Play interactive tour

Edit tour

Windows Analysis Report btc1exch06_2021-10-24_12_30_07.zip

Overview

General Information

Sample Name:	btc1exch06_2021-10-24_12_30_07.zip
Analysis ID:	508276
MD5:	55b2aed249f07346fb34a72c0ddd0ee1
SHA1:	69465885111c48e07efd98e7e0f363f29229f206
SHA256:	bba536f8adeed06f60f9ce85f04e4d32cd7860f69eff026a58336ef02b11424c
Infos:
Most interesting Screenshot:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found inlined nop instructions (likely shell or obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Creates a process in suspended mode (likely to inject code)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Classification

Process Tree

System is w10x64

unarchiver.exe (PID: 4780 cmdline: 'C:\Windows\SysWOW64\unarchiver.exe' 'C:\Users\user\Desktop\btc1exch06_2021-10-24_12_30_07.zip' MD5: DB55139D9DD29F24AE8EA8F0E5606901)

7za.exe (PID: 6740 cmdline: 'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\amgha5zs.gqf' 'C:\Users\user\Desktop\btc1exch06_2021-10-24_12_30_07.zip' MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 4340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 0135099Bh		0_2_013502A8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 0135099Ah		0_2_013502A8

Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 0_2_013502A8		0_2_013502A8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 0_2_01350299		0_2_01350299

Source: C:\Windows\SysWOW64\unarchiver.exe

File created: C:\Users\user\AppData\Local\Temp\o21fgc1p.ykx

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: classification engine

Classification label: clean2.winZIP@4/2@0/0

Source: unknown	Process created: C:\Windows\SysWOW64\unarchiver.exe 'C:\Windows\SysWOW64\unarchiver.exe' 'C:\Users\user\Desktop\btc1exch06_2021-10-24_12_30_07.zip'
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe 'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\amgha5zs.gqf' 'C:\Users\user\Desktop\btc1exch06_2021-10-24_12_30_07.zip'
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe 'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\amgha5zs.gqf' 'C:\Users\user\Desktop\btc1exch06_2021-10-24_12_30_07.zip'	Jump to behavior

Source: btc1exch06_2021-10-24_12_30_07.zip

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4340:120:WilError_01

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe TID: 6760

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Process created: C:\Windows\SysWOW64\7za.exe 'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\amgha5zs.gqf' 'C:\Users\user\Desktop\btc1exch06_2021-10-24_12_30_07.zip'

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection11	Disable or Modify Tools1	OS Credential Dumping	Virtualization/Sandbox Evasion21	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Virtualization/Sandbox Evasion21	LSASS Memory	System Information Discovery2	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection11	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information1	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	508276
Start date:	24.10.2021
Start time:	19:31:38
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 4m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	btc1exch06_2021-10-24_12_30_07.zip
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean2.winZIP@4/2@0/0
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 11 Number of non-executed functions: 1
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .zip
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 20.50.102.62, 20.199.120.151, 23.211.5.146, 23.211.4.86, 23.211.6.115, 20.199.120.182, 20.199.120.85, 209.197.3.8, 20.54.110.249, 40.91.112.76, 40.112.88.60, 80.67.82.211, 80.67.82.235, 20.82.210.154 Excluded domains from analysis (whitelisted): storeedgefd.dsx.mp.microsoft.com.edgekey.net.globalredir.akadns.net, displaycatalog-rp-uswest.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, wus2-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, a1449.dscg2.akamai.net, arc.msn.com, storeedgefd.xbetservices.akadns.net, e12564.dspb.akamaiedge.net, wns.notify.trafficmanager.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, arc.trafficmanager.net, consumer-displaycatalogrp-aks2aks-uswest.md.mp.microsoft.com.akadns.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, storeedgefd.dsx.mp.microsoft.com, client.wns.windows.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, cds.d2s7q6s2.hwcdn.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, storeedgefd.dsx.mp.microsoft.com.edgekey.net, ris.api.iris.microsoft.com, store-images.s-microsoft.com, e16646.dscg.akamaiedge.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Execution Graph export aborted for target unarchiver.exe, PID 4780 because it is empty Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log Download File
Process:	C:\Windows\SysWOW64\unarchiver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	388
Entropy (8bit):	5.2529463157768355
Encrypted:	false
SSDEEP:	12:Q3LaJU20NaL10U29hJ5g1B0U2ukyrFk7v:MLF20NaL329hJ5g522r0
MD5:	FF3B761A021930205BEC9D7664AE9258
SHA1:	1039D595C6333358D5F7EE5619FE6794E6F5FDB1
SHA-256:	A3517BC4B1E6470905F9A38466318B302186496E8706F1976F1ED76F3E87AF0F
SHA-512:	1E77D09CF965575EF9800B1EE8947A02D98F88DBFA267300330860757A0C7350AF857A2CB7001C49AFF1F5BD1E0AE6E90F643B27054522CADC730DD14BC3DE11
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1ffc437de59fb69ba2b865ffdc98ffd1\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\54d944b3ca0ea1188d700fbd8089726b\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\bd8d59c984c9f5f2695f64341115cdf0\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Temp\o21fgc1p.ykx\unarchiver.log Download File
Process:	C:\Windows\SysWOW64\unarchiver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2042
Entropy (8bit):	5.079284227182979
Encrypted:	false
SSDEEP:	48:9cgWdEG0Gb0G0GpOG4VG0Gpmg/G0GBjGeG0GbyGjg/Gc/GBjGeGxG0G0GmbG0GR3:9onV5x
MD5:	83E3D2A747734B22BA209184848CE656
SHA1:	6981E7C2AABDD280ACAB31905F50D3E57744A28C
SHA-256:	8D218AB5EFDBE2F377BFA7FAFC131A6EA80CFD1C5CAEEF4D179B159F14161CC3
SHA-512:	2D86E26750925713E26B702DDA97390B219F17672EF7F85E3D6F16220F7ADA201A3B591A2D309028515CEE5B6A6A9D23D655A9AF42315A0E62E436185E0E47A6
Malicious:	false
Reputation:	low
Preview:	10/24/2021 7:32 PM: Unpack: C:\Users\user\Desktop\btc1exch06_2021-10-24_12_30_07.zip..10/24/2021 7:32 PM: Tmp dir: C:\Users\user\AppData\Local\Temp\amgha5zs.gqf..10/24/2021 7:32 PM: Received from standard out: ..10/24/2021 7:32 PM: Received from standard out: 7-Zip 18.05 (x86) : Copyright (c) 1999-2018 Igor Pavlov : 2018-04-30..10/24/2021 7:32 PM: Received from standard out: ..10/24/2021 7:32 PM: Received from standard out: Scanning the drive for archives:..10/24/2021 7:32 PM: Received from standard out: 1 file, 268 bytes (1 KiB)..10/24/2021 7:32 PM: Received from standard out: ..10/24/2021 7:32 PM: Received from standard out: Extracting archive: C:\Users\user\Desktop\btc1exch06_2021-10-24_12_30_07.zip..10/24/2021 7:32 PM: Received from standard out: ..10/24/2021 7:32 PM: Received from standard out: WARNINGS:..10/24/2021 7:32 PM: Received from standard out: Headers Error..10/24/2021 7:32 PM: Received from standard out: ..10/24/2021 7:32 PM: Received from standard out: --..10/24/2021

Static File Info

General
File type:	Zip archive data, at least v4.5 to extract
Entropy (8bit):	5.530880604643101
TrID:	ZIP compressed archive (8000/1) 100.00%
File name:	btc1exch06_2021-10-24_12_30_07.zip
File size:	268
MD5:	55b2aed249f07346fb34a72c0ddd0ee1
SHA1:	69465885111c48e07efd98e7e0f363f29229f206
SHA256:	bba536f8adeed06f60f9ce85f04e4d32cd7860f69eff026a58336ef02b11424c
SHA512:	f3a26304cdd879537481aee94de98856159e77c9ee85af1bcd5757f74d29af4f0d7108f33215ca84a3ce598bacfb65a33092a1d5e03f8907b3e290eed8478e71
SSDEEP:	6:5jvCeIK5A8+V2z2v2Bq6THkNzZzSvCe4Ec5jll+l8:5jv3Fz2eBpTEzzSvEEG/a8
File Content Preview:	PK..-.......... ..\|...........manifest.json......................k.O..9.W...-..j9..k).........e..,d...}A....PT?......_B4..T.}s.r..~........ FCs..r.r?...........O..0..%i..H..)...XZ......SLPK............... ..\|.........................manifest.jsonPK.......

File Icon


Icon Hash:	00828e8e8686b000

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: unarchiver.exe PID: 4780 Parent PID: 6488

General

Start time:	19:32:23
Start date:	24/10/2021
Path:	C:\Windows\SysWOW64\unarchiver.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\SysWOW64\unarchiver.exe' 'C:\Users\user\Desktop\btc1exch06_2021-10-24_12_30_07.zip'
Imagebase:	0x7b0000
File size:	10240 bytes
MD5 hash:	DB55139D9DD29F24AE8EA8F0E5606901
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	moderate

Chronological Activities

Analysis Process: 7za.exe PID: 6740 Parent PID: 4780

General

Start time:	19:32:24
Start date:	24/10/2021
Path:	C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\amgha5zs.gqf' 'C:\Users\user\Desktop\btc1exch06_2021-10-24_12_30_07.zip'
Imagebase:	0x1180000
File size:	289792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 4340 Parent PID: 6740

General

Start time:	19:32:25
Start date:	24/10/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: unarchiver.exe PID: 4780 Parent PID: 6488 unarchiver.exeCOMMON

Executed Functions

Function 013502A8, Relevance: 1.7, Strings: 1, Instructions: 481COMMON

Download Yara Rule

Strings

X1q, xrefs: 013506FA

Memory Dump Source

Source File: 00000000.00000002.287661484.0000000001350000.00000040.00000001.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_unarchiver.jbxd

Similarity

API ID:
String ID: X1q
API String ID: 0-4213818131
Opcode ID: 61877e67103e9e30578f8cb932ee293bb346c40779275dc49e708af4aeb5329d
Instruction ID: bc3b431e13f32daeb81ae37a8b62e207d452595de821c655452a91a6ae7635aa
Opcode Fuzzy Hash: 61877e67103e9e30578f8cb932ee293bb346c40779275dc49e708af4aeb5329d
Instruction Fuzzy Hash: DB221A74D00228CFDB14DFA5D884B9DBBB2FF89305F108669E90AA7359DB355981CF10

Uniqueness

Uniqueness Score: -1.00%

Function 01350C40, Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.287661484.0000000001350000.00000040.00000001.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdaa18558c2aff45f0c234563f2092f42cbc26b8458f3212c78c1d7fcd34336f
Instruction ID: bf6b459a757901187215d8d64bc06cda4defd20b70037ae361bd8e149e357e70
Opcode Fuzzy Hash: cdaa18558c2aff45f0c234563f2092f42cbc26b8458f3212c78c1d7fcd34336f
Instruction Fuzzy Hash: 46510774E02209DFDB18DFB5D9809AEBBB2FF8A704F205429E805B7354DB359941CB64

Uniqueness

Uniqueness Score: -1.00%

Function 01350C30, Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.287661484.0000000001350000.00000040.00000001.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e09bca7124a4a75b232f8bc2b8b385e476150f7042b9d70c2720cfb0939475a
Instruction ID: 50b18baf4f972275fa873051e2185ba576f9422ca0ae0037fd891ea879823018
Opcode Fuzzy Hash: 1e09bca7124a4a75b232f8bc2b8b385e476150f7042b9d70c2720cfb0939475a
Instruction Fuzzy Hash: E8512870E02209DFDB18DFB9D980AAEBBB2FF8A310F205429E405A7354DB359941CF64

Uniqueness

Uniqueness Score: -1.00%

Function 01350ACC, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.287661484.0000000001350000.00000040.00000001.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3ccb5f67a3952efa24f58041b5f3e7d1e62def2cb0e5061879891b42b42bb3f
Instruction ID: 2b2d8c76203574b09b76af57cead2ea5a3df8dcfa8b17fc3153c9a8182a7d609
Opcode Fuzzy Hash: b3ccb5f67a3952efa24f58041b5f3e7d1e62def2cb0e5061879891b42b42bb3f
Instruction Fuzzy Hash: 32217C71D05218CFCB54DFA5D884AEDBBB6FB89304F20852AD900B3254DB70AD45CF60

Uniqueness

Uniqueness Score: -1.00%

Function 01350AD8, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.287661484.0000000001350000.00000040.00000001.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5170d6143c7f84629f59859125f7265a3ae65f6da38da12db329b3ba289b3e0
Instruction ID: 130f42981637dbb25a77f251b97b40d047503de671598386197d8aefd67bbe00
Opcode Fuzzy Hash: b5170d6143c7f84629f59859125f7265a3ae65f6da38da12db329b3ba289b3e0
Instruction Fuzzy Hash: 82214C35D05218DFCB14DFA5D9846EEBBB6EB89304F20852ADA00B3354DB71AE16CF94

Uniqueness

Uniqueness Score: -1.00%

Function 01350EBF, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.287661484.0000000001350000.00000040.00000001.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11bd38694c787edfebd17b193905f9d6de7eba0484337e17dd9587451e574b5a
Instruction ID: a3f9cad40aa8f37476131866ccf6308817a69fee0ecbcaafe73e260a83a7a1de
Opcode Fuzzy Hash: 11bd38694c787edfebd17b193905f9d6de7eba0484337e17dd9587451e574b5a
Instruction Fuzzy Hash: 0C113270C052498FCB08DFA4C484AAEBBB0EF46314F2045AEC801A72A0D7795A89CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01350E38, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.287661484.0000000001350000.00000040.00000001.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3af6ec72abdf0baef12ff30e6dca4848130632fb24a420e329453dbcdc69a820
Instruction ID: 02536d9faa9fbd0937e29ef5164b4cd031113631f4be826c28395c4f41dfbc5d
Opcode Fuzzy Hash: 3af6ec72abdf0baef12ff30e6dca4848130632fb24a420e329453dbcdc69a820
Instruction Fuzzy Hash: B3012570C022099FCB08DFA4C485BAEBBB0AF45305F2095ADD400A7291C7345A44CF91

Uniqueness

Uniqueness Score: -1.00%

Function 01350ED0, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.287661484.0000000001350000.00000040.00000001.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6d5322a29df1ec0123be3bdd6d8c4c5001d8e459c0de5005552fac020cf294f
Instruction ID: 215623baa5c5540bf7f08e50c569d775bfb33db731725d46f3c5303413850d75
Opcode Fuzzy Hash: a6d5322a29df1ec0123be3bdd6d8c4c5001d8e459c0de5005552fac020cf294f
Instruction Fuzzy Hash: E1011270C01209DFCB08EFA8C445BAEBBB0AB45305F2099ADC80473290C7799A84CF94

Uniqueness

Uniqueness Score: -1.00%

Function 01350BBF, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.287661484.0000000001350000.00000040.00000001.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70f758de9966ac0080415462f52f83fffb6c395b8e273845fba8b2ad85203197
Instruction ID: 8443acd21a8d860e65f61fabd0c96d3aa54134eb4cdca4f8b8a2151c8ed3c353
Opcode Fuzzy Hash: 70f758de9966ac0080415462f52f83fffb6c395b8e273845fba8b2ad85203197
Instruction Fuzzy Hash: D70178B4D08349DFCF14DFA8C4849AEBFF1AF46300F2084AEC885A7211EB385A01CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01350E48, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.287661484.0000000001350000.00000040.00000001.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4f68c6067c25dde3d02a1c61451980adc20bdb5d5c69bfd87bce988ba714ca9
Instruction ID: 67180f1c90af7d11b247eb92d590c017f5bd53f592f791b865ca17bbb0a1b1d3
Opcode Fuzzy Hash: e4f68c6067c25dde3d02a1c61451980adc20bdb5d5c69bfd87bce988ba714ca9
Instruction Fuzzy Hash: D7012470C01209DFCB08EFA8D545BAEBBB0AF45305F2095ADC40473390C7399A84CF94

Uniqueness

Uniqueness Score: -1.00%

Function 01350BD0, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.287661484.0000000001350000.00000040.00000001.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 067c4e2542368ee30912a069256e135598203035285995b7fefa0d1aea2c5430
Instruction ID: 093adebd994f26eaba7e9848db9441c98c36a84b8fad9a0c58a28f7228c9c05a
Opcode Fuzzy Hash: 067c4e2542368ee30912a069256e135598203035285995b7fefa0d1aea2c5430
Instruction Fuzzy Hash: 89F01D74D0520DEBCB58EFA9C5819AEBBF5AF45700F1084AA9805B7310DB355A00CB65

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 01350299, Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.287661484.0000000001350000.00000040.00000001.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 384e72dae48f688d253bad281390789d272e865705b347dcb06b562f6ca2027e
Instruction ID: f65787eb35d6b07ae0f74b5c213b7539e7d0cd614e192b74cfa4c6246fb28518
Opcode Fuzzy Hash: 384e72dae48f688d253bad281390789d272e865705b347dcb06b562f6ca2027e
Instruction Fuzzy Hash: BE91D474D00214DFDB18DFA6EC48B99BBB2FB89305F108666E90EA7268DB315955CF20

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report btc1exch06_2021-10-24_12_30_07.zip

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Sigma Overview

Jbx Signature Overview

Compliance:

Software Vulnerabilities:

System Summary:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: unarchiver.exe PID: 4780 Parent PID: 6488

General

Chronological Activities

Analysis Process: 7za.exe PID: 6740 Parent PID: 4780

General

Chronological Activities

Analysis Process: conhost.exe PID: 4340 Parent PID: 6740

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: unarchiver.exe PID: 4780 Parent PID: 6488 unarchiver.exeCOMMON

Executed Functions

Function 013502A8, Relevance: 1.7, Strings: 1, Instructions: 481COMMON

Function 01350C40, Relevance: .2, Instructions: 150COMMON

Function 01350C30, Relevance: .1, Instructions: 143COMMON

Function 01350ACC, Relevance: .1, Instructions: 76COMMON

Function 01350AD8, Relevance: .1, Instructions: 71COMMON

Function 01350EBF, Relevance: .0, Instructions: 46COMMON