
Instruction Fuzzy Hash: 39C1EE74E042188FDB24CFA9C881BDDBBB1BF49308F2095A9E419BB351DB34A995CF41

Uniqueness

Uniqueness Score: -1.00%

Function 04EAC794, Relevance: 1.8, APIs: 1, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.280679702.0000000004EA0000.00000040.00000001.sdmp, Offset: 04EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a77b1f3a67d4d27ae44f18020e31883463800888de1c33102a726f0285f632e1
Instruction ID: 7a0b50171d22b3ae9ecaad061a73f3ec38e1768053db4c64b8b5c22c02743611
Opcode Fuzzy Hash: a77b1f3a67d4d27ae44f18020e31883463800888de1c33102a726f0285f632e1
Instruction Fuzzy Hash: 3AB10074E042188FEB24CFA9C981BDDBBB1BF49308F2495A9E419BB350D730A995CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00C2E4E8, Relevance: 1.6, APIs: 1, Instructions: 100memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 00C2E597

Memory Dump Source

Source File: 00000000.00000002.274004871.0000000000C20000.00000040.00000001.sdmp, Offset: 00C20000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 08b5b3ce5fd1b1f659f26ca0ac6ab304ab7869a753a91d96e5108c70079120c6
Instruction ID: ee7139c280250befb1edd8bef769f950056e033e56d80d166a8cb82e93703db8
Opcode Fuzzy Hash: 08b5b3ce5fd1b1f659f26ca0ac6ab304ab7869a753a91d96e5108c70079120c6
Instruction Fuzzy Hash: A63188B9D042589FCF10CFA9E484AEEFBF0BB59314F14906AE819B7210D774A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00C2A3E8, Relevance: 1.6, APIs: 1, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 00C2A497

Memory Dump Source

Source File: 00000000.00000002.274004871.0000000000C20000.00000040.00000001.sdmp, Offset: 00C20000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 41229fe45a0bb63833383428164859dc04b56e64bccd7d6bd8322cf4c5b122f0
Instruction ID: c0304ac519866c1633c36a2ec30b3d42af49625934dc6a3cd976c3cd14d4ee12
Opcode Fuzzy Hash: 41229fe45a0bb63833383428164859dc04b56e64bccd7d6bd8322cf4c5b122f0
Instruction Fuzzy Hash: 4D3198B9D042589FCF10CFA9E884AEEFBB1BB59310F14A06AE814B7210C774A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00C2A3F0, Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 00C2A497

Memory Dump Source

Source File: 00000000.00000002.274004871.0000000000C20000.00000040.00000001.sdmp, Offset: 00C20000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: e3c9aff52423b410179fd4e3dd0089287708f0efeca530a073852aff26d5a01a
Instruction ID: ec582841c7af4d36fb5c56db2e31450bae11206f0c93cd68b51f8c323e4dbdf9
Opcode Fuzzy Hash: e3c9aff52423b410179fd4e3dd0089287708f0efeca530a073852aff26d5a01a
Instruction Fuzzy Hash: 9A3179B9D042589FCF10CFAAE984AEEFBB0BB59310F14902AE814B7210D774A945CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00C2E4F0, Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 00C2E597

Memory Dump Source

Source File: 00000000.00000002.274004871.0000000000C20000.00000040.00000001.sdmp, Offset: 00C20000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 15c26fe423b99230954e3d8a6035146b4ad5097be73ede07351364691da2222c
Instruction ID: 70c025335aa630601949e2be6dd6acafae588ea6ad2b2f5a736c6f4ab72c673f
Opcode Fuzzy Hash: 15c26fe423b99230954e3d8a6035146b4ad5097be73ede07351364691da2222c
Instruction Fuzzy Hash: 4D317AB9D042589FCF10CFA9E584AEEFBB0BB59314F14902AE814B7210D774A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00C2AE5C, Relevance: 1.6, APIs: 1, Instructions: 86fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?), ref: 00C2EC49

Memory Dump Source

Source File: 00000000.00000002.274004871.0000000000C20000.00000040.00000001.sdmp, Offset: 00C20000, based on PE: false

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: f2d0e675b2aa4f20897dbbdf2d17a598588665680b5d3cd617a9c374fec9359d
Instruction ID: 38c154a1cd6202b5708cb48aef441d0b253ca29d619171267f070ecaf8011c67
Opcode Fuzzy Hash: f2d0e675b2aa4f20897dbbdf2d17a598588665680b5d3cd617a9c374fec9359d
Instruction Fuzzy Hash: 3F31BBB4D05228DFCB10CFAAE984AEEFBF1AB49314F14806AE415B7210D374AA45CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00C2EBA8, Relevance: 1.6, APIs: 1, Instructions: 83fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?), ref: 00C2EC49

Memory Dump Source

Source File: 00000000.00000002.274004871.0000000000C20000.00000040.00000001.sdmp, Offset: 00C20000, based on PE: false

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 26c9c5c71e239268ac7082e55cc3155d84fbfce84ccd3476608678387ef5fb6a
Instruction ID: 6035b74b0d99ccf2f81602a199ed61c140499acb43522f58079c16dcdb8a2be3
Opcode Fuzzy Hash: 26c9c5c71e239268ac7082e55cc3155d84fbfce84ccd3476608678387ef5fb6a
Instruction Fuzzy Hash: D731BBB4D05258DFCB00CFA9E984AEEFBF1AB49314F14806AE415B7210D374AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00AAD21D, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.273353353.0000000000AAD000.00000040.00000001.sdmp, Offset: 00AAD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f66aeafc4404c93a1de2b180d5307eeab5c02c8ecf9620235c0af980e0f11bc
Instruction ID: 4be49b2484f1a5965fcc307bedecdededeb72157c75d636f0c433a841a7a61bd
Opcode Fuzzy Hash: 7f66aeafc4404c93a1de2b180d5307eeab5c02c8ecf9620235c0af980e0f11bc
Instruction Fuzzy Hash: 3B01477140C3849AEB104F16D8807A6FBD8EF56724F188059ED465B682C338D808C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 00AAD21C, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.273353353.0000000000AAD000.00000040.00000001.sdmp, Offset: 00AAD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ceb98c1361305404d1816b261f47296baf166d65068750f5df0951eb8f9d1e5
Instruction ID: 70da6bb03de961e9aecf55e5082b416908f4a5b2fb22b5d57dd017b124f78053
Opcode Fuzzy Hash: 9ceb98c1361305404d1816b261f47296baf166d65068750f5df0951eb8f9d1e5
Instruction Fuzzy Hash: 86F0C271408284AEEB108F06CCC4BB6FBD8EB52734F18C45AED485B686C3789C48CAB0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 04EA0188, Relevance: 4.1, Strings: 3, Instructions: 327COMMON

Download Yara Rule

Strings

\/l, xrefs: 04EA0278
D04l, xrefs: 04EA05E0
\/l, xrefs: 04EA026E

Memory Dump Source

Source File: 00000000.00000002.280679702.0000000004EA0000.00000040.00000001.sdmp, Offset: 04EA0000, based on PE: false

Similarity

API ID:
String ID: D04l$\/l$\/l
API String ID: 0-3910472393
Opcode ID: f069f8d050b1d784213c25980ecaa4aec2810a83566046292b8379e13d58b311
Instruction ID: 202b4bb35c47ec6a85dd4bf1127d6453363cbb3391b52c917ac3d27cc8a016c1
Opcode Fuzzy Hash: f069f8d050b1d784213c25980ecaa4aec2810a83566046292b8379e13d58b311
Instruction Fuzzy Hash: 04B11334B04205CBDB342F25840637AB6E2AFC6785F15982DD983CE694DF34F862DB62

Uniqueness

Uniqueness Score: -1.00%

Function 04EAC110, Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.280679702.0000000004EA0000.00000040.00000001.sdmp, Offset: 04EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17884ffcd9fc7d55b45594e1ce4f0346068afedc2859179b314fc3e47271764e
Instruction ID: f5767df02fc59f5abf2511df5d4e47fff971dab684be7a1d65470b447a90ea26
Opcode Fuzzy Hash: 17884ffcd9fc7d55b45594e1ce4f0346068afedc2859179b314fc3e47271764e
Instruction Fuzzy Hash: 0A02D574E04228CFDB24DFA5C844BEDBBB2BF49304F2495A9D408AB295DB346A95CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04EAB5F1, Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.280679702.0000000004EA0000.00000040.00000001.sdmp, Offset: 04EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebf8c067aae9af2b044b7c19256c4edbac70d761298ca2ce533b342bbd9369e3
Instruction ID: c564ab3a5dca66e1903a27527313e2037cd6e486ccb07da4069248b71103f247
Opcode Fuzzy Hash: ebf8c067aae9af2b044b7c19256c4edbac70d761298ca2ce533b342bbd9369e3
Instruction Fuzzy Hash: CBD1C1B4E01218CFDB14DFA5D994BEDFBB2BB49300F1092AAD909A7355DB306A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04EAB600, Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.280679702.0000000004EA0000.00000040.00000001.sdmp, Offset: 04EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 225895b00027959d2ecd86ed6f29e766e9002348fcd0be7a7c94d70ff7195c41
Instruction ID: 1caa97bce2660b6cb1143d6ae23bf08ca54994dba3dacc6195ba0985270dea41
Opcode Fuzzy Hash: 225895b00027959d2ecd86ed6f29e766e9002348fcd0be7a7c94d70ff7195c41
Instruction Fuzzy Hash: 6FD1C374E01218CFDB14DFA5D994BDDFBB2BB49300F1092AAD909A7355DB306A45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04EA5178, Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.280679702.0000000004EA0000.00000040.00000001.sdmp, Offset: 04EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98bf200977e030286fd75a494b3ab95dddf3366b1a89336b5fbfb7573bdbdfb2
Instruction ID: eaed27651511949ad4a389624474665e330f7caa9aecf24d3b3a9cca3bfdddcf
Opcode Fuzzy Hash: 98bf200977e030286fd75a494b3ab95dddf3366b1a89336b5fbfb7573bdbdfb2
Instruction Fuzzy Hash: 13D1E831C20B5A8ACB10EF64D990ADDB371FF96300F609B9AE50977224EF706AC5CB51

Uniqueness

Uniqueness Score: -1.00%

Function 04EA517F, Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.280679702.0000000004EA0000.00000040.00000001.sdmp, Offset: 04EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4d625a656136751c4c2b78d02012cbb956afedfd7f1aa6b5c11126914048550
Instruction ID: 3b22a422cdcaaa25e0b78c475c1a3fc47240e34b8c036309ee1b8dcb434bc0dd
Opcode Fuzzy Hash: f4d625a656136751c4c2b78d02012cbb956afedfd7f1aa6b5c11126914048550
Instruction Fuzzy Hash: 21D1E831C21B5A8ACB10EF64D990ADDB371FF96300F609B9AE50977224EF706AC5CB51

Uniqueness

Uniqueness Score: -1.00%

Function 04EA5188, Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.280679702.0000000004EA0000.00000040.00000001.sdmp, Offset: 04EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c297ac5d9388729e6c4e02c9fd5310a7636dd59ed7363fa9c8f8c394bbee5d7c
Instruction ID: 20cd2d3825512823d5f5bd8e806339d9b106019f1e429dc5410079d6697fc941
Opcode Fuzzy Hash: c297ac5d9388729e6c4e02c9fd5310a7636dd59ed7363fa9c8f8c394bbee5d7c
Instruction Fuzzy Hash: 98D1E931C20B5A8ACB10EF64D990ADDB371FF96300F609B9AE50977224EF706AC5CB51

Uniqueness

Uniqueness Score: -1.00%

Function 04EA5738, Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.280679702.0000000004EA0000.00000040.00000001.sdmp, Offset: 04EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 813b685f3018c7a08cb9f47c6bd89d7288ff7ac4dd3a7ec22c3f7ebc173dee47
Instruction ID: 4df7cd40ce7ce4283eb73cceffbae933ea103edef2e3160c53513aa86201b062
Opcode Fuzzy Hash: 813b685f3018c7a08cb9f47c6bd89d7288ff7ac4dd3a7ec22c3f7ebc173dee47
Instruction Fuzzy Hash: 8EB1E374E002188FDB14DFA9C944ADDFBB2BF89314F10D1AAD819AB355EB34A985CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04EAAF50, Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.280679702.0000000004EA0000.00000040.00000001.sdmp, Offset: 04EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e4ed282a115c971aeeb897671e1441152d2b7319270f7dd3fe4c0bda10d459f
Instruction ID: 60f58adb67dd97efa43d41e7e1d4abb78adc1a19542715edb0307294dfd4f4a5
Opcode Fuzzy Hash: 3e4ed282a115c971aeeb897671e1441152d2b7319270f7dd3fe4c0bda10d459f
Instruction Fuzzy Hash: 93512374D05218DFDB18DFA5C8887EDBBB2FF49309F249029D415AB2A0C7796A86CF10

Uniqueness

Uniqueness Score: -1.00%

Function 04EA5C68, Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.280679702.0000000004EA0000.00000040.00000001.sdmp, Offset: 04EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d4a6b75fe203f2ef442eb43ed2e2910bf86230045377f729fa2f45f6a17a284
Instruction ID: 45abd4acfc2b1fe2c91c8e20d1b453bf15f5ca80ddc05cce1c49102c9ab159c6
Opcode Fuzzy Hash: 7d4a6b75fe203f2ef442eb43ed2e2910bf86230045377f729fa2f45f6a17a284
Instruction Fuzzy Hash: B741AAB4D042089FDB10CFA9C984ADEFBF1AB0A304F24912AE419BB350D775A959CF95

Uniqueness

Uniqueness Score: -1.00%

Function 04EA3C14, Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.280679702.0000000004EA0000.00000040.00000001.sdmp, Offset: 04EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01186e608280cb4b97e46d877bb2f8d8c96e6e6b3fbaa215203024811fce8c06
Instruction ID: fa27d920301b72753bf55f91670892e76526a91fa65b158c8badea65563d537d
Opcode Fuzzy Hash: 01186e608280cb4b97e46d877bb2f8d8c96e6e6b3fbaa215203024811fce8c06
Instruction Fuzzy Hash: 34419AB4D052089FDB10CFA9C584BDEFBF0BB49308F20912AE415BB250D7B4A955CF95

Uniqueness

Uniqueness Score: -1.00%

Function 04EA41D7, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.280679702.0000000004EA0000.00000040.00000001.sdmp, Offset: 04EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84a369a6921420ff394da4f22ff91af9e245ebe908d653a97548cfbe1f0adca7
Instruction ID: a78d6032090df9341927c38b1ee86972f1633d76ec5ea6b2a7f6244675e899c0
Opcode Fuzzy Hash: 84a369a6921420ff394da4f22ff91af9e245ebe908d653a97548cfbe1f0adca7
Instruction Fuzzy Hash: 7D41A8B4D052089FDB10CFA9C584BEEFBF0BB09308F20952AE415BB250C7B4A949CF54

Uniqueness

Uniqueness Score: -1.00%

Function 04EA572A, Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.280679702.0000000004EA0000.00000040.00000001.sdmp, Offset: 04EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e0b03a74b5b0f55cec5a69c8725e596ccd1753dacb143c205347faf9c5ed2aa
Instruction ID: fe52a2bf666de1a0aa5909bc335d117a53ae967fb03193a8076077f9d59597d5
Opcode Fuzzy Hash: 3e0b03a74b5b0f55cec5a69c8725e596ccd1753dacb143c205347faf9c5ed2aa
Instruction Fuzzy Hash: 9431B175E006189FDB18CFAAD884ADDFBF2AFC8304F14D16AD408AB265EB705946CF00

Uniqueness

Uniqueness Score: -1.00%

Function 04EA46AB, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.280679702.0000000004EA0000.00000040.00000001.sdmp, Offset: 04EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d81cb15c4272ee900ca4606e184d910241c28c50dbbce6b0f279afa60680c03b
Instruction ID: 7bec21fea18f2c45aa57ad2b361499d1d901e05f7bd10cce80145799fb0a172e
Opcode Fuzzy Hash: d81cb15c4272ee900ca4606e184d910241c28c50dbbce6b0f279afa60680c03b
Instruction Fuzzy Hash: C9315EB8D05208DFDB18CFA9D584AEDBBB2BF89350F24A129E814B7390D374A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 04EA46B0, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.280679702.0000000004EA0000.00000040.00000001.sdmp, Offset: 04EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbce35e7c3e4e9e1dfbcb5106f6f7b81e730b34aa9037cfd223c78d1a44c6443
Instruction ID: ac7d35284a1b813fdcf129a28ab958ec456299c8d6b76ec64e4e3e6e7e238485
Opcode Fuzzy Hash: cbce35e7c3e4e9e1dfbcb5106f6f7b81e730b34aa9037cfd223c78d1a44c6443
Instruction Fuzzy Hash: 54315EB8D05208EFCB14CFA9D584AADBBF2BF89350F24A129E814B7390D774A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 04EA49C4, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.280679702.0000000004EA0000.00000040.00000001.sdmp, Offset: 04EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47d739583032be1f77b8d35834cea892c2b9d6d68108f5aa627f2843a185357b
Instruction ID: 2578d2c4fcf078a3ad6c986b874d88a8d25ad9987b4168799781708a828edf24
Opcode Fuzzy Hash: 47d739583032be1f77b8d35834cea892c2b9d6d68108f5aa627f2843a185357b
Instruction Fuzzy Hash: 1221C5B5D00208DFDB14CFAAD4846EDFBF1AB49314F14E16AE814BB290E774A641CF58

Uniqueness

Uniqueness Score: -1.00%

Function 04EA49D0, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.280679702.0000000004EA0000.00000040.00000001.sdmp, Offset: 04EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da0ba9d53882eca1a7d948cce21c189a3355de69749b4878b8eaddc9cc15a1e8
Instruction ID: f7e56dee3d10a4ca5a2464a6a7e5830d027b61273d726757ab1866c0c272e974
Opcode Fuzzy Hash: da0ba9d53882eca1a7d948cce21c189a3355de69749b4878b8eaddc9cc15a1e8
Instruction Fuzzy Hash: F4219274D00208DFDB04CFAAD4446EDFBF1AB89314F10E169E814BB290D774A941CF58

Uniqueness

Uniqueness Score: -1.00%

Function 04EA48FD, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.280679702.0000000004EA0000.00000040.00000001.sdmp, Offset: 04EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8507d0220b06a573bea27494b3199afb022b4e8c9daffe910ff3650c1dc076f4
Instruction ID: 93de96d322f948d83ffe957e9c9c596d0077efa8b3d2e91f4d1ddf1c154e53a2
Opcode Fuzzy Hash: 8507d0220b06a573bea27494b3199afb022b4e8c9daffe910ff3650c1dc076f4
Instruction Fuzzy Hash: 6EF062B5D052099BCF04CFA9D5814EEFBF2EB9A310F14A16AD915B7310E3349952CF58

Uniqueness

Uniqueness Score: -1.00%

Function 04EA4908, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.280679702.0000000004EA0000.00000040.00000001.sdmp, Offset: 04EA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eb7edaa31dfbf35867dc96d8b8f8c426529f6e1b54484e160c576f9eb5ddf33
Instruction ID: 93d669ccc7b9139f409e441d5e82ea21e209492799981a408f3adf5ecf4d1a0d
Opcode Fuzzy Hash: 9eb7edaa31dfbf35867dc96d8b8f8c426529f6e1b54484e160c576f9eb5ddf33
Instruction Fuzzy Hash: DCF042B5D0520D9F8F04DFA9D5418EEFBF2AB99310F10A16AE814B7310E73599518FA8

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: explore.exe PID: 2152 Parent PID: 3292 explore.exeCOMMON

Executed Functions

Function 00EEA3E8, Relevance: 1.6, APIs: 1, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,514A1B1F,DBBDF2D4), ref: 00EEA497

Memory Dump Source

Source File: 00000005.00000002.278241165.0000000000EE0000.00000040.00000001.sdmp, Offset: 00EE0000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: e8fa0552c4b365aae3cb1497244c0c5927876e170f75abcb64843defa55b3c3c
Instruction ID: 39c9a75e7580bf9699ee8e7e1fc350bd81140240255eda07b586e36c455ea35b
Opcode Fuzzy Hash: e8fa0552c4b365aae3cb1497244c0c5927876e170f75abcb64843defa55b3c3c
Instruction Fuzzy Hash: 6031A8B5D042589FCF10CFAAE884AEEFBB0BB59314F14A02AE814B7210D774A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00EE97F4, Relevance: 1.6, APIs: 1, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 00EEE597

Memory Dump Source

Source File: 00000005.00000002.278241165.0000000000EE0000.00000040.00000001.sdmp, Offset: 00EE0000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: c626d2193d7c88e421655684ad1c71daaca07762c8c6ba122925b35e4ae81db1
Instruction ID: e0e7fa7669151051acfbbdf70d9e4ce03c7e25601d22f1114805f86efe19f0b4
Opcode Fuzzy Hash: c626d2193d7c88e421655684ad1c71daaca07762c8c6ba122925b35e4ae81db1
Instruction Fuzzy Hash: 493189B5D04258DFCF10CFAAE484AEEFBB0AB59314F14A02AE814B7310D774A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00EE97B4, Relevance: 1.6, APIs: 1, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,514A1B1F,DBBDF2D4), ref: 00EEA497

Memory Dump Source

Source File: 00000005.00000002.278241165.0000000000EE0000.00000040.00000001.sdmp, Offset: 00EE0000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 48a1dfbe12eb5e1007ac1c7e6951950b2ea033a0a78ab9f70518926c52ec7f6a
Instruction ID: 36b52db78e0ba668510b828fa70f375d2ca23bc4d9e4ea7c971b80388ef8b98d
Opcode Fuzzy Hash: 48a1dfbe12eb5e1007ac1c7e6951950b2ea033a0a78ab9f70518926c52ec7f6a
Instruction Fuzzy Hash: 70319AB5D042589FCF10CFAAE484AEEFBB0AB59314F14902AE814B7310D774A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00EEE4E8, Relevance: 1.6, APIs: 1, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 00EEE597

Memory Dump Source

Source File: 00000005.00000002.278241165.0000000000EE0000.00000040.00000001.sdmp, Offset: 00EE0000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: f88686ee621d988058c0105b3cc0cf1e372d49a80059746f88ebfd0f36aab6a4
Instruction ID: 4ec1f81f13846355c32980d57556475b6f88059cae842977131f009b2715139a
Opcode Fuzzy Hash: f88686ee621d988058c0105b3cc0cf1e372d49a80059746f88ebfd0f36aab6a4
Instruction Fuzzy Hash: 243188B5D04258DFCB10CFAAE584AEEFBB1AB59314F14A02AE814B7310D734A945CF64

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: explore.exe PID: 6200 Parent PID: 6904 explore.exeCOMMON

Executed Functions

Function 012A97B4, Relevance: 1.6, APIs: 1, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,514A1B1F,DBBDF2D4), ref: 012AA497

Memory Dump Source

Source File: 00000006.00000002.279119188.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: da0fb88ae8ee4448dabef4f8f96b12cd31fd2b774ec443176c876194823ec033
Instruction ID: efd564857dae9aa04513a5dfdc7020e0a7073240032f144bdbc900e4b119a3c7
Opcode Fuzzy Hash: da0fb88ae8ee4448dabef4f8f96b12cd31fd2b774ec443176c876194823ec033
Instruction Fuzzy Hash: 2A3188B9D042589FCF10CFA9E984AEEFBB0BB49310F14906AE914B7210D774A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 012A97F4, Relevance: 1.6, APIs: 1, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 012AE597

Memory Dump Source

Source File: 00000006.00000002.279119188.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: cc912f3844122aa17df217d4ac98682ce46787167a2c7e70414ada5b96ab49c6
Instruction ID: cee08d980d61429182371b27a8eff0546f22c8ef91db146fd9e16d7841eb77d2
Opcode Fuzzy Hash: cc912f3844122aa17df217d4ac98682ce46787167a2c7e70414ada5b96ab49c6
Instruction Fuzzy Hash: EE3188B5D042589FCF14CFA9E884AEEFBB0BB59310F14906AE914B7210D774A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 012AA3E8, Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,514A1B1F,DBBDF2D4), ref: 012AA497

Memory Dump Source

Source File: 00000006.00000002.279119188.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8d55f72b6b09fef25d862cc63ccb98ee733de62a29413f0c1cc1aba6bf0fa6ef
Instruction ID: 77a03c782535d1e9d97163c0e4ae992ab88bd998ae6f43ae1e0db3f2f25ae858
Opcode Fuzzy Hash: 8d55f72b6b09fef25d862cc63ccb98ee733de62a29413f0c1cc1aba6bf0fa6ef
Instruction Fuzzy Hash: 8C3197B9D042589FCF10CFA9E984AEEFBB0BF19310F14906AE814B7210D374A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 012AE4E8, Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 012AE597

Memory Dump Source

Source File: 00000006.00000002.279119188.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 4988cb4961c5c400e2c26fb95bb02a223e41bc2efe496476d4b247dacbffc7de
Instruction ID: 390f0bb84d225e0a55d3392fd0be49ad3a041362636c22770cf9c20154e1df41
Opcode Fuzzy Hash: 4988cb4961c5c400e2c26fb95bb02a223e41bc2efe496476d4b247dacbffc7de
Instruction Fuzzy Hash: 0A3197B9D042589FCF14CFA9E984AEEFBB0AB19310F14942AE814B7210E774A945CF64

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report PO-75013.scr

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Sigma Overview

Signature Overview

Compliance:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre