Analysis Report payload.exe

Overview

General Information

Sample Name: payload.exe
Analysis ID: 433772
MD5: b06395f18df7aec3d7c00aa219594631
SHA1: 83e8ebe8e706fe4fdb0220cac18094ca4caa0259
SHA256: 1d9bccec9ebbe9e1b0947bdbb0a80c09e7277b2af65a4d25d64d99606d2a7b3a
Infos:

Most interesting Screenshot:

Detection

Score: 48
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Contains long sleeps (>= 3 min)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
May sleep (evasive loops) to hinder dynamic analysis
Program does not show much activity (idle)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files

Classification

AV Detection:

barindex
Antivirus / Scanner detection for submitted sample
Source: payload.exe Avira: detected

Compliance:

barindex
Uses 32bit PE files
Source: payload.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: payload.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: m.pdb*, q_Hi source: payload.exe, 00000001.00000002.1299332423.000000001AC66000.00000004.00000001.sdmp
Source: Binary string: 0C:\Windows\System.pdbG>g source: payload.exe, 00000001.00000002.1299332423.000000001AC66000.00000004.00000001.sdmp

System Summary:

barindex
Sample file is different than original file name gathered from version info
Source: payload.exe, 00000001.00000002.1297195072.000000000053C000.00000004.00000020.sdmp Binary or memory string: OriginalFilenameclr.dllT vs payload.exe
Source: payload.exe, 00000001.00000002.1296955099.0000000000104000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameShell.exe$ vs payload.exe
Source: payload.exe, 00000001.00000002.1299398035.000000001AF70000.00000002.00000001.sdmp Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs payload.exe
Source: payload.exe Binary or memory string: OriginalFilenameShell.exe$ vs payload.exe
Uses 32bit PE files
Source: payload.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: 1.0.payload.exe.100000.0.unpack, Program.cs Suspicious method names: System.Void Payload.Program::.ctor()
Source: 1.0.payload.exe.100000.0.unpack, Program.cs Suspicious method names: System.Void Payload.Program::Main(System.String[])
Source: 1.0.payload.exe.100000.0.unpack, Program.cs Suspicious method names: System.Void Payload.Program::<Main>m__0(System.Object)
Source: 1.0.payload.exe.100000.0.unpack, Program.cs Suspicious method names: System.Void Payload.Program::Shell()
Source: 1.0.payload.exe.100000.0.unpack, Program.cs Suspicious method names: System.Void Payload.Program::CmdOutputDataHandler(System.Object,System.Diagnostics.DataReceivedEventArgs)
Source: payload.exe, Program.cs Suspicious method names: System.Void Payload.Program::.ctor()
Source: payload.exe, Program.cs Suspicious method names: System.Void Payload.Program::Main(System.String[])
Source: payload.exe, Program.cs Suspicious method names: System.Void Payload.Program::<Main>m__0(System.Object)
Source: payload.exe, Program.cs Suspicious method names: System.Void Payload.Program::Shell()
Source: payload.exe, Program.cs Suspicious method names: System.Void Payload.Program::CmdOutputDataHandler(System.Object,System.Diagnostics.DataReceivedEventArgs)
Source: 1.2.payload.exe.100000.0.unpack, Program.cs Suspicious method names: System.Void Payload.Program::.ctor()
Source: 1.2.payload.exe.100000.0.unpack, Program.cs Suspicious method names: System.Void Payload.Program::Main(System.String[])
Source: 1.2.payload.exe.100000.0.unpack, Program.cs Suspicious method names: System.Void Payload.Program::<Main>m__0(System.Object)
Source: 1.2.payload.exe.100000.0.unpack, Program.cs Suspicious method names: System.Void Payload.Program::Shell()
Source: 1.2.payload.exe.100000.0.unpack, Program.cs Suspicious method names: System.Void Payload.Program::CmdOutputDataHandler(System.Object,System.Diagnostics.DataReceivedEventArgs)
Source: classification engine Classification label: mal48.winEXE@2/1@0/1
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5388:120:WilError_01
Source: payload.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\payload.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\payload.exe File read: C:\Users\user\Desktop\payload.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\payload.exe 'C:\Users\user\Desktop\payload.exe'
Source: C:\Users\user\Desktop\payload.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\payload.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 Jump to behavior
Source: payload.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: payload.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: m.pdb*, q_Hi source: payload.exe, 00000001.00000002.1299332423.000000001AC66000.00000004.00000001.sdmp
Source: Binary string: 0C:\Windows\System.pdbG>g source: payload.exe, 00000001.00000002.1299332423.000000001AC66000.00000004.00000001.sdmp
Source: C:\Users\user\Desktop\payload.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 420000 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 419891 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 419781 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 419672 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 419562 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 419453 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 419344 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 419234 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 419125 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 419016 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 418906 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 418797 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 418687 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 418578 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 418469 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 418359 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 418250 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 418141 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 418031 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 417922 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 417812 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 417703 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 417594 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 417484 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 417375 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 417266 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 417156 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 417047 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 416937 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 416828 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 416719 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 416609 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 416500 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 416391 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 416281 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 416172 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 416062 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 415953 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 415843 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 415734 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 415625 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 415516 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 415406 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 415297 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 415187 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 415078 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 414969 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 414859 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 414750 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 414641 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 414531 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\payload.exe Window / User API: threadDelayed 6914 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Window / User API: threadDelayed 2913 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -23058430092136925s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -420000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -419891s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -419781s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -419672s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -419562s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -419453s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -419344s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -419234s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -419125s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -419016s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -418906s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -418797s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -418687s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -418578s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -418469s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -418359s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -418250s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -418141s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -418031s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -417922s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -417812s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -417703s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -417594s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -417484s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -417375s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -417266s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -417156s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -417047s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -416937s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -416828s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -416719s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -416609s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -416500s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -416391s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -416281s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -416172s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -416062s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -415953s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -415843s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -415734s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -415625s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -415516s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -415406s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -415297s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -415187s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -415078s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -414969s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -414859s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -414750s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -414641s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\payload.exe TID: 6108 Thread sleep time: -414531s >= -30000s Jump to behavior
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 420000 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 419891 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 419781 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 419672 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 419562 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 419453 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 419344 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 419234 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 419125 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 419016 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 418906 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 418797 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 418687 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 418578 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 418469 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 418359 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 418250 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 418141 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 418031 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 417922 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 417812 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 417703 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 417594 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 417484 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 417375 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 417266 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 417156 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 417047 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 416937 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 416828 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 416719 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 416609 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 416500 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 416391 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 416281 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 416172 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 416062 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 415953 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 415843 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 415734 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 415625 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 415516 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 415406 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 415297 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 415187 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 415078 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 414969 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 414859 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 414750 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 414641 Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Thread delayed: delay time: 414531 Jump to behavior
Source: payload.exe, 00000001.00000002.1299398035.000000001AF70000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: payload.exe, 00000001.00000002.1299398035.000000001AF70000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: payload.exe, 00000001.00000002.1299398035.000000001AF70000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: payload.exe, 00000001.00000002.1297256206.0000000000599000.00000004.00000020.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: payload.exe, 00000001.00000002.1299398035.000000001AF70000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Anti Debugging:

barindex
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\payload.exe Memory allocated: page read and write | page guard Jump to behavior
Source: payload.exe, 00000001.00000002.1297875771.0000000000DA0000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: payload.exe, 00000001.00000002.1297875771.0000000000DA0000.00000002.00000001.sdmp Binary or memory string: Progman
Source: payload.exe, 00000001.00000002.1297875771.0000000000DA0000.00000002.00000001.sdmp Binary or memory string: SProgram Managerl
Source: payload.exe, 00000001.00000002.1297875771.0000000000DA0000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd,
Source: payload.exe, 00000001.00000002.1297875771.0000000000DA0000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\payload.exe Queries volume information: C:\Users\user\Desktop\payload.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\payload.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs