Joe Sandbox Cloud Basic Analysis Report
Play interactive tourEdit tour

Windows Analysis Report aspnet_compiler.exe

Overview

General Information

Sample Name:aspnet_compiler.exe
Analysis ID:524315
MD5:fda8c8f2a4e100afb14c13dfcbcab2d2
SHA1:19dfd86294c4a525ba21c6af77681b2a9bbecb55
SHA256:99a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09
Infos:

Most interesting Screenshot:

Detection

Score:3
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Sample execution stops while process was sleeping (likely an evasion)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
May sleep (evasive loops) to hinder dynamic analysis
Contains long sleeps (>= 3 min)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

Process Tree

  • System is w10x64
  • aspnet_compiler.exe (PID: 3076 cmdline: "C:\Users\user\Desktop\aspnet_compiler.exe" MD5: FDA8C8F2A4E100AFB14C13DFCBCAB2D2)
    • conhost.exe (PID: 1708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: aspnet_compiler.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: aspnet_compiler.exeStatic PE information: certificate valid
Source: aspnet_compiler.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Source: Binary string: aspnet_compiler.pdb source: aspnet_compiler.exe
Source: aspnet_compiler.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: aspnet_compiler.exe, 00000000.00000002.251211914.000000000076A000.00000004.00000020.sdmpBinary or memory string: OriginalFilenameclr.dllT vs aspnet_compiler.exe
Source: aspnet_compiler.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\aspnet_compiler.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\Desktop\aspnet_compiler.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
Source: classification engineClassification label: clean3.winEXE@2/2@0/0
Source: unknownProcess created: C:\Users\user\Desktop\aspnet_compiler.exe "C:\Users\user\Desktop\aspnet_compiler.exe"
Source: C:\Users\user\Desktop\aspnet_compiler.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1708:120:WilError_01
Source: C:\Users\user\Desktop\aspnet_compiler.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\aspnet_compiler.exe.logJump to behavior
Source: aspnet_compiler.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: initial sampleStatic PE information: Valid certificate with Microsoft Issuer
Source: aspnet_compiler.exeStatic PE information: certificate valid
Source: aspnet_compiler.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Source: aspnet_compiler.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: aspnet_compiler.pdb source: aspnet_compiler.exe
Source: C:\Users\user\Desktop\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\aspnet_compiler.exe TID: 2212Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Users\user\Desktop\aspnet_compiler.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Users\user\Desktop\aspnet_compiler.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Users\user\Desktop\aspnet_compiler.exeMemory allocated: page read and write | page guardJump to behavior
Source: C:\Users\user\Desktop\aspnet_compiler.exeQueries volume information: C:\Users\user\Desktop\aspnet_compiler.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\aspnet_compiler.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformationJump to behavior

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection1Masquerading1OS Credential DumpingVirtualization/Sandbox Evasion21Remote ServicesData from Local SystemExfiltration Over Other Network MediumData ObfuscationEavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsDisable or Modify Tools1LSASS MemorySystem Information Discovery11Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Virtualization/Sandbox Evasion21Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection1NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 524315 Sample: aspnet_compiler.exe Startdate: 18/11/2021 Architecture: WINDOWS Score: 3 5 aspnet_compiler.exe 2 2->5         started        process3 7 conhost.exe 5->7         started       

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
aspnet_compiler.exe0%MetadefenderBrowse
aspnet_compiler.exe0%ReversingLabs

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:34.0.0 Boulder Opal
Analysis ID:524315
Start date:18.11.2021
Start time:10:59:43
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 3m 21s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:aspnet_compiler.exe
Cookbook file name:default.jbs
Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:5
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • HDC enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Detection:CLEAN
Classification:clean3.winEXE@2/2@0/0
EGA Information:Failed
HDC Information:
  • Successful, ratio: 1.9% (good quality ratio 1.9%)
  • Quality average: 61.7%
  • Quality standard deviation: 7.4%
HCA Information:
  • Successful, ratio: 100%
  • Number of executed functions: 8
  • Number of non-executed functions: 0
Cookbook Comments:
  • Adjust boot time
  • Enable AMSI
  • Found application associated with file extension: .exe
  • Stop behavior analysis, all processes terminated
Warnings:
  • Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe
  • Excluded IPs from analysis (whitelisted): 131.253.33.200, 13.107.22.200, 20.82.210.154, 23.35.236.56
  • Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, e1723.g.akamaiedge.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, dual-a-0001.dc-msedge.net, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, www-bing-com.dual-a-0001.a-msedge.net, arc.trafficmanager.net, prod.fs.microsoft.com.akadns.net
  • Execution Graph export aborted for target aspnet_compiler.exe, PID 3076 because it is empty
  • Not all processes where analyzed, report is missing behavior information
  • VT rate limit hit for: /opt/package/joesandbox/database/analysis/524315/sample/aspnet_compiler.exe

Simulations

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\aspnet_compiler.exe.log
Process:C:\Users\user\Desktop\aspnet_compiler.exe
File Type:ASCII text, with CRLF line terminators
Category:modified
Size (bytes):311
Entropy (8bit):5.323131242172993
Encrypted:false
SSDEEP:6:Q3La/xwchA2DLIP12MUAvvr3tDLIP12MUAvvR+uTL2LDY3U21v:Q3La/hhpDLI4M9tDLI4MWuPk21v
MD5:8722E88F9E6ACB8D431A70E7039AEB75
SHA1:28046D604A6500451BE3F539BAA6BA4BB68A70D0
SHA-256:3C0F25EBE9FE43091DE5A65EE92748F2B531F29DD2743B0D4E01DCCFADC95B5E
SHA-512:937092F2EDCABD47CD1896C5CFBAB8E7E443D1039650B3462DF0E301F6C53562A4B91FBF59A04957839DE5C121D061C08C6BD274E02DF2C8CC477F601C442C3B
Malicious:false
Reputation:low
Preview: 1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..
\Device\ConDrv
Process:C:\Users\user\Desktop\aspnet_compiler.exe
File Type:ASCII text, with CRLF line terminators
Category:dropped
Size (bytes):221
Entropy (8bit):4.801526423190794
Encrypted:false
SSDEEP:6:zx3Me21f1LRJIQtAMw/VgRZBXVN+1GFJqozrCib:zKpj1JIUwqBFN+1Q3b
MD5:A3DCA41A950A7DF7ECE76A867A17400E
SHA1:AA9EFDBCF37BEE2C7FD0986F1A4308A73EC3F7BB
SHA-256:6B2BE177016DF867316A0C432DAB0B71B6E51B35D169B0ACB1ABB47A4C03D7C0
SHA-512:F80207B5B78C7AE867AAB139196BBBEDE0437961DD03E790AEF3B877A228D7A90B9178B3342324B0EEA1C270E2A232A769B2F2D9E5DB4C065EB95140FA12239D
Malicious:false
Reputation:low
Preview: Microsoft (R) ASP.NET Compilation Tool version 4.8.4084.0..Utility to precompile an ASP.NET application..Copyright (C) Microsoft Corporation. All rights reserved.....Run 'aspnet_compiler -?' for a list of valid options...

Static File Info

General

File type:PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):6.120994357619221
TrID:
  • Win32 Executable (generic) Net Framework (10011505/4) 50.01%
  • Win32 Executable (generic) a (10002005/4) 49.97%
  • Generic Win/DOS Executable (2004/3) 0.01%
  • DOS Executable Generic (2002/1) 0.01%
  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:aspnet_compiler.exe
File size:56368
MD5:fda8c8f2a4e100afb14c13dfcbcab2d2
SHA1:19dfd86294c4a525ba21c6af77681b2a9bbecb55
SHA256:99a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09
SHA512:94f0ace37cae77be9935cf4fc8aaa94691343d3b38de5e16c663b902c220bff513cd02256c7af2d815a23dd30439582ddbb0880009c76bbf36ff8fbc1a6ddc18
SSDEEP:768:fF9E8FLLs2Zokf85d9PTV6Iq8Fnqf7P+WxqWKnz8DH:ffE6EkfOd9PT86dWvKgb
File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A>.]..............0.................. ........@.. ....................................`................................

File Icon

Icon Hash:00828e8e8686b000

Static PE Info

General

Entrypoint:0x40abc6
Entrypoint Section:.text
Digitally signed:true
Imagebase:0x400000
Subsystem:windows cui
Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Time Stamp:0x5DDA3E41 [Sun Nov 24 08:24:33 2019 UTC]
TLS Callbacks:
CLR (.Net) Version:v4.0.30319
OS Version Major:4
OS Version Minor:0
File Version Major:4
File Version Minor:0
Subsystem Version Major:4
Subsystem Version Minor:0
Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:true
Signature Issuer:CN=Microsoft Code Signing PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Signature Validation Error:The operation completed successfully
Error Number:0
Not Before, Not After
  • 5/2/2019 2:37:46 PM 5/2/2020 2:37:46 PM
Subject Chain
  • CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Version:3
Thumbprint MD5:6F00C8E4B0871786C50F94F4FDB5B1CE
Thumbprint SHA-1:62009AAABDAE749FD47D19150958329BF6FF4B34
Thumbprint SHA-256:B5DC4E58C8AFB9688734F6C5CF3ED0D4D89BF8366ACE982CC6B6854C480FC82E
Serial:33000001519E8D8F4071A30E41000000000151
Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
NameVirtual AddressVirtual Size Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IMPORT0xab740x4f.text
IMAGE_DIRECTORY_ENTRY_RESOURCE0xc0000x90c.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
IMAGE_DIRECTORY_ENTRY_SECURITY0x9a000x4230
IMAGE_DIRECTORY_ENTRY_BASERELOC0xe0000xc.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG0xaa3c0x1c.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
IMAGE_DIRECTORY_ENTRY_TLS0x00x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

Sections

NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
.text0x20000x8bcc0x8c00False0.368247767857data5.30781637535IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc0xc0000x90c0xa00False0.375data4.37979715052IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc0xe0000xc0x200False0.044921875data0.0815394123432IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
NameRVASizeTypeLanguageCountry
RT_VERSION0xc0900x3ecdataEnglishUnited States
RT_MANIFEST0xc48c0x47bexported SGML document, ASCII text, with CRLF line terminatorsEnglishUnited States
DLLImport
mscoree.dll_CorExeMain
DescriptionData
LegalCopyright Microsoft Corporation. All rights reserved.
InternalNameaspnet_compiler.exe
FileVersion4.8.4084.0 built by: NET48REL1
CompanyNameMicrosoft Corporation
PrivateBuildDDBLD502
CommentsFlavor=Retail
ProductNameMicrosoft .NET Framework
ProductVersion4.8.4084.0
FileDescriptionaspnet_compiler.exe
OriginalFilenameaspnet_compiler.exe
Translation0x0409 0x04b0

Possible Origin

Language of compilation systemCountry where language is spokenMap
EnglishUnited States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

051015s020406080100

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

  • • File
  • • Registry

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: aspnet_compiler.exe PID: 3076 Parent PID: 5940

Function Logs

General

Start time:11:00:41
Start date:18/11/2021
Path:C:\Users\user\Desktop\aspnet_compiler.exe
Wow64 process (32bit):true
Commandline:"C:\Users\user\Desktop\aspnet_compiler.exe"
Imagebase:0x170000
File size:56368 bytes
MD5 hash:FDA8C8F2A4E100AFB14C13DFCBCAB2D2
Has elevated privileges:true
Has administrator privileges:true
Programmed in:.Net C# or VB.NET
Reputation:low
Show Windows behavior

File Activities

Show Windows behavior

Section Activities

Show Windows behavior

Registry Activities

Show Windows behavior

Mutex Activities

Show Windows behavior

Process Activities

Show Windows behavior

Thread Activities

Show Windows behavior

Memory Activities

Show Windows behavior

System Activities

Show Windows behavior

LPC Port Activities

Analysis Process: conhost.exe PID: 1708 Parent PID: 3076

Function Logs

General

Start time:11:00:42
Start date:18/11/2021
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff774ee0000
File size:625664 bytes
MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Show Windows behavior

File Activities

Show Windows behavior

Section Activities

Show Windows behavior

Registry Activities

Show Windows behavior

Mutex Activities

Show Windows behavior

Process Activities

Show Windows behavior

Thread Activities

Show Windows behavior

Memory Activities

Show Windows behavior

System Activities

Show Windows behavior

Timing Activities

Show Windows behavior

Windows UI Activities

Show Windows behavior

LPC Port Activities

Disassembly

Code Analysis

Analysis Process: aspnet_compiler.exe PID: 3076 Parent PID: 5940 aspnet_compiler.exeCOMMON

Executed Functions

Download Yara Rule
Memory Dump Source
  • Source File: 00000000.00000002.251449702.0000000002330000.00000040.00000001.sdmp, Offset: 02330000, based on PE: false
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_2330000_aspnet_compiler.jbxd
Similarity
  • API ID:
  • String ID:
  • API String ID:
  • Opcode ID: b7431225231658c03fc865624376e3878ec718b35f9abc10977c955e4e7d0bd6
  • Instruction ID: a3b987e19e662af3a1cf35ff64bb009c31af8755d22e355c1d21456c5b5b83a6
  • Opcode Fuzzy Hash: b7431225231658c03fc865624376e3878ec718b35f9abc10977c955e4e7d0bd6
  • Instruction Fuzzy Hash: D981F135B042149FDB1AEFB8D8047ADB7F6EF89314F148869D4059B350EB35AE46CB81
Uniqueness

Uniqueness Score: -1.00%

Download Yara Rule
Memory Dump Source
  • Source File: 00000000.00000002.251449702.0000000002330000.00000040.00000001.sdmp, Offset: 02330000, based on PE: false
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_2330000_aspnet_compiler.jbxd
Similarity
  • API ID:
  • String ID:
  • API String ID:
  • Opcode ID: 4adcfac3b0256ebe7ca076a16b9d968b3479c8818e664d2e7ec1b112c5b48a7e
  • Instruction ID: 749bfb676676cb3bf02c27252d64d597a58a936d5ff1bc4c571b4ca1d876412c
  • Opcode Fuzzy Hash: 4adcfac3b0256ebe7ca076a16b9d968b3479c8818e664d2e7ec1b112c5b48a7e
  • Instruction Fuzzy Hash: 4841DF31F042149FEB19EBB8D9043ADB7E6EFC9305F158829D901A7340EF74AE468B91
Uniqueness

Uniqueness Score: -1.00%

Download Yara Rule
Memory Dump Source
  • Source File: 00000000.00000002.251449702.0000000002330000.00000040.00000001.sdmp, Offset: 02330000, based on PE: false
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_2330000_aspnet_compiler.jbxd
Similarity
  • API ID:
  • String ID:
  • API String ID:
  • Opcode ID: b2493f96c2c860f3d9ae72b9ab876646a08ce4aa35cdbc625467baf89d07b4db
  • Instruction ID: 9f6a32014361bc5b0ae93428a6aecc64f0f12ca6b44ca21ba646d78640a3b109
  • Opcode Fuzzy Hash: b2493f96c2c860f3d9ae72b9ab876646a08ce4aa35cdbc625467baf89d07b4db
  • Instruction Fuzzy Hash: 58312A343086108FD759ABB8D558A2D37E1AF8A71931608BCE506DF771DB36DC42CB90
Uniqueness

Uniqueness Score: -1.00%

Download Yara Rule
Memory Dump Source
  • Source File: 00000000.00000002.251449702.0000000002330000.00000040.00000001.sdmp, Offset: 02330000, based on PE: false
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_2330000_aspnet_compiler.jbxd
Similarity
  • API ID:
  • String ID:
  • API String ID:
  • Opcode ID: 2595aa9ed0387d59e367b3101e097d2fa3c0ef2b7b9471ae8eedae3b7f1bb3b9
  • Instruction ID: 48fb07eac4345448bf275aeef026b10353b315e286af19d70a99714190ea0517
  • Opcode Fuzzy Hash: 2595aa9ed0387d59e367b3101e097d2fa3c0ef2b7b9471ae8eedae3b7f1bb3b9
  • Instruction Fuzzy Hash: 4B21F3347041208FD759ABB9E558A2D33E2AF8961931208B8E606DF371DF36EC42CB90
Uniqueness

Uniqueness Score: -1.00%

Download Yara Rule
Memory Dump Source
  • Source File: 00000000.00000002.251449702.0000000002330000.00000040.00000001.sdmp, Offset: 02330000, based on PE: false
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_2330000_aspnet_compiler.jbxd
Similarity
  • API ID:
  • String ID:
  • API String ID:
  • Opcode ID: 49157562f8a89263a6f307fa8d5a839bb2a48981ced99d3a5f6f4411445ec5ee
  • Instruction ID: 33cc769c9e842d0698b0d9111cbd3490c408143485c9ddd99557c2c27c09c14a
  • Opcode Fuzzy Hash: 49157562f8a89263a6f307fa8d5a839bb2a48981ced99d3a5f6f4411445ec5ee
  • Instruction Fuzzy Hash: 7F217C31B082148FEF14ABB495183ADB3E6EFC930AF158828D906DB340DF75ED468B91
Uniqueness

Uniqueness Score: -1.00%

Download Yara Rule
Memory Dump Source
  • Source File: 00000000.00000002.251449702.0000000002330000.00000040.00000001.sdmp, Offset: 02330000, based on PE: false
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_2330000_aspnet_compiler.jbxd
Similarity
  • API ID:
  • String ID:
  • API String ID:
  • Opcode ID: 057f604fb9d68bdd4fd33657274f4ffee6b831d0fd21eac65cf117d1bc03d02b
  • Instruction ID: 8dd00128f395521b546a0fee4234d3da827202cd936f4e9b0f8ae4340941845a
  • Opcode Fuzzy Hash: 057f604fb9d68bdd4fd33657274f4ffee6b831d0fd21eac65cf117d1bc03d02b
  • Instruction Fuzzy Hash: 5611A1786007449FCB9BEF7CE495AA8BFF1EF4A31470904D8D4859F666EB218846CB41
Uniqueness

Uniqueness Score: -1.00%

Download Yara Rule
Memory Dump Source
  • Source File: 00000000.00000002.251449702.0000000002330000.00000040.00000001.sdmp, Offset: 02330000, based on PE: false
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_2330000_aspnet_compiler.jbxd
Similarity
  • API ID:
  • String ID:
  • API String ID:
  • Opcode ID: b2913b3c03d96d0d4d0365c2457e3843d13db26933bf03e09546046841f384da
  • Instruction ID: e7845c963e3c45e61896078e97906ca71ebac09483283c19871a4b54e95c7561
  • Opcode Fuzzy Hash: b2913b3c03d96d0d4d0365c2457e3843d13db26933bf03e09546046841f384da
  • Instruction Fuzzy Hash: 1DF0E9756046808FC757EB7CD055BA9BFF58F4721470808E9D045DF26ADB204C42CB51
Uniqueness

Uniqueness Score: -1.00%

Download Yara Rule
Memory Dump Source
  • Source File: 00000000.00000002.251449702.0000000002330000.00000040.00000001.sdmp, Offset: 02330000, based on PE: false
Joe Sandbox IDA Plugin
  • Snapshot File: hcaresult_0_2_2330000_aspnet_compiler.jbxd
Similarity
  • API ID:
  • String ID:
  • API String ID:
  • Opcode ID: a6747e34090c29a53dacacf1a7300ecefa197cc19cfd0e3ec7e9943bae5869a3
  • Instruction ID: 0cd81b34ae259a7d5943aec62ddde1dc8b5926a67794dc389d2b18bc330d77e5
  • Opcode Fuzzy Hash: a6747e34090c29a53dacacf1a7300ecefa197cc19cfd0e3ec7e9943bae5869a3
  • Instruction Fuzzy Hash: 90E0D875300A14CFC6A5FB6CE445F59B7D9DB85254B044824E109EF36CEF305C428791
Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions