Analysis Report payload.exe

ID:	433772
Product:	CloudBasic
Start time:	19:38:09
Start date:	13.06.2021
Sample:	payload.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	b06395f18df7aec3d7c00aa219594631
SHA1:	83e8ebe8e706fe4fdb0220cac18094ca4caa0259
SHA256:	1d9bccec9ebbe9e1b0947bdbb0a80c09e7277b2af65a4d25d64d99606d2a7b3a
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Name	Type	MD5	SHA1	SHA256
\Device\ConDrv	ASCII text, with CRLF line terminators	C147D87539490FCE026C828437C09B01	A921A72CCBED142579DE211DA005FB65AE713A07	12AE6114710970B7297DD8C52A0874FA455E11F96235FC38DD863A6174213629

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: payload.exe

Avira: detected

Compliance:

Uses 32bit PE files

Source: payload.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: payload.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: m.pdb*, q_Hi source: payload.exe, 00000001.00000002.1299332423.000000001AC66000.00000004.00000001.sdmp
Source:	Binary string: 0C:\Windows\System.pdbG>g source: payload.exe, 00000001.00000002.1299332423.000000001AC66000.00000004.00000001.sdmp

System Summary:

Sample file is different than original file name gathered from version info

Source: payload.exe, 00000001.00000002.1297195072.000000000053C000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs payload.exe
Source: payload.exe, 00000001.00000002.1296955099.0000000000104000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameShell.exe$ vs payload.exe
Source: payload.exe, 00000001.00000002.1299398035.000000001AF70000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs payload.exe
Source: payload.exe	Binary or memory string: OriginalFilenameShell.exe$ vs payload.exe

Uses 32bit PE files

Source: payload.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

.NET source code contains methods with suspicious names

Source: 1.0.payload.exe.100000.0.unpack, Program.cs	Suspicious method names: System.Void Payload.Program::.ctor()
Source: 1.0.payload.exe.100000.0.unpack, Program.cs	Suspicious method names: System.Void Payload.Program::Main(System.String[])
Source: 1.0.payload.exe.100000.0.unpack, Program.cs	Suspicious method names: System.Void Payload.Program::<Main>m__0(System.Object)
Source: 1.0.payload.exe.100000.0.unpack, Program.cs	Suspicious method names: System.Void Payload.Program::Shell()
Source: 1.0.payload.exe.100000.0.unpack, Program.cs	Suspicious method names: System.Void Payload.Program::CmdOutputDataHandler(System.Object,System.Diagnostics.DataReceivedEventArgs)
Source: payload.exe, Program.cs	Suspicious method names: System.Void Payload.Program::.ctor()
Source: payload.exe, Program.cs	Suspicious method names: System.Void Payload.Program::Main(System.String[])
Source: payload.exe, Program.cs	Suspicious method names: System.Void Payload.Program::<Main>m__0(System.Object)
Source: payload.exe, Program.cs	Suspicious method names: System.Void Payload.Program::Shell()
Source: payload.exe, Program.cs	Suspicious method names: System.Void Payload.Program::CmdOutputDataHandler(System.Object,System.Diagnostics.DataReceivedEventArgs)
Source: 1.2.payload.exe.100000.0.unpack, Program.cs	Suspicious method names: System.Void Payload.Program::.ctor()
Source: 1.2.payload.exe.100000.0.unpack, Program.cs	Suspicious method names: System.Void Payload.Program::Main(System.String[])
Source: 1.2.payload.exe.100000.0.unpack, Program.cs	Suspicious method names: System.Void Payload.Program::<Main>m__0(System.Object)
Source: 1.2.payload.exe.100000.0.unpack, Program.cs	Suspicious method names: System.Void Payload.Program::Shell()
Source: 1.2.payload.exe.100000.0.unpack, Program.cs	Suspicious method names: System.Void Payload.Program::CmdOutputDataHandler(System.Object,System.Diagnostics.DataReceivedEventArgs)

Classification label

Source: classification engine

Classification label: mal48.winEXE@2/1@0/1

Creates mutexes

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5388:120:WilError_01

PE file has an executable .text section and no other executable section

Source: payload.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Parts of this applications are using the .NET runtime (Probably coded in C#)

Source: C:\Users\user\Desktop\payload.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll

Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\payload.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Sample reads its own file content

Source: C:\Users\user\Desktop\payload.exe

File read: C:\Users\user\Desktop\payload.exe

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\payload.exe 'C:\Users\user\Desktop\payload.exe'
Source: C:\Users\user\Desktop\payload.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Uses an in-process (OLE) Automation server

Source: C:\Users\user\Desktop\payload.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Jump to behavior

PE file contains a COM descriptor data directory

Source: payload.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: payload.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: m.pdb*, q_Hi source: payload.exe, 00000001.00000002.1299332423.000000001AC66000.00000004.00000001.sdmp
Source:	Binary string: 0C:\Windows\System.pdbG>g source: payload.exe, 00000001.00000002.1299332423.000000001AC66000.00000004.00000001.sdmp

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\payload.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Contains long sleeps (>= 3 min)

Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 420000			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 419891			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 419781			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 419672			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 419562			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 419453			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 419344			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 419234			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 419125			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 419016			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 418906			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 418797			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 418687			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 418578			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 418469			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 418359			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 418250			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 418141			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 418031			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 417922			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 417812			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 417703			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 417594			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 417484			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 417375			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 417266			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 417156			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 417047			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 416937			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 416828			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 416719			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 416609			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 416500			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 416391			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 416281			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 416172			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 416062			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 415953			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 415843			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 415734			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 415625			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 415516			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 415406			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 415297			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 415187			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 415078			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 414969			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 414859			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 414750			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 414641			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 414531			Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Users\user\Desktop\payload.exe	Window / User API: threadDelayed 6914			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Window / User API: threadDelayed 2913			Jump to behavior

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -23058430092136925s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -420000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -419891s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -419781s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -419672s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -419562s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -419453s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -419344s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -419234s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -419125s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -419016s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -418906s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -418797s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -418687s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -418578s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -418469s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -418359s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -418250s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -418141s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -418031s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -417922s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -417812s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -417703s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -417594s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -417484s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -417375s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -417266s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -417156s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -417047s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -416937s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -416828s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -416719s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -416609s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -416500s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -416391s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -416281s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -416172s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -416062s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -415953s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -415843s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -415734s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -415625s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -415516s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -415406s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -415297s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -415187s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -415078s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -414969s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -414859s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -414750s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -414641s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108	Thread sleep time: -414531s >= -30000s			Jump to behavior

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Contains medium sleeps (>= 30s)

Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 420000			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 419891			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 419781			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 419672			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 419562			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 419453			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 419344			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 419234			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 419125			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 419016			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 418906			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 418797			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 418687			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 418578			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 418469			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 418359			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 418250			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 418141			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 418031			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 417922			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 417812			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 417703			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 417594			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 417484			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 417375			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 417266			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 417156			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 417047			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 416937			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 416828			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 416719			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 416609			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 416500			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 416391			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 416281			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 416172			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 416062			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 415953			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 415843			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 415734			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 415625			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 415516			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 415406			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 415297			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 415187			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 415078			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 414969			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 414859			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 414750			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 414641			Jump to behavior
Source: C:\Users\user\Desktop\payload.exe	Thread delayed: delay time: 414531			Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: payload.exe, 00000001.00000002.1299398035.000000001AF70000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: payload.exe, 00000001.00000002.1299398035.000000001AF70000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: payload.exe, 00000001.00000002.1299398035.000000001AF70000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: payload.exe, 00000001.00000002.1297256206.0000000000599000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: payload.exe, 00000001.00000002.1299398035.000000001AF70000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Anti Debugging:

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Creates guard pages, often used to prevent reverse engineering and debugging

Source: C:\Users\user\Desktop\payload.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Source: payload.exe, 00000001.00000002.1297875771.0000000000DA0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: payload.exe, 00000001.00000002.1297875771.0000000000DA0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: payload.exe, 00000001.00000002.1297875771.0000000000DA0000.00000002.00000001.sdmp	Binary or memory string: SProgram Managerl
Source: payload.exe, 00000001.00000002.1297875771.0000000000DA0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd,
Source: payload.exe, 00000001.00000002.1297875771.0000000000DA0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\payload.exe

Queries volume information: C:\Users\user\Desktop\payload.exe VolumeInformation

Jump to behavior

Queries the cryptographic machine GUID

Source: C:\Users\user\Desktop\payload.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior