Edit tour

Windows Analysis Report
UBpReASuEC

Overview

General Information

Sample Name:	UBpReASuEC (renamed file extension from none to dll)
Analysis ID:	670724
MD5:	66df13c96db53128fee1997dc75cd1b9
SHA1:	96b538087dd52cdd71b753e25d3f208ad45efc1b
SHA256:	3743363b9a2845554eed086c43ee5756bd8878867b4cb0a3c0ba6f096596aa5d
Tags:	dllOpenCTIBRSandboxed
Infos:

Detection

Wannacry

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected Wannacry ransomware

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Maps a DLL or memory area into another process

Found evasive API chain (may execute only at specific dates)

Writes to foreign memory regions

Changes memory attributes in foreign processes to executable or writable

Tries to evade debugger and weak emulator (self modifying code)

Machine Learning detection for sample

Machine Learning detection for dropped file

Creates a thread in another existing process (thread injection)

Tries to resolve many domain names, but no domain seems valid

Drops executables to the windows directory (C:\Windows) and starts them

Queries random domain names (often used to prevent blacklisting and sinkholes)

Uses 32bit PE files

Yara signature match

Antivirus or Machine Learning detection for unpacked file

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Found evasive API chain (date check)

Creates files inside the system directory

PE file contains sections with non-standard names

Detected potential crypto function

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

PE file contains executable resources (Code or Archives)

Connects to many different domains

Contains functionality for execution timing, often used to detect debuggers

Entry point lies outside standard sections

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

AV process strings found (often used to terminate AV products)

PE file does not import any functions

Drops PE files

Contains functionality to read the PEB

Drops PE files to the windows directory (C:\Windows)

Checks if the current process is being debugged

Dropped file seen in connection with other malware

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 6876 cmdline: loaddll32.exe "C:\Users\user\Desktop\UBpReASuEC.dll" MD5: 7DEB5DB86C0AC789123DEC286286B938)

cmd.exe (PID: 6884 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\UBpReASuEC.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 6904 cmdline: rundll32.exe "C:\Users\user\Desktop\UBpReASuEC.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

mssecsvc.exe (PID: 6944 cmdline: C:\WINDOWS\mssecsvc.exe MD5: 2391E0DBB3A7862306913032CE72F302)

winlogon.exe (PID: 576 cmdline: winlogon.exe MD5: F9017F2DC455AD373DF036F5817A8870)

lsass.exe (PID: 624 cmdline: C:\Windows\system32\lsass.exe MD5: 317340CD278A374BCEF6A30194557227)

backgroundTaskHost.exe (PID: 1592 cmdline: "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca MD5: B7FC4A29431D4F795BBAB1FB182B759A)

WMIADAP.exe (PID: 6908 cmdline: wmiadap.exe /F /T /R MD5: 9783D0765F31980950445DFD40DB15DA)

svchost.exe (PID: 6012 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

fontdrvhost.exe (PID: 728 cmdline: fontdrvhost.exe MD5: 31113981180E69C2773BCADA4051738A)

fontdrvhost.exe (PID: 736 cmdline: fontdrvhost.exe MD5: 31113981180E69C2773BCADA4051738A)

svchost.exe (PID: 812 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

BackgroundTransferHost.exe (PID: 4320 cmdline: "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 MD5: 02BA81746B929ECC9DB6665589B68335)

BackgroundTransferHost.exe (PID: 3040 cmdline: "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 MD5: 02BA81746B929ECC9DB6665589B68335)

backgroundTaskHost.exe (PID: 6196 cmdline: "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXv783p9dqgsc3mek8m05c3tj95wa9p858.mca MD5: B7FC4A29431D4F795BBAB1FB182B759A)

svchost.exe (PID: 904 cmdline: c:\windows\system32\svchost.exe -k dcomlaunch -p -s LSM MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 372 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p -s gpsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 256 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 472 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s lmhosts MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 696 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p -s Schedule MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 1040 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s TimeBrokerSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 1060 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p -s ProfSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 1172 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p -s UserManager MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 1304 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s EventLog MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 1372 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s EventSystem MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 1388 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p -s Themes MD5: 32569E403279B3FD2EDB7EBD036273FA)

rundll32.exe (PID: 6892 cmdline: rundll32.exe C:\Users\user\Desktop\UBpReASuEC.dll,PlayGame MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6960 cmdline: rundll32.exe "C:\Users\user\Desktop\UBpReASuEC.dll",PlayGame MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

mssecsvc.exe (PID: 6976 cmdline: C:\WINDOWS\mssecsvc.exe MD5: 2391E0DBB3A7862306913032CE72F302)

mssecsvc.exe (PID: 7092 cmdline: C:\WINDOWS\mssecsvc.exe -m security MD5: 2391E0DBB3A7862306913032CE72F302)

svchost.exe (PID: 744 cmdline: c:\windows\system32\svchost.exe -k dcomlaunch -p -s PlugPlay MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 860 cmdline: c:\windows\system32\svchost.exe -k rpcss -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

dwm.exe (PID: 992 cmdline: dwm.exe MD5: 70073A05B2B43FFB7A625708BB29E7C7)

svchost.exe (PID: 5488 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6480 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6644 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
UBpReASuEC.dll	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x45604:$x1: icacls . /grant Everyone:F /T /C /Q 0x353d0:$x3: tasksche.exe 0x455e0:$x3: tasksche.exe 0x455bc:$x4: Global\MsWinZonesCacheCounterMutexA 0x45634:$x5: WNcry@2ol7 0x3028:$x7: mssecsvc.exe 0x120ac:$x7: mssecsvc.exe 0x1b3b4:$x7: mssecsvc.exe 0x353a8:$x8: C:\%s\qeriuwjhrf 0x45604:$x9: icacls . /grant Everyone:F /T /C /Q 0x3014:$s1: C:\%s\%s 0x12098:$s1: C:\%s\%s 0x1b39c:$s1: C:\%s\%s 0x353bc:$s1: C:\%s\%s 0x45534:$s3: cmd.exe /c "%s" 0x77a88:$s4: msg/m_portuguese.wnry 0x326f0:$s5: \\192.168.56.20\IPC$ 0x1fae5:$s6: \\172.16.99.5\IPC$ 0xd195:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x78da:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x5449:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
UBpReASuEC.dll	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
UBpReASuEC.dll	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x455e0:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x45608:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68

Dropped Files

Source	Rule	Description	Author	Strings
C:\Windows\tasksche.exe	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry
C:\Windows\tasksche.exe	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
C:\Windows\mssecsvc.exe	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q 0x3136c:$x3: tasksche.exe 0x4157c:$x3: tasksche.exe 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA 0x415d0:$x5: WNcry@2ol7 0xe048:$x7: mssecsvc.exe 0x17350:$x7: mssecsvc.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q 0xe034:$s1: C:\%s\%s 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x414d0:$s3: cmd.exe /c "%s" 0x73a24:$s4: msg/m_portuguese.wnry 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
C:\Windows\mssecsvc.exe	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
C:\Windows\mssecsvc.exe	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
C:\Windows\mssecsvc.exe	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x4157c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x415a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000000.390692739.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000000.395643051.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000004.00000002.712940908.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000000.400396194.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000000.398897193.0000000000710000.00000080.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000006.00000000.397658913.0000000000710000.00000080.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000009.00000000.403899564.0000000000710000.00000080.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000004.00000000.390830304.0000000000710000.00000080.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000004.00000000.395187719.0000000000710000.00000080.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000006.00000000.400479545.0000000000710000.00000080.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000009.00000002.517302066.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000000.395761146.0000000000710000.00000080.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000004.00000000.392189177.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000009.00000002.517693947.0000000000710000.00000080.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000004.00000000.392372689.0000000000710000.00000080.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000006.00000000.398730935.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000004.00000000.396523616.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000004.00000000.395038973.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000000.397443595.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000002.470437987.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000004.00000002.713109877.0000000000710000.00000080.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000006.00000002.470687764.0000000000710000.00000080.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000004.00000000.396673500.0000000000710000.00000080.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000009.00000000.403788291.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: mssecsvc.exe PID: 6944	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: mssecsvc.exe PID: 6976	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: mssecsvc.exe PID: 7092	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Click to see the 22 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
6.2.mssecsvc.exe.7100a4.1.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry
6.2.mssecsvc.exe.7100a4.1.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
9.2.mssecsvc.exe.7100a4.1.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xe8fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xe8d8:$x3: tasksche.exe 0xe8b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xe92c:$x5: WNcry@2ol7 0xe8fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xe82c:$s3: cmd.exe /c "%s"
9.2.mssecsvc.exe.7100a4.1.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xe8d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xe900:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
4.0.mssecsvc.exe.7100a4.1.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xe8fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xe8d8:$x3: tasksche.exe 0xe8b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xe92c:$x5: WNcry@2ol7 0xe8fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xe82c:$s3: cmd.exe /c "%s"
4.0.mssecsvc.exe.7100a4.1.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xe8d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xe900:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
6.0.mssecsvc.exe.7100a4.7.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xe8fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xe8d8:$x3: tasksche.exe 0xe8b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xe92c:$x5: WNcry@2ol7 0xe8fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xe82c:$s3: cmd.exe /c "%s"
6.0.mssecsvc.exe.7100a4.7.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xe8d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xe900:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
9.0.mssecsvc.exe.7100a4.1.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xe8fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xe8d8:$x3: tasksche.exe 0xe8b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xe92c:$x5: WNcry@2ol7 0xe8fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xe82c:$s3: cmd.exe /c "%s"
9.0.mssecsvc.exe.7100a4.1.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xe8d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xe900:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
4.0.mssecsvc.exe.7100a4.5.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xe8fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xe8d8:$x3: tasksche.exe 0xe8b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xe92c:$x5: WNcry@2ol7 0xe8fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xe82c:$s3: cmd.exe /c "%s"
4.0.mssecsvc.exe.7100a4.5.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xe8d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xe900:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
6.0.mssecsvc.exe.7100a4.5.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xe8fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xe8d8:$x3: tasksche.exe 0xe8b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xe92c:$x5: WNcry@2ol7 0xe8fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xe82c:$s3: cmd.exe /c "%s"
6.0.mssecsvc.exe.7100a4.5.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xe8d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xe900:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
6.0.mssecsvc.exe.7100a4.1.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xe8fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xe8d8:$x3: tasksche.exe 0xe8b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xe92c:$x5: WNcry@2ol7 0xe8fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xe82c:$s3: cmd.exe /c "%s"
6.0.mssecsvc.exe.7100a4.1.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xe8d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xe900:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
4.0.mssecsvc.exe.7100a4.7.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xe8fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xe8d8:$x3: tasksche.exe 0xe8b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xe92c:$x5: WNcry@2ol7 0xe8fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xe82c:$s3: cmd.exe /c "%s"
4.0.mssecsvc.exe.7100a4.7.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xe8d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xe900:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
4.2.mssecsvc.exe.7100a4.1.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xe8fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xe8d8:$x3: tasksche.exe 0xe8b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xe92c:$x5: WNcry@2ol7 0xe8fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xe82c:$s3: cmd.exe /c "%s"
4.2.mssecsvc.exe.7100a4.1.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xe8d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xe900:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
6.2.mssecsvc.exe.7100a4.1.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xe8fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xe8d8:$x3: tasksche.exe 0xe8b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xe92c:$x5: WNcry@2ol7 0xe8fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xe82c:$s3: cmd.exe /c "%s"
6.2.mssecsvc.exe.7100a4.1.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xe8d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xe900:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
4.0.mssecsvc.exe.7100a4.1.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry
4.0.mssecsvc.exe.7100a4.1.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
9.0.mssecsvc.exe.7100a4.1.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry
9.0.mssecsvc.exe.7100a4.1.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
6.0.mssecsvc.exe.7100a4.3.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xe8fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xe8d8:$x3: tasksche.exe 0xe8b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xe92c:$x5: WNcry@2ol7 0xe8fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xe82c:$s3: cmd.exe /c "%s"
6.0.mssecsvc.exe.7100a4.3.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xe8d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xe900:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
4.2.mssecsvc.exe.7100a4.1.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry
4.2.mssecsvc.exe.7100a4.1.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
4.0.mssecsvc.exe.7100a4.3.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xe8fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xe8d8:$x3: tasksche.exe 0xe8b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xe92c:$x5: WNcry@2ol7 0xe8fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xe82c:$s3: cmd.exe /c "%s"
4.0.mssecsvc.exe.7100a4.3.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xe8d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xe900:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
6.0.mssecsvc.exe.7100a4.5.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry
6.0.mssecsvc.exe.7100a4.5.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
9.2.mssecsvc.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q 0x3136c:$x3: tasksche.exe 0x4157c:$x3: tasksche.exe 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA 0x415d0:$x5: WNcry@2ol7 0x17350:$x7: mssecsvc.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x414d0:$s3: cmd.exe /c "%s" 0x73a24:$s4: msg/m_portuguese.wnry 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
9.2.mssecsvc.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
9.2.mssecsvc.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
9.2.mssecsvc.exe.400000.0.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x4157c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x415a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
6.0.mssecsvc.exe.7100a4.7.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry
6.0.mssecsvc.exe.7100a4.7.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
9.2.mssecsvc.exe.7100a4.1.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry
9.2.mssecsvc.exe.7100a4.1.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
4.0.mssecsvc.exe.7100a4.3.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry
4.0.mssecsvc.exe.7100a4.3.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
4.0.mssecsvc.exe.7100a4.5.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry
4.0.mssecsvc.exe.7100a4.5.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
6.0.mssecsvc.exe.7100a4.1.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry
6.0.mssecsvc.exe.7100a4.1.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
6.0.mssecsvc.exe.7100a4.3.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry
6.0.mssecsvc.exe.7100a4.3.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
4.0.mssecsvc.exe.7100a4.7.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry
4.0.mssecsvc.exe.7100a4.7.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
6.0.mssecsvc.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q 0x3136c:$x3: tasksche.exe 0x4157c:$x3: tasksche.exe 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA 0x415d0:$x5: WNcry@2ol7 0x17350:$x7: mssecsvc.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x414d0:$s3: cmd.exe /c "%s" 0x73a24:$s4: msg/m_portuguese.wnry 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
6.0.mssecsvc.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
6.0.mssecsvc.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
6.0.mssecsvc.exe.400000.0.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x4157c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x415a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
9.0.mssecsvc.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q 0x3136c:$x3: tasksche.exe 0x4157c:$x3: tasksche.exe 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA 0x415d0:$x5: WNcry@2ol7 0x17350:$x7: mssecsvc.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x414d0:$s3: cmd.exe /c "%s" 0x73a24:$s4: msg/m_portuguese.wnry 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
9.0.mssecsvc.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
9.0.mssecsvc.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
9.0.mssecsvc.exe.400000.0.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x4157c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x415a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
6.0.mssecsvc.exe.400000.2.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q 0x3136c:$x3: tasksche.exe 0x4157c:$x3: tasksche.exe 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA 0x415d0:$x5: WNcry@2ol7 0x17350:$x7: mssecsvc.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x414d0:$s3: cmd.exe /c "%s" 0x73a24:$s4: msg/m_portuguese.wnry 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
6.0.mssecsvc.exe.400000.2.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
6.0.mssecsvc.exe.400000.2.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
6.0.mssecsvc.exe.400000.2.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x4157c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x415a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
6.2.mssecsvc.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q 0x3136c:$x3: tasksche.exe 0x4157c:$x3: tasksche.exe 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA 0x415d0:$x5: WNcry@2ol7 0x17350:$x7: mssecsvc.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x414d0:$s3: cmd.exe /c "%s" 0x73a24:$s4: msg/m_portuguese.wnry 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
6.2.mssecsvc.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
6.2.mssecsvc.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
6.2.mssecsvc.exe.400000.0.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x4157c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x415a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
4.0.mssecsvc.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q 0x3136c:$x3: tasksche.exe 0x4157c:$x3: tasksche.exe 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA 0x415d0:$x5: WNcry@2ol7 0x17350:$x7: mssecsvc.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x414d0:$s3: cmd.exe /c "%s" 0x73a24:$s4: msg/m_portuguese.wnry 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
4.0.mssecsvc.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
4.0.mssecsvc.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
4.0.mssecsvc.exe.400000.0.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x4157c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x415a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
4.0.mssecsvc.exe.400000.2.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q 0x3136c:$x3: tasksche.exe 0x4157c:$x3: tasksche.exe 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA 0x415d0:$x5: WNcry@2ol7 0x17350:$x7: mssecsvc.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x414d0:$s3: cmd.exe /c "%s" 0x73a24:$s4: msg/m_portuguese.wnry 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
4.0.mssecsvc.exe.400000.2.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
4.0.mssecsvc.exe.400000.2.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
4.0.mssecsvc.exe.400000.2.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x4157c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x415a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
4.0.mssecsvc.exe.400000.6.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q 0x3136c:$x3: tasksche.exe 0x4157c:$x3: tasksche.exe 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA 0x415d0:$x5: WNcry@2ol7 0x17350:$x7: mssecsvc.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x414d0:$s3: cmd.exe /c "%s" 0x73a24:$s4: msg/m_portuguese.wnry 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
4.0.mssecsvc.exe.400000.6.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
4.0.mssecsvc.exe.400000.6.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
4.0.mssecsvc.exe.400000.6.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x4157c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x415a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
4.2.mssecsvc.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q 0x3136c:$x3: tasksche.exe 0x4157c:$x3: tasksche.exe 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA 0x415d0:$x5: WNcry@2ol7 0x17350:$x7: mssecsvc.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x414d0:$s3: cmd.exe /c "%s" 0x73a24:$s4: msg/m_portuguese.wnry 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
4.2.mssecsvc.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
4.2.mssecsvc.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
4.2.mssecsvc.exe.400000.0.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x4157c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x415a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
4.0.mssecsvc.exe.400000.4.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q 0x3136c:$x3: tasksche.exe 0x4157c:$x3: tasksche.exe 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA 0x415d0:$x5: WNcry@2ol7 0x17350:$x7: mssecsvc.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x414d0:$s3: cmd.exe /c "%s" 0x73a24:$s4: msg/m_portuguese.wnry 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
4.0.mssecsvc.exe.400000.4.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
4.0.mssecsvc.exe.400000.4.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
4.0.mssecsvc.exe.400000.4.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x4157c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x415a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
6.0.mssecsvc.exe.400000.4.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q 0x3136c:$x3: tasksche.exe 0x4157c:$x3: tasksche.exe 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA 0x415d0:$x5: WNcry@2ol7 0x17350:$x7: mssecsvc.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x414d0:$s3: cmd.exe /c "%s" 0x73a24:$s4: msg/m_portuguese.wnry 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
6.0.mssecsvc.exe.400000.4.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
6.0.mssecsvc.exe.400000.4.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
6.0.mssecsvc.exe.400000.4.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x4157c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x415a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
6.0.mssecsvc.exe.400000.6.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q 0x3136c:$x3: tasksche.exe 0x4157c:$x3: tasksche.exe 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA 0x415d0:$x5: WNcry@2ol7 0x17350:$x7: mssecsvc.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x414d0:$s3: cmd.exe /c "%s" 0x73a24:$s4: msg/m_portuguese.wnry 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
6.0.mssecsvc.exe.400000.6.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
6.0.mssecsvc.exe.400000.6.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
6.0.mssecsvc.exe.400000.6.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x4157c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x415a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
Click to see the 91 entries

Snort Signatures

ETPRO TROJAN Possible Virut DGA NXDOMAIN Responses (com) - Source IP: 8.8.8.8 - Destination IP: 192.168.2.6

Timestamp:	8.8.8.8192.168.2.653620792811577 07/21/22-05:05:02.361266
SID:	2811577
Source Port:	53
Destination Port:	62079
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Possible Virut DGA NXDOMAIN Responses (com) - Source IP: 8.8.8.8 - Destination IP: 192.168.2.6

Timestamp:	8.8.8.8192.168.2.653642892811577 07/21/22-05:03:37.145468
SID:	2811577
Source Port:	53
Destination Port:	64289
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Possible Virut DGA NXDOMAIN Responses (com) - Source IP: 8.8.8.8 - Destination IP: 192.168.2.6

Timestamp:	8.8.8.8192.168.2.653492872811577 07/21/22-05:03:59.403745
SID:	2811577
Source Port:	53
Destination Port:	49287
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Possible Virut DGA NXDOMAIN Responses (com) - Source IP: 8.8.8.8 - Destination IP: 192.168.2.6

Timestamp:	8.8.8.8192.168.2.653584682811577 07/21/22-05:04:20.247307
SID:	2811577
Source Port:	53
Destination Port:	58468
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) - Source IP: 192.168.2.6 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.68.8.8.851748532830018 07/21/22-05:00:40.717318
SID:	2830018
Source Port:	51748
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) - Source IP: 192.168.2.6 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.68.8.8.852225532830018 07/21/22-05:03:02.787279
SID:	2830018
Source Port:	52225
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: UBpReASuEC.dll	Metadefender: Detection: 74%			Perma Link
Source: UBpReASuEC.dll	ReversingLabs: Detection: 92%

Antivirus / Scanner detection for submitted sample

Source: UBpReASuEC.dll

Avira: detected

Antivirus detection for URL or domain

Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/N	Avira URL Cloud: Label: malware
Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/o	Avira URL Cloud: Label: malware
Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	URL Reputation: Label: malware
Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/%	Avira URL Cloud: Label: malware
Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/	URL Reputation: Label: malware

Antivirus detection for dropped file

Source: C:\Windows\mssecsvc.exe	Avira: detection malicious, Label: W32/Virut.Gen
Source: C:\Windows\tasksche.exe	Avira: detection malicious, Label: TR/AD.WannaCry.gpbbt

Multi AV Scanner detection for dropped file

Source: C:\Windows\tasksche.exe	Metadefender: Detection: 75%			Perma Link
Source: C:\Windows\tasksche.exe	ReversingLabs: Detection: 100%

Machine Learning detection for sample

Source: UBpReASuEC.dll

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Windows\mssecsvc.exe	Joe Sandbox ML: detected
Source: C:\Windows\tasksche.exe	Joe Sandbox ML: detected

Source: 4.0.mssecsvc.exe.400000.6.unpack	Avira: Label: W32/Virut.Gen
Source: 4.2.mssecsvc.exe.400000.0.unpack	Avira: Label: W32/Virut.Gen
Source: 4.0.mssecsvc.exe.400000.0.unpack	Avira: Label: W32/Virut.Gen
Source: 6.2.mssecsvc.exe.400000.0.unpack	Avira: Label: W32/Virut.Gen
Source: 4.0.mssecsvc.exe.400000.2.unpack	Avira: Label: W32/Virut.Gen
Source: 4.0.mssecsvc.exe.400000.4.unpack	Avira: Label: W32/Virut.Gen
Source: 6.0.mssecsvc.exe.400000.2.unpack	Avira: Label: W32/Virut.Gen
Source: 9.0.mssecsvc.exe.400000.0.unpack	Avira: Label: W32/Virut.Gen
Source: 9.2.mssecsvc.exe.400000.0.unpack	Avira: Label: W32/Virut.Gen
Source: 6.0.mssecsvc.exe.400000.0.unpack	Avira: Label: W32/Virut.Gen
Source: 6.0.mssecsvc.exe.400000.4.unpack	Avira: Label: W32/Virut.Gen
Source: 6.0.mssecsvc.exe.400000.6.unpack	Avira: Label: W32/Virut.Gen

Source: UBpReASuEC.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2830018 ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) 192.168.2.6:51748 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2830018 ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) 192.168.2.6:52225 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2811577 ETPRO TROJAN Possible Virut DGA NXDOMAIN Responses (com) 8.8.8.8:53 -> 192.168.2.6:64289
Source: Traffic	Snort IDS: 2811577 ETPRO TROJAN Possible Virut DGA NXDOMAIN Responses (com) 8.8.8.8:53 -> 192.168.2.6:49287
Source: Traffic	Snort IDS: 2811577 ETPRO TROJAN Possible Virut DGA NXDOMAIN Responses (com) 8.8.8.8:53 -> 192.168.2.6:58468
Source: Traffic	Snort IDS: 2811577 ETPRO TROJAN Possible Virut DGA NXDOMAIN Responses (com) 8.8.8.8:53 -> 192.168.2.6:62079

Tries to resolve many domain names, but no domain seems valid

Source: unknown	DNS traffic detected: query: euxngi.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kymlxf.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: haqipv.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: akelqu.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: skpqjl.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: knajpk.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oevgnn.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oyadis.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mlsjzu.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ovalzq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: auyazv.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mbbaux.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: dhmqvm.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: odivfj.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mjdvvw.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yfgraf.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: edbeos.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lnn.maft.at replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: wofqss.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pfdpty.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aueolp.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: flpuej.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oivayb.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qrmrxa.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: akufuf.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nrwwej.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eixjei.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oletfa.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: auowel.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ylyguq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iooaai.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: bhhhpq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ihfjtf.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yfobli.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vaaoff.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yldizc.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yexisu.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cjebbx.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: unuyas.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: agrwiq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uwyrsy.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: weuanq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kto.gind.at replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: src.gide.at replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pfntvw.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: shyykl.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lntyhe.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yxdidf.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: easecy.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vqzvfi.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nkewuc.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hoqayg.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: tpoxvi.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mwhmpz.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gvkzcm.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: guseek.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mlgjto.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: jueuby.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: usecvu.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iietwy.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: bswdic.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iqzvcy.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ovlicu.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: voirue.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: zeufbm.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vvwxii.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qfsper.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kqmkgp.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: jyruxe.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: zwstuy.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ww.ziten.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pgmuok.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oirlzx.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: dzwrvg.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rmdyox.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wkedxi.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oqiqee.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: muyuou.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qxuyel.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: anyqaz.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uptrqo.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ufmuub.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vusvyj.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eetebu.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: jkjztp.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: edmwpe.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mjrztu.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ytyepn.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qsuuox.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: raniod.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: bnylmd.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qsyrmp.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pxzoao.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pniyeh.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ohqasc.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oyebru.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nuejea.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: julanu.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: akiypc.com replaycode: Name error (3)

Queries random domain names (often used to prevent blacklisting and sinkholes)

Source: unknown

DNS traffic detected: English language letter frequency does not match the domain names

Source: unknown

Network traffic detected: DNS query count 30

Source: svchost.exe, 0000001B.00000000.526150966.0000029A9B0C8000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.925987981.0000029A9B0C8000.00000004.00000001.00020000.00000000.sdmp

String found in binary or memory: (@http://www.facebook.com equals www.facebook.com (Facebook)

Source: svchost.exe, 00000025.00000002.934439454.00000266A5486000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb
Source: lsass.exe, 0000000A.00000000.406730577.0000020A0F823000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.409621751.0000020A0F823000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.410034517.0000020A0F95F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: lsass.exe, 0000000A.00000000.406730577.0000020A0F823000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.409621751.0000020A0F823000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.410034517.0000020A0F95F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA-2.crt0
Source: svchost.exe, 00000012.00000002.937199804.0000023260AB7000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000012.00000000.434915689.0000023260AB7000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000012.00000000.434450989.0000023260AB7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cdn.content.prod.cms.msn.com/singletile/summary/alias/experiencebyname/today?market=en-US&sou
Source: lsass.exe, 0000000A.00000000.406688208.0000020A0F800000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.928389853.0000020A0F800000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000002.655733813.000001968955C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.684675611.000002062AD00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 00000028.00000002.684675611.000002062AD00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: lsass.exe, 0000000A.00000000.406730577.0000020A0F823000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.409621751.0000020A0F823000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.410034517.0000020A0F95F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: lsass.exe, 0000000A.00000000.406730577.0000020A0F823000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.409621751.0000020A0F823000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.410034517.0000020A0F95F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigicertSHA2SecureServerCA-1.crl0?
Source: lsass.exe, 0000000A.00000000.409059915.0000020A0F073000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.406730577.0000020A0F823000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.919189853.0000020A0F03F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.409621751.0000020A0F823000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.406137063.0000020A0F03F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.408867824.0000020A0F03F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.932218591.0000020A0F8BD000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.470812037.0000019689517000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.488128927.0000019689517000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.517446302.0000019687A00000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.469185004.0000019687A00000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.518610082.0000019689517000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.478629962.0000019687A00000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.474237810.0000019687A00000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.507053493.0000019689517000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.502767921.0000019689517000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.512953733.0000019689517000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.501838544.0000019687A00000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000002.652525230.0000019687A00000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: lsass.exe, 0000000A.00000000.406730577.0000020A0F823000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.409621751.0000020A0F823000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.410034517.0000020A0F95F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: lsass.exe, 0000000A.00000000.406730577.0000020A0F823000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.409621751.0000020A0F823000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.410034517.0000020A0F95F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0
Source: lsass.exe, 0000000A.00000000.406730577.0000020A0F823000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.409621751.0000020A0F823000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.929953130.0000020A0F823000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: lsass.exe, 0000000A.00000000.406450907.0000020A0F0B1000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.925211663.0000020A0F0B1000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.409297757.0000020A0F0B1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000028.00000003.654901611.000002062ADA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.disneyplus.com.
Source: lsass.exe, 0000000A.00000000.406730577.0000020A0F823000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.409621751.0000020A0F823000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.410034517.0000020A0F95F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: lsass.exe, 0000000A.00000000.409059915.0000020A0F073000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.406730577.0000020A0F823000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.919189853.0000020A0F03F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.409621751.0000020A0F823000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.406137063.0000020A0F03F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.408867824.0000020A0F03F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.932218591.0000020A0F8BD000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.470812037.0000019689517000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.488128927.0000019689517000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.517446302.0000019687A00000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.469185004.0000019687A00000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.518610082.0000019689517000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.478629962.0000019687A00000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.474237810.0000019687A00000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.507053493.0000019689517000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.502767921.0000019689517000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.512953733.0000019689517000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.501838544.0000019687A00000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000002.652525230.0000019687A00000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: lsass.exe, 0000000A.00000000.406730577.0000020A0F823000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.409621751.0000020A0F823000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.410034517.0000020A0F95F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0H
Source: lsass.exe, 0000000A.00000000.409059915.0000020A0F073000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.935116062.0000020A0F994000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.406730577.0000020A0F823000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.410060899.0000020A0F993000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.409621751.0000020A0F823000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.406710935.0000020A0F815000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.932218591.0000020A0F8BD000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.470812037.0000019689517000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.488128927.0000019689517000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.518610082.0000019689517000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.507053493.0000019689517000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.502767921.0000019689517000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.512953733.0000019689517000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000002.655072175.0000019689513000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: backgroundTaskHost.exe, 00000018.00000002.653443453.0000019687A9C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.482934202.0000019687A9C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.502128636.0000019687A9C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.512021088.0000019687A9C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.478934256.0000019687A9C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.517793482.0000019687A9C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.469844015.0000019687A9C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.492450987.0000019687A9C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.506335861.0000019687A9C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.497685292.0000019687A9C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.474651684.0000019687A9C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.487364117.0000019687A9C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schema.org/reminder
Source: svchost.exe, 00000028.00000002.685289382.000002062AD3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.microft8
Source: svchost.exe, 0000001E.00000000.544447681.00000184771DD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.msoft
Source: lsass.exe, 0000000A.00000000.406730577.0000020A0F823000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.409621751.0000020A0F823000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.410034517.0000020A0F95F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0~
Source: svchost.exe, 0000001B.00000000.526150966.0000029A9B0C8000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.925987981.0000029A9B0C8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com
Source: mssecsvc.exe.2.dr	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
Source: mssecsvc.exe, 00000006.00000002.473354431.0000000000D44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/
Source: mssecsvc.exe, 00000004.00000002.715152073.0000000000DC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/%
Source: mssecsvc.exe, 00000004.00000002.715373222.0000000000DF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/N
Source: mssecsvc.exe, 00000006.00000002.473354431.0000000000D44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/o
Source: mssecsvc.exe, 00000004.00000002.712659508.000000000019C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comJ
Source: svchost.exe, 00000012.00000002.937199804.0000023260AB7000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000012.00000000.434915689.0000023260AB7000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000012.00000000.434450989.0000023260AB7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://candycrush.king.com/mobile/windows/TileTemplate.xml
Source: svchost.exe, 00000012.00000000.435829049.0000023260B50000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.940173415.0000023260B50000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000012.00000000.435512851.0000023260B50000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.onenote.net/livetile/?Language=en-US
Source: svchost.exe, 00000028.00000003.654901611.000002062ADA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://disneyplus.com/legal.
Source: 60f12053-d245-44a6-bc56-ad6e6ab7a7c9.f2d7e325-8812-419f-93c5-393f1d8412fe.down_meta.25.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4IhjW?ver=1f70Last-Mo
Source: 359095cb-bf2b-41bf-8103-13a2a8012235.a3ca69e3-e705-4f64-a747-3b1b77a563b2.down_meta.25.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4Ivzu?ver=4f7dContent
Source: aa32b058-0d4a-4dd4-a681-a185709cfe4c.c81d4019-1330-4010-8ca2-301e518d770c.down_meta.25.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4PlTB?ver=2a94Content
Source: 6faba965-83b0-4727-9cf6-f717a8d19482.up_meta.25.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4Pwej?ver=cbf0
Source: 6faba965-83b0-4727-9cf6-f717a8d19482.593aeaca-14dd-4f73-a505-b9177043fbb4.down_meta.25.dr, 7d74c1c9-e7b4-43ae-af85-d91ef9a0b3dd.593aeaca-14dd-4f73-a505-b9177043fbb4.down_meta.25.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4Pwej?ver=cbf0Content
Source: 883a00d1-26f9-46de-b0d6-299b64c5e1d5.8072ed17-626f-4b05-8d4e-e1f8c9d17eb3.down_meta.25.dr, 328613bb-d9fd-464d-8e18-36a56bfcd660.8072ed17-626f-4b05-8d4e-e1f8c9d17eb3.down_meta.25.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RWHdvF?ver=db75Content-
Source: backgroundTaskHost.exe, 00000018.00000000.517659898.0000019687A43000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.492172317.0000019687A43000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.497564176.0000019687A43000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.474469001.0000019687A43000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.501989041.0000019687A43000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.482751547.0000019687A43000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000002.653090452.0000019687A59000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.478770028.0000019687A43000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.511817816.0000019687A43000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.469612248.0000019687A43000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.487190551.0000019687A43000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.506188205.0000019687A43000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://pf.directory.live.com/profile/profile.asmx
Source: svchost.exe, 00000025.00000002.953014239.00000266A5C1B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000000.586857196.00000266A5C1B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://site-cdn.onenote.net/161182431559_Images/LiveTileImages/MediumAndLarge/Image1.png
Source: svchost.exe, 00000028.00000003.651043924.000002062AD9C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.650880528.000002062B202000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.651148131.000002062ADAD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.651394135.000002062B202000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.hotspotshield.com/
Source: backgroundTaskHost.exe, 00000018.00000000.479135816.0000019687B02000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000002.654120987.0000019687B02000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.bing.c
Source: svchost.exe, 00000028.00000003.654901611.000002062ADA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
Source: svchost.exe, 00000028.00000003.654901611.000002062ADA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
Source: svchost.exe, 00000028.00000003.651043924.000002062AD9C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.650880528.000002062B202000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.651148131.000002062ADAD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.651394135.000002062B202000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.hotspotshield.com/terms/
Source: svchost.exe, 00000028.00000003.651043924.000002062AD9C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.650880528.000002062B202000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.651148131.000002062ADAD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.651394135.000002062B202000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.pango.co/privacy
Source: svchost.exe, 00000028.00000003.661304130.000002062B202000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.660891846.000002062ADBC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.661072190.000002062ADBC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.661121292.000002062ADA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.tiktok.com/legal/report/feedback

Source: unknown

DNS traffic detected: queries for: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com

Source: C:\Windows\mssecsvc.exe

Code function: 4_2_00BD27A7 GetTempFileNameA,CreateFileA,InternetReadFile,WriteFile,CloseHandle,CreateProcessA,InternetCloseHandle,InternetCloseHandle,

4_2_00BD27A7

Source: mssecsvc.exe, 00000004.00000002.714937974.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Spam, unwanted Advertisements and Ransom Demands

Yara detected Wannacry ransomware

Source: Yara match	File source: UBpReASuEC.dll, type: SAMPLE
Source: Yara match	File source: 9.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000000.390692739.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.395643051.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.712940908.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.400396194.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.517302066.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.392189177.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.398730935.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.396523616.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.395038973.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.397443595.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.470437987.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.403788291.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mssecsvc.exe PID: 6944, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mssecsvc.exe PID: 6976, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mssecsvc.exe PID: 7092, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\mssecsvc.exe, type: DROPPED

System Summary

Malicious sample detected (through community Yara rule)

Source: UBpReASuEC.dll, type: SAMPLE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: UBpReASuEC.dll, type: SAMPLE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 6.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 9.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 9.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 4.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 4.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 6.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 9.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 9.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 4.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 4.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 6.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 6.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 4.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 4.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 4.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 4.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 6.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 4.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 4.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 9.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 9.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 6.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 4.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 4.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 4.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 4.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 6.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 9.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 9.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 9.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 6.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 9.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 9.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 4.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 4.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 4.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 4.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 6.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 6.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 4.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 4.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 6.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 6.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 9.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 9.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 9.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 6.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 6.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 6.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 6.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 6.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 6.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 6.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 6.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000006.00000000.398897193.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000006.00000000.397658913.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000009.00000000.403899564.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000004.00000000.390830304.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000004.00000000.395187719.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000006.00000000.400479545.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000006.00000000.395761146.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000009.00000002.517693947.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000004.00000000.392372689.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000004.00000002.713109877.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000006.00000002.470687764.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000004.00000000.396673500.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: C:\Windows\mssecsvc.exe, type: DROPPED	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: C:\Windows\mssecsvc.exe, type: DROPPED	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: C:\Windows\mssecsvc.exe, type: DROPPED	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team

Source: UBpReASuEC.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL

Source: UBpReASuEC.dll, type: SAMPLE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: UBpReASuEC.dll, type: SAMPLE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 6.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 9.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 9.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 4.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 4.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 6.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 9.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 9.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 4.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 4.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 6.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 6.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 4.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 4.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 4.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 4.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 6.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 4.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 4.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 9.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 9.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 6.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 4.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 4.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 4.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 4.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 6.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 9.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 9.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 9.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 6.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 9.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 9.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 4.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 4.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 4.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 4.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 6.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 6.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 4.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 4.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 6.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 6.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 9.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 9.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 9.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 6.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 6.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 6.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 6.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 6.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 6.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 6.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 6.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000006.00000000.398897193.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000006.00000000.397658913.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000009.00000000.403899564.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000004.00000000.390830304.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000004.00000000.395187719.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000006.00000000.400479545.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000006.00000000.395761146.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000009.00000002.517693947.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000004.00000000.392372689.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000004.00000002.713109877.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000006.00000002.470687764.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000004.00000000.396673500.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: C:\Windows\mssecsvc.exe, type: DROPPED	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: C:\Windows\mssecsvc.exe, type: DROPPED	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: C:\Windows\mssecsvc.exe, type: DROPPED	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set

Source: C:\Windows\System32\wbem\WMIADAP.exe

File deleted: C:\Windows\System32\wbem\Performance\WmiApRpl.h

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\WINDOWS\mssecsvc.exe

Jump to behavior

Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00BD3CB7	4_2_00BD3CB7
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00BD3C88	4_2_00BD3C88
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00BD3CE3	4_2_00BD3CE3
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00BD3BD5	4_2_00BD3BD5
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00BD3CCE	4_2_00BD3CCE
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00BD28C8	4_2_00BD28C8
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00BD3C5A	4_2_00BD3C5A
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA3CE3	4_2_7FEA3CE3
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA28C8	4_2_7FEA28C8
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA3CCE	4_2_7FEA3CCE
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA4BDD	4_2_7FEA4BDD
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA3BD5	4_2_7FEA3BD5
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA3CB7	4_2_7FEA3CB7
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA3C88	4_2_7FEA3C88
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA3C5A	4_2_7FEA3C5A
Source: C:\Windows\mssecsvc.exe	Code function: 9_2_00B93CB7	9_2_00B93CB7
Source: C:\Windows\mssecsvc.exe	Code function: 9_2_00B93C88	9_2_00B93C88
Source: C:\Windows\mssecsvc.exe	Code function: 9_2_00B93CE3	9_2_00B93CE3
Source: C:\Windows\mssecsvc.exe	Code function: 9_2_00B93BD5	9_2_00B93BD5
Source: C:\Windows\mssecsvc.exe	Code function: 9_2_00B928C8	9_2_00B928C8
Source: C:\Windows\mssecsvc.exe	Code function: 9_2_00B93CCE	9_2_00B93CCE
Source: C:\Windows\mssecsvc.exe	Code function: 9_2_00B93C5A	9_2_00B93C5A

Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00BD05F2 FindCloseChangeNotification,GetModuleHandleA,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,FindCloseChangeNotification,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,FindCloseChangeNotification,FindCloseChangeNotification,	4_2_00BD05F2
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00BD042D GetModuleHandleA,GetVersion,VirtualAlloc,FindCloseChangeNotification,SetProcessAffinityMask,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,FindCloseChangeNotification,	4_2_00BD042D
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00BD252F NtOpenSection,	4_2_00BD252F
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00BD2574 NtMapViewOfSection,FindCloseChangeNotification,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,	4_2_00BD2574
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00BD2477 NtCreateFile,NtCreateFile,NtCreateFile,NtProtectVirtualMemory,NtWriteVirtualMemory,	4_2_00BD2477
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00BD116F LoadLibraryA,GetModuleHandleA,NtCreateProcessEx,NtMapViewOfSection,NtQueryInformationToken,NtAdjustPrivilegesToken,	4_2_00BD116F
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00BD144A LookupPrivilegeValueA,NtAdjustPrivilegesToken,	4_2_00BD144A
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00BD24AE lstrcpyW,lstrlenW,NtCreateSection,	4_2_00BD24AE
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00BD339D NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,	4_2_00BD339D
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00BD1422 LookupPrivilegeValueA,NtAdjustPrivilegesToken,	4_2_00BD1422
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00BD3378 NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,	4_2_00BD3378
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA05F2 CloseHandle,GetModuleHandleA,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,CloseHandle,CloseHandle,	4_2_7FEA05F2
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA24AE lstrcpyW,lstrlenW,NtCreateSection,	4_2_7FEA24AE
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA339D NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,	4_2_7FEA339D
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA3378 NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,	4_2_7FEA3378
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA2477 NtCreateFile,NtCreateFile,NtCreateFile,NtProtectVirtualMemory,NtWriteVirtualMemory,	4_2_7FEA2477
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA2574 NtMapViewOfSection,CloseHandle,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,	4_2_7FEA2574
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA144A LookupPrivilegeValueA,NtAdjustPrivilegesToken,	4_2_7FEA144A
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA252F NtOpenSection,	4_2_7FEA252F
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA042D GetModuleHandleA,GetVersion,VirtualAlloc,CloseHandle,SetProcessAffinityMask,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,CloseHandle,	4_2_7FEA042D
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA1422 LookupPrivilegeValueA,NtAdjustPrivilegesToken,	4_2_7FEA1422
Source: C:\Windows\mssecsvc.exe	Code function: 9_2_00B905F2 CloseHandle,GetModuleHandleA,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,FindCloseChangeNotification,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,CloseHandle,CloseHandle,	9_2_00B905F2
Source: C:\Windows\mssecsvc.exe	Code function: 9_2_00B9252F NtOpenSection,	9_2_00B9252F
Source: C:\Windows\mssecsvc.exe	Code function: 9_2_00B92574 NtMapViewOfSection,FindCloseChangeNotification,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,	9_2_00B92574
Source: C:\Windows\mssecsvc.exe	Code function: 9_2_00B92477 NtCreateFile,NtCreateFile,NtCreateFile,NtProtectVirtualMemory,NtWriteVirtualMemory,	9_2_00B92477
Source: C:\Windows\mssecsvc.exe	Code function: 9_2_00B9116F LoadLibraryA,GetModuleHandleA,NtCreateProcessEx,NtMapViewOfSection,NtQueryInformationToken,NtAdjustPrivilegesToken,	9_2_00B9116F
Source: C:\Windows\mssecsvc.exe	Code function: 9_2_00B9144A LookupPrivilegeValueA,NtAdjustPrivilegesToken,	9_2_00B9144A
Source: C:\Windows\mssecsvc.exe	Code function: 9_2_00B924AE lstrcpyW,lstrlenW,NtCreateSection,	9_2_00B924AE
Source: C:\Windows\mssecsvc.exe	Code function: 9_2_00B9339D NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,	9_2_00B9339D
Source: C:\Windows\mssecsvc.exe	Code function: 9_2_00B9042D GetModuleHandleA,GetVersion,VirtualAlloc,CloseHandle,SetProcessAffinityMask,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,CloseHandle,	9_2_00B9042D
Source: C:\Windows\mssecsvc.exe	Code function: 9_2_00B91422 LookupPrivilegeValueA,NtAdjustPrivilegesToken,	9_2_00B91422
Source: C:\Windows\mssecsvc.exe	Code function: 9_2_00B93378 NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,	9_2_00B93378

Source: mssecsvc.exe.2.dr

Static PE information: Resource name: R type: PE32 executable (GUI) Intel 80386, for MS Windows

Source: tasksche.exe.6.dr

Static PE information: No import functions for PE file found

Source: Joe Sandbox View

Dropped File: C:\Windows\tasksche.exe 96D7B2D83E30FED4EEC2CBF2E1FBE426DAD705F918AE8ABBDA0DB4B4AFB82865

Source: tasksche.exe.6.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: tasksche.exe.6.dr	Static PE information: Section: .rdata ZLIB complexity 1.0007621951219512
Source: tasksche.exe.6.dr	Static PE information: Section: .data ZLIB complexity 1.001953125
Source: tasksche.exe.6.dr	Static PE information: Section: .rsrc ZLIB complexity 1.0007408405172413

Source: UBpReASuEC.dll	Metadefender: Detection: 74%
Source: UBpReASuEC.dll	ReversingLabs: Detection: 92%

Source: UBpReASuEC.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\UBpReASuEC.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\UBpReASuEC.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\UBpReASuEC.dll,PlayGame
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UBpReASuEC.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UBpReASuEC.dll",PlayGame
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe
Source: unknown	Process created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe -m security
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\BackgroundTransferHost.exe "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\BackgroundTransferHost.exe "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
Source: C:\Windows\System32\lsass.exe	Process created: C:\Windows\System32\wbem\WMIADAP.exe wmiadap.exe /F /T /R
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\backgroundTaskHost.exe "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXv783p9dqgsc3mek8m05c3tj95wa9p858.mca
Source: C:\Windows\System32\lsass.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\UBpReASuEC.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\UBpReASuEC.dll,PlayGame	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UBpReASuEC.dll",PlayGame	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UBpReASuEC.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe	Jump to behavior

Source: C:\Windows\mssecsvc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\BackgroundTransferHost.exe

File created: C:\Users\user\AppData\Local\Packages\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\AC\BackgroundTransferApi\6071454c-93cc-4d3c-88ff-dcf9b8a683e4.down_data

Jump to behavior

Source: classification engine

Classification label: mal100.rans.troj.evad.winDLL@24/28@31/1

Source: C:\Windows\mssecsvc.exe

Code function: 4_2_00BD05F2 FindCloseChangeNotification,GetModuleHandleA,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,FindCloseChangeNotification,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,FindCloseChangeNotification,FindCloseChangeNotification,

4_2_00BD05F2

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\UBpReASuEC.dll,PlayGame

Source: C:\Windows\System32\wbem\WMIADAP.exe	Mutant created: \BaseNamedObjects\Global\RefreshRA_Mutex
Source: C:\Windows\System32\wbem\WMIADAP.exe	Mutant created: \BaseNamedObjects\Global\RefreshRA_Mutex_Flag
Source: C:\Windows\System32\wbem\WMIADAP.exe	Mutant created: \BaseNamedObjects\Global\ADAP_WMI_ENTRY
Source: C:\Windows\System32\wbem\WMIADAP.exe	Mutant created: \BaseNamedObjects\Global\RefreshRA_Mutex_Lib

Source: UBpReASuEC.dll, mssecsvc.exe.2.dr

Binary or memory string: @.der.pfx.key.crt.csr.p12.pem.odt.ott.sxw.stw.uot.3ds.max.3dm.ods.ots.sxc.stc.dif.slk.wb2.odp.otp.sxd.std.uop.odg.otg.sxm.mml.lay.lay6.asc.sqlite3.sqlitedb.sql.accdb.mdb.db.dbf.odb.frm.myd.myi.ibd.mdf.ldf.sln.suo.cs.c.cpp.pas.h.asm.js.cmd.bat.ps1.vbs.vb.pl.dip.dch.sch.brd.jsp.php.asp.rb.java.jar.class.sh.mp3.wav.swf.fla.wmv.mpg.vob.mpeg.asf.avi.mov.mp4.3gp.mkv.3g2.flv.wma.mid.m3u.m4u.djvu.svg.ai.psd.nef.tiff.tif.cgm.raw.gif.png.bmp.jpg.jpeg.vcd.iso.backup.zip.rar.7z.gz.tgz.tar.bak.tbk.bz2.PAQ.ARC.aes.gpg.vmx.vmdk.vdi.sldm.sldx.sti.sxi.602.hwp.snt.onetoc2.dwg.pdf.wk1.wks.123.rtf.csv.txt.vsdx.vsd.edb.eml.msg.ost.pst.potm.potx.ppam.ppsx.ppsm.pps.pot.pptm.pptx.ppt.xltm.xltx.xlc.xlm.xlt.xlw.xlsb.xlsm.xlsx.xls.dotx.dotm.dot.docm.docb.docx.docWANACRY!%s\%sCloseHandleDeleteFileWMoveFileExWMoveFileWReadFileWriteFileCreateFileWkernel32.dll

Source: C:\Windows\mssecsvc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\BackgroundTransferHost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\BackgroundTransferHost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: UBpReASuEC.dll

Static file information: File size 5267459 > 1048576

Source: UBpReASuEC.dll

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x501000

Source: mssecsvc.exe.2.dr

Static PE information: section name: lkuhvek

Source: C:\Windows\mssecsvc.exe

Code function: 4_2_00BD3CCE LoadLibraryA,GetProcAddress,LoadLibraryA,GetTickCount,GetVolumeInformationA,CreateThread,CloseHandle,WSAStartup,CreateThread,CloseHandle,CreateEventA,socket,connect,GetVersionExA,wsprintfA,CreateThread,CloseHandle,

4_2_00BD3CCE

Source: initial sample

Static PE information: section where entry point is pointing to: .rsrc

Source: initial sample

Static PE information: section name: .text entropy: 7.663042758896975

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\SysWOW64\rundll32.exe

Executable created and started: C:\WINDOWS\mssecsvc.exe

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\mssecsvc.exe			Jump to dropped file
Source: C:\Windows\mssecsvc.exe	File created: C:\Windows\tasksche.exe			Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\mssecsvc.exe			Jump to dropped file
Source: C:\Windows\mssecsvc.exe	File created: C:\Windows\tasksche.exe			Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\BackgroundTransferHost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\BackgroundTransferHost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may execute only at specific dates)

Source: C:\Windows\mssecsvc.exe

Evasive API call chain: GetSystemTime,DecisionNodes,Sleep

graph_9-2467

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Windows\mssecsvc.exe

Special instruction interceptor: First address: 0000000000A6B605 instructions caused by: Self-modifying code

Source: C:\Windows\System32\wbem\WMIADAP.exe TID: 6904	Thread sleep count: 2696 > 30	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe TID: 6904	Thread sleep count: 2699 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6872	Thread sleep time: -150000s >= -30000s	Jump to behavior

Source: C:\Windows\mssecsvc.exe

Evasive API call chain: GetSystemTime,DecisionNodes

graph_9-2467

Source: C:\Windows\mssecsvc.exe

Code function: 4_2_00BD042D rdtsc

4_2_00BD042D

Source: C:\Windows\System32\wbem\WMIADAP.exe	Window / User API: threadDelayed 2696			Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe	Window / User API: threadDelayed 2699			Jump to behavior

Source: C:\Windows\mssecsvc.exe	API coverage: 6.3 %
Source: C:\Windows\mssecsvc.exe	API coverage: 8.2 %

Source: C:\Windows\mssecsvc.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: svchost.exe, 0000001B.00000000.527634222.0000029A9C426000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@vmicheartbeat
Source: svchost.exe, 0000001B.00000000.530406338.0000029A9CAB5000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@Allow inbound TCP port 636 traffic for vmicheartbeatLMEMp
Source: svchost.exe, 0000001B.00000000.527634222.0000029A9C426000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: c-Licen"@vmicheartbeat-block-out
Source: svchost.exe, 00000025.00000000.586250079.00000266A5B7E000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>X
Source: svchost.exe, 0000001B.00000000.527634222.0000029A9C426000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: *@vmicvss-block-out
Source: svchost.exe, 0000001B.00000000.530406338.0000029A9CAB5000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@Allow outbound TCP traffic for vmicheartbeatLMEM`
Source: svchost.exe, 00000013.00000000.441750757.0000013E23228000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000013.00000000.442234393.0000013E23228000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.923809237.0000013E23228000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.513098530.0000019689539000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000002.655370947.0000019689539000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.683534614.000002062A484000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.684248942.000002062A4EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 0000001B.00000000.527634222.0000029A9C426000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Block any other inbound traffic for vmicheartbeat
Source: svchost.exe, 00000025.00000002.952494580.00000266A5B7E000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect><
Source: dwm.exe, 00000015.00000002.937197080.0000024126E20000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&1EC51BF7&0&000000
Source: svchost.exe, 0000001B.00000000.530406338.0000029A9CAB5000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: *@Allow inbound TCP port 389 traffic for vmicheartbeatLMEMp
Source: svchost.exe, 00000025.00000002.927632282.00000266A4FC0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
Source: svchost.exe, 00000014.00000002.915352448.000001E26D828000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: svchost.exe, 00000025.00000002.919102052.00000266A4843000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000000.570612328.00000266A4843000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@Microsoft-Windows-Hyper-V-Hypervisor
Source: svchost.exe, 0000001B.00000000.527634222.0000029A9C426000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: "@vmicheartbeat
Source: svchost.exe, 0000001E.00000002.925647945.0000018476029000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: zSCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000_0r
Source: svchost.exe, 00000012.00000002.935997567.0000023260A52000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: vmicshutdown
Source: dwm.exe, 00000015.00000002.937197080.0000024126E20000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000/
Source: svchost.exe, 0000001B.00000000.527634222.0000029A9C426000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: &@vmicheartbeat-allow-in-1
Source: svchost.exe, 00000012.00000000.432317240.000002325FE96000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&1EC51BF7&0&000000@a
Source: svchost.exe, 0000001B.00000002.932879008.0000029A9C400000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: "@Block any outbound traffic for vmicshutdown
Source: svchost.exe, 0000001B.00000000.527634222.0000029A9C426000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: &@vmicshutdown
Source: svchost.exe, 00000012.00000000.433024630.0000023260236000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: vmicvss
Source: svchost.exe, 0000001B.00000000.527634222.0000029A9C426000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: .@Allow inbound TCP port 389 traffic for vmicheartbeat
Source: svchost.exe, 00000012.00000000.433024630.0000023260236000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: $@vmicshutdown
Source: svchost.exe, 0000001B.00000000.527634222.0000029A9C426000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: &@Allow inbound TCP port 636 traffic for vmicheartbeat
Source: svchost.exe, 0000001B.00000000.527634222.0000029A9C426000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: ,@vmicvss
Source: svchost.exe, 00000025.00000000.583806432.00000266A5A00000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware
Source: svchost.exe, 00000025.00000000.586250079.00000266A5B7E000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>oso
Source: svchost.exe, 00000014.00000002.916878109.000001E26D849000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&1EC51BF7&0&000000
Source: svchost.exe, 00000025.00000002.952494580.00000266A5B7E000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect></conn
Source: svchost.exe, 0000001B.00000002.932879008.0000029A9C400000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@Allow outbound TCP traffic for vmicheartbeat
Source: svchost.exe, 00000025.00000000.586250079.00000266A5B7E000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>c><lci
Source: svchost.exe, 00000012.00000000.432317240.000002325FE96000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: vmicheartbeat
Source: svchost.exe, 0000001B.00000000.527634222.0000029A9C426000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: "@vmicvss-block-in
Source: svchost.exe, 00000025.00000002.952494580.00000266A5B7E000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>WNS 1
Source: svchost.exe, 0000001B.00000000.527634222.0000029A9C426000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: ,@vmicshutdown-block-out
Source: lsass.exe, 0000000A.00000000.406267729.0000020A0F082000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicvssNT SERVICE
Source: backgroundTaskHost.exe, 00000018.00000002.655566709.0000019689548000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWpm
Source: svchost.exe, 00000025.00000000.586250079.00000266A5B7E000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>c><lc
Source: backgroundTaskHost.exe, 00000018.00000000.488298108.0000019689548000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.470958836.0000019689548000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWMSAFD Tcpip [RAW/IPv6]
Source: svchost.exe, 0000001B.00000000.527634222.0000029A9C426000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: "&@Block any other outbound traffic for vmicheartbeat
Source: svchost.exe, 0000001B.00000000.530406338.0000029A9CAB5000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @Allow outbound TCP traffic for vmicheartbeatLMEM`
Source: svchost.exe, 00000012.00000000.432885126.0000023260213000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@vmicshutdown
Source: svchost.exe, 00000025.00000000.575535498.00000266A5400000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMwareVirtual disk2.0NULLSCSI0PCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\4&2509f6e&0&00A8
Source: svchost.exe, 0000001B.00000000.527634222.0000029A9C426000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: "@Block any outbound traffic for vmicvss
Source: svchost.exe, 0000001B.00000000.527634222.0000029A9C426000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@vmicheartbeat-allow-in-2
Source: mssecsvc.exe, 00000004.00000002.715152073.0000000000DC9000.00000004.00000020.00020000.00000000.sdmp, mssecsvc.exe, 00000006.00000002.473354431.0000000000D44000.00000004.00000020.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.405855460.0000020A0F013000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.916543919.0000020A0F013000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.408786696.0000020A0F013000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.914678495.000002EB37828000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.925395220.0000029A9B0B5000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001B.00000000.526064728.0000029A9B0B5000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001C.00000000.536167383.000001B5A282D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001C.00000002.915131423.000001B5A282D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001E.00000002.926192564.000001847603D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: lsass.exe, 0000000A.00000000.406267729.0000020A0F082000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicshutdownNT SERVICE
Source: svchost.exe, 00000012.00000000.433024630.0000023260236000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: $@vmicshutdowne
Source: svchost.exe, 00000025.00000000.586250079.00000266A5B7E000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>cat
Source: svchost.exe, 0000001B.00000000.527634222.0000029A9C426000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: .@vmicshutdown
Source: svchost.exe, 0000001B.00000000.527634222.0000029A9C426000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: *@vmicshutdown-block-in
Source: svchost.exe, 0000001B.00000000.527634222.0000029A9C426000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: $@vmicheartbeat
Source: svchost.exe, 0000001B.00000002.932879008.0000029A9C400000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: *@Block any inbound traffic for vmicshutdown
Source: svchost.exe, 00000025.00000002.919102052.00000266A4843000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000000.570612328.00000266A4843000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: $Microsoft-Windows-Hyper-V-Hypervisor
Source: svchost.exe, 00000017.00000002.912583826.000002EB37802000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
Source: lsass.exe, 0000000A.00000000.406267729.0000020A0F082000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicheartbeatNT SERVICE
Source: svchost.exe, 0000001B.00000000.527634222.0000029A9C426000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: *@vmicheartbeat-allow-out
Source: svchost.exe, 0000001B.00000000.530406338.0000029A9CAB5000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @Allow inbound TCP port 389 traffic for vmicheartbeatLMEMp
Source: backgroundTaskHost.exe, 00000018.00000002.653443453.0000019687A9C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.482934202.0000019687A9C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.502128636.0000019687A9C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.512021088.0000019687A9C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.478934256.0000019687A9C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.517793482.0000019687A9C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.469844015.0000019687A9C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.492450987.0000019687A9C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.506335861.0000019687A9C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.497685292.0000019687A9C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: svchost.exe, 0000001B.00000000.527634222.0000029A9C426000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @vmicheartbeat-block-in
Source: svchost.exe, 00000025.00000000.583806432.00000266A5A00000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: nonicVMware Virtual disk 2.0 NULL
Source: svchost.exe, 00000012.00000000.433024630.0000023260236000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @vmicheartbeat
Source: svchost.exe, 0000001B.00000000.527634222.0000029A9C426000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: &@Block any inbound traffic for vmicvss

Source: C:\Windows\mssecsvc.exe

4_2_00BD3CCE

Source: C:\Windows\mssecsvc.exe

Code function: 4_2_00BD042D rdtsc

4_2_00BD042D

Source: C:\Windows\mssecsvc.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\mssecsvc.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00BD05F2 mov eax, dword ptr fs:[00000030h]	4_2_00BD05F2
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00BD042D mov eax, dword ptr fs:[00000030h]	4_2_00BD042D
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00BD025E mov edx, dword ptr fs:[00000030h]	4_2_00BD025E
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA05F2 mov eax, dword ptr fs:[00000030h]	4_2_7FEA05F2
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA025E mov edx, dword ptr fs:[00000030h]	4_2_7FEA025E
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA042D mov eax, dword ptr fs:[00000030h]	4_2_7FEA042D
Source: C:\Windows\mssecsvc.exe	Code function: 9_2_00B905F2 mov eax, dword ptr fs:[00000030h]	9_2_00B905F2
Source: C:\Windows\mssecsvc.exe	Code function: 9_2_00B9042D mov eax, dword ptr fs:[00000030h]	9_2_00B9042D
Source: C:\Windows\mssecsvc.exe	Code function: 9_2_00B9025E mov edx, dword ptr fs:[00000030h]	9_2_00B9025E

Source: C:\Windows\mssecsvc.exe

Process queried: DebugPort

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: C:\Windows\System32\winlogon.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: C:\Windows\System32\lsass.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: C:\Windows\System32\fontdrvhost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: C:\Windows\System32\fontdrvhost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: C:\Windows\System32\dwm.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\rgltVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\whptVt target: C:\Windows\System32\winlogon.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\whptVt target: C:\Windows\System32\lsass.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\whptVt target: C:\Windows\System32\fontdrvhost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\whptVt target: C:\Windows\System32\fontdrvhost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\whptVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\whptVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\whptVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\whptVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\whptVt target: C:\Windows\System32\dwm.exe protection: execute and read and write	Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\backgroundTaskHost.exe base: 19689AC0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\backgroundTaskHost.exe base: 19689AC0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\backgroundTaskHost.exe base: 19689AC0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\backgroundTaskHost.exe base: 19689AC0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\backgroundTaskHost.exe base: 19689AC0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\backgroundTaskHost.exe base: 19689AC0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\backgroundTaskHost.exe base: 19689AC0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\backgroundTaskHost.exe base: 19689AC0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\backgroundTaskHost.exe base: 19689AC0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\backgroundTaskHost.exe base: 19689AC0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\backgroundTaskHost.exe base: 19689AC0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2062B1A0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2062B1A0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2062B1A0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2062B1A0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2062B1A0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2062B1A0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2062B1A0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2062B1A0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2062B1A0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2062B1A0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2062B1A0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1BAB0D90000	Jump to behavior

Changes memory attributes in foreign processes to executable or writable

Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F9A50 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F9830 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772FA040 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F99D0 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772FA120 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F9670 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F9A50 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F9830 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772FA040 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F99D0 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772FA120 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F9670 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F9A50 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F9830 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772FA040 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F99D0 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772FA120 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F9670 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F9A50 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F9830 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772FA040 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F99D0 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772FA120 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F9670 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F9A50 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F9830 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772FA040 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F99D0 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772FA120 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F9670 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F9A50 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F9830 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772FA040 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F99D0 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772FA120 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F9670 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F9A50 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F9830 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772FA040 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F99D0 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772FA120 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F9670 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F9A50 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F9830 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772FA040 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F99D0 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772FA120 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F9670 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F9A50 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F9830 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772FA040 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F99D0 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772FA120 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F9670 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F9A50 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F9830 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772FA040 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F99D0 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772FA120 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F9670 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F9A50 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F9830 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772FA040 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F99D0 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772FA120 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F9670 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F9A50 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F9830 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772FA040 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F99D0 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772FA120 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 772F9670 protect: page execute and read and write	Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Windows\mssecsvc.exe

Thread created: unknown EIP: 7FFF3BD0

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UBpReASuEC.dll",#1

Jump to behavior

Source: dwm.exe, 00000015.00000000.484558802.0000024129C21000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 00000015.00000002.957348978.0000024129C21000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: winlogon.exe, 00000007.00000000.406951072.0000021287470000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000007.00000000.402480383.0000021287470000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000007.00000002.931503022.0000021287470000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: winlogon.exe, 00000007.00000000.406951072.0000021287470000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000007.00000000.402480383.0000021287470000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000007.00000002.931503022.0000021287470000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: winlogon.exe, 00000007.00000000.406951072.0000021287470000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000007.00000000.402480383.0000021287470000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000007.00000002.931503022.0000021287470000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: winlogon.exe, 00000007.00000000.406951072.0000021287470000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000007.00000000.402480383.0000021287470000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000007.00000002.931503022.0000021287470000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Windows\mssecsvc.exe

Code function: 4_2_00BD3826 GetSystemTime,Sleep,InternetGetConnectedState,gethostbyname,socket,ioctlsocket,connect,Sleep,closesocket,

4_2_00BD3826

Source: C:\Windows\mssecsvc.exe

Code function: 4_2_00BD042D GetModuleHandleA,GetVersion,VirtualAlloc,FindCloseChangeNotification,SetProcessAffinityMask,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,FindCloseChangeNotification,

4_2_00BD042D

Source: svchost.exe, 0000001B.00000002.947165387.0000029A9CD20000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.940859027.0000029A9CAB5000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.940537206.0000029A9CA8E000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@\device\harddiskvolume4\program files\windows defender\msmpeng.exe
Source: svchost.exe, 0000001B.00000002.940537206.0000029A9CA8E000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001B.00000000.530331622.0000029A9CA8E000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @\device\harddiskvolume4\program files\windows defender\msmpeng.exe
Source: svchost.exe, 0000001B.00000002.936538879.0000029A9C552000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001B.00000000.528784421.0000029A9C552000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@C:\Program Files\Windows Defender\MsMpEng.exe
Source: svchost.exe, 0000001B.00000002.933407744.0000029A9C426000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001B.00000000.527634222.0000029A9C426000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: .@C:\Program Files\Windows Defender\MsMpEng.exe
Source: svchost.exe, 0000001B.00000002.933407744.0000029A9C426000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001B.00000000.527634222.0000029A9C426000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @C:\Program Files\Windows Defender\MsMpEng.exe
Source: svchost.exe, 0000001B.00000002.936538879.0000029A9C552000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001B.00000000.528784421.0000029A9C552000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: *@C:\Program Files\Windows Defender\MsMpEng.exe
Source: svchost.exe, 0000001B.00000002.933407744.0000029A9C426000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001B.00000000.527634222.0000029A9C426000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: $@C:\Program Files\Windows Defender\MsMpEng.exe

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	12 Native API	Path Interception	412 Process Injection	121 Masquerading	1 Input Capture	11 System Time Discovery	Remote Services	1 Input Capture	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	21 Virtualization/Sandbox Evasion	LSASS Memory	231 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	1 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	412 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Obfuscated Files or Information	NTDS	3 Process Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Rundll32	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	4 Software Packing	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 File Deletion	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
UBpReASuEC.dll	74%	Metadefender		Browse
UBpReASuEC.dll	93%	ReversingLabs	Win32.Ransomware.WannaCry
UBpReASuEC.dll	100%	Avira	W32/Virut.Gen
UBpReASuEC.dll	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Windows\mssecsvc.exe	100%	Avira	W32/Virut.Gen
C:\Windows\tasksche.exe	100%	Avira	TR/AD.WannaCry.gpbbt
C:\Windows\mssecsvc.exe	100%	Joe Sandbox ML
C:\Windows\tasksche.exe	100%	Joe Sandbox ML
C:\Windows\tasksche.exe	75%	Metadefender		Browse
C:\Windows\tasksche.exe	100%	ReversingLabs	Win32.Ransomware.WannaCry

Unpacked PE Files

Source	Detection	Scanner	Label	Download
4.0.mssecsvc.exe.400000.6.unpack	100%	Avira	W32/Virut.Gen	Download File
4.2.mssecsvc.exe.400000.0.unpack	100%	Avira	W32/Virut.Gen	Download File
4.0.mssecsvc.exe.400000.0.unpack	100%	Avira	W32/Virut.Gen	Download File
6.2.mssecsvc.exe.400000.0.unpack	100%	Avira	W32/Virut.Gen	Download File
4.0.mssecsvc.exe.400000.2.unpack	100%	Avira	W32/Virut.Gen	Download File
4.0.mssecsvc.exe.400000.4.unpack	100%	Avira	W32/Virut.Gen	Download File
6.0.mssecsvc.exe.400000.2.unpack	100%	Avira	W32/Virut.Gen	Download File
9.0.mssecsvc.exe.400000.0.unpack	100%	Avira	W32/Virut.Gen	Download File
9.2.mssecsvc.exe.400000.0.unpack	100%	Avira	W32/Virut.Gen	Download File
6.0.mssecsvc.exe.400000.0.unpack	100%	Avira	W32/Virut.Gen	Download File
6.0.mssecsvc.exe.400000.4.unpack	100%	Avira	W32/Virut.Gen	Download File
6.0.mssecsvc.exe.400000.6.unpack	100%	Avira	W32/Virut.Gen	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/N	100%	Avira URL Cloud	malware
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/o	100%	Avira URL Cloud	malware
https://www.disneyplus.com/legal/your-california-privacy-rights	0%	URL Reputation	safe
https://www.disneyplus.com/legal/privacy-policy	0%	URL Reputation	safe
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	100%	URL Reputation	malware
https://www.bing.c	0%	Avira URL Cloud	safe
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/%	100%	Avira URL Cloud	malware
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/	100%	URL Reputation	malware
https://www.pango.co/privacy	0%	URL Reputation	safe
https://disneyplus.com/legal.	0%	URL Reputation	safe
http://crl.ver)	0%	Avira URL Cloud	safe
https://www.tiktok.com/legal/report/feedback	0%	URL Reputation	safe
http://Passport.NET/tb	0%	Avira URL Cloud	safe
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comJ	0%	URL Reputation	safe
http://schemas.msoft	0%	Avira URL Cloud	safe
http://help.disneyplus.com.	0%	URL Reputation	safe
http://schemas.microft8	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
dual-a-0001.a-msedge.net	204.79.197.200	true	false	unknown
hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com	3.130.204.160	true	false	high
shyykl.com	unknown	unknown	true	unknown
auyazv.com	unknown	unknown	true	unknown
euxngi.com	unknown	unknown	true	unknown
oivayb.com	unknown	unknown	true	unknown
ytyepn.com	unknown	unknown	true	unknown
ovalzq.com	unknown	unknown	true	unknown
ufmuub.com	unknown	unknown	true	unknown
jkjztp.com	unknown	unknown	true	unknown
ylyguq.com	unknown	unknown	true	unknown
kymlxf.com	unknown	unknown	true	unknown
mlsjzu.com	unknown	unknown	true	unknown
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	unknown	unknown	true	unknown
hiapba.com	unknown	unknown	true	unknown
muyuou.com	unknown	unknown	true	unknown
qxuyel.com	unknown	unknown	true	unknown
jueuby.com	unknown	unknown	true	unknown
nuejea.com	unknown	unknown	true	unknown
pfdpty.com	unknown	unknown	true	unknown
iqzvcy.com	unknown	unknown	true	unknown
easecy.com	unknown	unknown	true	unknown
zwstuy.com	unknown	unknown	true	unknown
mlgjto.com	unknown	unknown	true	unknown
bswdic.com	unknown	unknown	true	unknown
eetebu.com	unknown	unknown	true	unknown
iietwy.com	unknown	unknown	true	unknown
ihfjtf.com	unknown	unknown	true	unknown
rmdyox.com	unknown	unknown	true	unknown
jyruxe.com	unknown	unknown	true	unknown
oqiqee.com	unknown	unknown	true	unknown
yuyuol.com	unknown	unknown	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/N	mssecsvc.exe, 00000004.00000002.715373222.0000000000DF1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/o	mssecsvc.exe, 00000006.00000002.473354431.0000000000D44000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://www.disneyplus.com/legal/your-california-privacy-rights	svchost.exe, 00000028.00000003.654901611.000002062ADA0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.disneyplus.com/legal/privacy-policy	svchost.exe, 00000028.00000003.654901611.000002062ADA0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://candycrush.king.com/mobile/windows/TileTemplate.xml	svchost.exe, 00000012.00000002.937199804.0000023260AB7000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000012.00000000.434915689.0000023260AB7000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000012.00000000.434450989.0000023260AB7000.00000004.00000001.00020000.00000000.sdmp	false		high
https://pf.directory.live.com/profile/profile.asmx	backgroundTaskHost.exe, 00000018.00000000.517659898.0000019687A43000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.492172317.0000019687A43000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.497564176.0000019687A43000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.474469001.0000019687A43000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.501989041.0000019687A43000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.482751547.0000019687A43000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000002.653090452.0000019687A59000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.478770028.0000019687A43000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.511817816.0000019687A43000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.469612248.0000019687A43000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.487190551.0000019687A43000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.506188205.0000019687A43000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	mssecsvc.exe.2.dr	true	URL Reputation: malware	unknown
https://www.bing.c	backgroundTaskHost.exe, 00000018.00000000.479135816.0000019687B02000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000002.654120987.0000019687B02000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/%	mssecsvc.exe, 00000004.00000002.715152073.0000000000DC9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://www.hotspotshield.com/terms/	svchost.exe, 00000028.00000003.651043924.000002062AD9C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.650880528.000002062B202000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.651148131.000002062ADAD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.651394135.000002062B202000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/	mssecsvc.exe, 00000006.00000002.473354431.0000000000D44000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://www.pango.co/privacy	svchost.exe, 00000028.00000003.651043924.000002062AD9C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.650880528.000002062B202000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.651148131.000002062ADAD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.651394135.000002062B202000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://disneyplus.com/legal.	svchost.exe, 00000028.00000003.654901611.000002062ADA0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.ver)	svchost.exe, 00000028.00000002.684675611.000002062AD00000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.google.com	svchost.exe, 0000001B.00000000.526150966.0000029A9B0C8000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.925987981.0000029A9B0C8000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.tiktok.com/legal/report/feedback	svchost.exe, 00000028.00000003.661304130.000002062B202000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.660891846.000002062ADBC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.661072190.000002062ADBC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.661121292.000002062ADA6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://Passport.NET/tb	svchost.exe, 00000025.00000002.934439454.00000266A5486000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comJ	mssecsvc.exe, 00000004.00000002.712659508.000000000019C000.00000004.00000010.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
http://schema.org/reminder	backgroundTaskHost.exe, 00000018.00000002.653443453.0000019687A9C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.482934202.0000019687A9C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.502128636.0000019687A9C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.512021088.0000019687A9C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.478934256.0000019687A9C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.517793482.0000019687A9C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.469844015.0000019687A9C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.492450987.0000019687A9C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.506335861.0000019687A9C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.497685292.0000019687A9C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.474651684.0000019687A9C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000018.00000000.487364117.0000019687A9C000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.msoft	svchost.exe, 0000001E.00000000.544447681.00000184771DD000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://help.disneyplus.com.	svchost.exe, 00000028.00000003.654901611.000002062ADA0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.microft8	svchost.exe, 00000028.00000002.685289382.000002062AD3D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.hotspotshield.com/	svchost.exe, 00000028.00000003.651043924.000002062AD9C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.650880528.000002062B202000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.651148131.000002062ADAD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.651394135.000002062B202000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	670724
Start date and time: 21/07/202204:59:12	2022-07-21 04:59:12 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	UBpReASuEC (renamed file extension from none to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	20
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.troj.evad.winDLL@24/28@31/1
EGA Information:	Successful, ratio: 66.7%
HDC Information:	Successful, ratio: 1.5% (good quality ratio 1.5%) Quality average: 75.3% Quality standard deviation: 7.4%
HCA Information:	Successful, ratio: 53% Number of executed functions: 20 Number of non-executed functions: 66
Cookbook Comments:	Adjust boot time Enable AMSI Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 23.211.4.86, 23.211.6.115, 80.67.82.235, 80.67.82.211, 20.223.24.244, 52.167.249.196, 52.183.220.149, 52.140.118.28, 51.124.78.146
Excluded domains from analysis (whitelisted): bhhhpq.com, knajpk.com, vaaoff.com, pniyeh.com, vi.strup.pl, oevgnn.com, kto.gind.at, faiyda.com, anyqaz.com, lntyhe.com, fs-wildcard.microsoft.com.edgekey.net, mwhmpz.com, wkedxi.com, www.bing.com, akiypc.com, oyebru.com, aueolp.com, nkewuc.com, pgmuok.com, mjdvvw.com, settings-prod-cin-1.centralindia.cloudapp.azure.com, pxzoao.com, ris.api.iris.microsoft.com, hheong.com, qfsper.com, lnn.maft.at, iooaai.com, raniod.com, yexisu.com, agrwiq.com, oletfa.com, advein.com, e12564.dspb.akamaiedge.net, oirlzx.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, uptrqo.com, prod.fs.microsoft.com.akadns.net, settings-prod-weu-1.westeurope.cloudapp.azure.com, bnylmd.com, dzwrvg.com, pfntvw.com, eixjei.com, mjrztu.com, atm-settingsfe-prod-weighted.trafficmanager.net, qsyrmp.com, mbbaux.com, weuanq.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net, yxdidf.com, qrmrxa.com, oyadis.com, wofqss.com, kqmkgp.com, settings-prod-scus-2.southcentralus.clou
Execution Graph export aborted for target mssecsvc.exe, PID 6976 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
VT rate limit hit for: UBpReASuEC.dll

Simulations

Behavior and APIs

Time	Type	Description
05:00:35	API Interceptor	1x Sleep call for process: loaddll32.exe modified
05:02:29	API Interceptor	8x Sleep call for process: svchost.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
dual-a-0001.a-msedge.net	SecuriteInfo.com.W32.AIDetectNet.01.15601.exe	Get hash	malicious	Browse	204.79.197.200
	SecuriteInfo.com.VBA.Logan.3458.11956.xls	Get hash	malicious	Browse	204.79.197.200
	https://www.southtowna982.com/	Get hash	malicious	Browse	204.79.197.200
	FjYNZSPNkt.dll	Get hash	malicious	Browse	204.79.197.200
	38grJ6wbWq.html	Get hash	malicious	Browse	204.79.197.200
	https://www.flowcode.com/page/unite292will	Get hash	malicious	Browse	204.79.197.200
	JWEZOVFR.EXE	Get hash	malicious	Browse	204.79.197.200
	MY00884Q00129.exe	Get hash	malicious	Browse	204.79.197.200
	https://1drv.ms:443/o/s!BCmallTfOXamgzSwGgeeXl7lslt3?e=4Cla4nBnfkadKLTfw_Mdjg&at=9	Get hash	malicious	Browse	204.79.197.200
	PEQzYbY0er.exe	Get hash	malicious	Browse	204.79.197.200
	Documents KMTCMAA0290019 ( CI+PL+BL).vbs	Get hash	malicious	Browse	204.79.197.200
	4DzrKufLnK.exe	Get hash	malicious	Browse	204.79.197.200
	https://go.nice.com/MzM4LUVKUC00MzEAAAGFtb6zVXuOnVoNFSA7qTufQcWLkaX6RNa3d0vDuXUAKDvgJohiHT6eOcGd-RIg23FVlIC2oKo=	Get hash	malicious	Browse	204.79.197.200
	https://the.realfactsamerica.com/link.php?AGENCY=COWBOY&M=8124335&N=25331&L=19456&F=H&drurl=aHR0cDovL2ZlZWRsZHMuY29tLz9lPWMzUmxkbVZ1TG5OcGJIWmxjbk4wWldsdVFITndaVzVqWlhKbmFXWjBjeTVqYjIwPQ==	Get hash	malicious	Browse	204.79.197.200
	https://1drv.ms/o/s!BBDr9SvsQwFJnGrnPPXxUYT0fc6B?e=KkxvxbUlEEmram7MVHeibQ&at=9	Get hash	malicious	Browse	204.79.197.200
	https://urlsand.esvalabs.com/?u=https%3A%2F%2Fservices.intralinks.com%2FAZ%3Fw%3D13095755%26br%3D1%26p%3D3%26urlId%3D1415095158&e=50525cf7&h=57da353e&f=y&p=y	Get hash	malicious	Browse	204.79.197.200
	Inv-42092859-4.ppam	Get hash	malicious	Browse	204.79.197.200
	File.exe	Get hash	malicious	Browse	204.79.197.200
	http://45.134.140.152	Get hash	malicious	Browse	204.79.197.200
	https://231e02eb.sibforms.com/serve/MUIEADfoAq5V0DVdRclj7_zH_rTFPm-YlKyi7usfXQ3yerbZLkQyg6Yluzckf4ldkvV6aGl63NCfewKNQvuBTUEqJaEwbcKkRqePZwehzpP9BuVPBvwjgIhzgpLaBfjmUQ9u6FehhiXxwYgSz5haG95Y1PMfo6T36WjIWyVWs9re81SdC2BfmO91PC2FkaQcFWh6bexC-1-7Ps1H	Get hash	malicious	Browse	204.79.197.200

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Windows\tasksche.exe	2yQ8hmXyz0.dll	Get hash	malicious	Browse
	4Maoj78D1f.dll	Get hash	malicious	Browse
	9UxtlcUBmY.dll	Get hash	malicious	Browse
	41ECj4EgTY.dll	Get hash	malicious	Browse
	NANG-104355_mssecsvr.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\1736c80d-6930-4acb-ae77-1088e65a6703.c81d4019-1330-4010-8ca2-301e518d770c.down_meta

Download File

Process:	C:\Windows\System32\BackgroundTransferHost.exe
File Type:	data
Category:	dropped
Size (bytes):	1230
Entropy (8bit):	3.6110385152907045
Encrypted:	false
SSDEEP:	24:LLVR2mRiwmXpjgWzgxjX+vUViwH72tBKf1+BnXsafxOc2CpX3K0bwNzw:LLD2mRi3XpjPgVX+v8iG72tBKN4Xrfew
MD5:	B56ED40CAC267C282D8F4070A3A64510
SHA1:	F9C90BF670ABC4DC90B69F784A15797F44473934
SHA-256:	AC7E5ADF17AD92E800E034711B3ECE829CCFA209CD2A9EDC184972444B0049B1
SHA-512:	1D3A2EC341DE9F3AA859DBA9AC07C35FD30A0D4B8BCEFB2392A02130C81819BE8145145F6B57A23C52F5348F15707447CCC305F3E2E68A7DEFDA3CB9BE3EDD44
Malicious:	false
Preview:	h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.P.l.T.B.?.v.e.r.=.2.a.9.4...C.o.n.t.e.n.t.-.T.y.p.e.:. .i.m.a.g.e./.j.p.e.g...A.c.c.e.s.s.-.C.o.n.t.r.o.l.-.A.l.l.o.w.-.O.r.i.g.i.n.:. ....C.o.n.t.e.n.t.-.L.o.c.a.t.i.o.n.:. .h.t.t.p.s.:././.i.m.a.g.e...p.r.o.d...c.m.s...r.t...m.i.c.r.o.s.o.f.t...c.o.m./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.P.l.T.B.?.v.e.r.=.2.a.9.4...L.a.s.t.-.M.o.d.i.f.i.e.d.:. .S.u.n.,. .0.3. .J.u.l. .2.0.2.2. .0.5.:.0.2.:.3.7. .G.M.T...X.-.S.o.u.r.c.e.-.L.e.n.g.t.h.:. .1.6.6.0.8.3.3...X.-.D.a.t.a.c.e.n.t.e.r.:. .n.o.r.t.h.e.u...X.-.A.c.t.i.v.i.t.y.I.d.:. .a.e.8.d.a.1.5.5.-.9.0.f.0.-.4.f.7.0.-.a.5.f.d.-.3.d.e.c.7.8.3.e.c.9.6.9...T.i.m.i.n.g.-.A.l.l.o.w.-.O.r.i.g.i.n.:. ....X.-.F.r.a.m.e.-.O.p.t.i.o.n.s.:. .D.E.N.Y...X.-.R.e.s.i.z.e.r.V.e.r.s.i.o.n.:. .1...0...C.o.n.t.e.n.t.-.L.e.n.g.t.h.:. .1.6.6.0.8.3.3...C.a.c.h.e.-.C.o.n.t.r.o.l.:. .p.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\1736c80d-6930-4acb-ae77-1088e65a6703.up_meta

Download File

Process:	C:\Windows\System32\BackgroundTransferHost.exe
File Type:	data
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.3894363370336076
Encrypted:	false
SSDEEP:	6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQwRct:ZxMghwLtHSM1Sb9mSMXAvwR
MD5:	A27F678F172C642E24DE4740C5B2DBC3
SHA1:	36444729D96B371E3B182455FD5416A724875FF3
SHA-256:	BF27499FEA1EC1D167352764D5DE5CC87FCE82683C3F8CDB3E3A19086DEC5C82
SHA-512:	7846A476F6349EB719D781B6F529DCAAB21140067A54756A3C51E695B20E4C5FF74F5CA798181023D22860E9EA36C9E452EC003AB8A1B242033EB43F3EFA627F
Malicious:	false
Preview:	F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.P.l.T.B.?.v.e.r.=.2.a.9.4...........

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\328613bb-d9fd-464d-8e18-36a56bfcd660.8072ed17-626f-4b05-8d4e-e1f8c9d17eb3.down_meta

Download File

Process:	C:\Windows\System32\BackgroundTransferHost.exe
File Type:	data
Category:	dropped
Size (bytes):	1228
Entropy (8bit):	3.617886292983045
Encrypted:	false
SSDEEP:	24:LLVR2mRitvXpjgWzgxjX+vUVitzBBKE1+AMfh+IpsafxOc2CpX3KdbmISz7zzw:LLD2mRiVXpjPgVX+v8iBBBKuhMZ+IprM
MD5:	B41DEC6FFA96BCF82FBAF611911398FA
SHA1:	FB971E95023E6864481564F30D899CF04A6C357D
SHA-256:	3C3118990B8F2F3A274699C9C7AC1A6F958E7E181F7F582EBB4E641D6BFE4334
SHA-512:	5F02AD0357AEEF860D04C7BEDF396DBD8E5E3BD6A17FD404E1171B078CFA1014A15DA9BA66F614A807D614B6A5D9DF2956807CC6E5F6C8D8FEC1FDB44CE5BB71
Malicious:	false
Preview:	h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.W.H.d.v.F.?.v.e.r.=.d.b.7.5...C.o.n.t.e.n.t.-.T.y.p.e.:. .i.m.a.g.e./.j.p.e.g...A.c.c.e.s.s.-.C.o.n.t.r.o.l.-.A.l.l.o.w.-.O.r.i.g.i.n.:. ....C.o.n.t.e.n.t.-.L.o.c.a.t.i.o.n.:. .h.t.t.p.s.:././.i.m.a.g.e...p.r.o.d...c.m.s...r.t...m.i.c.r.o.s.o.f.t...c.o.m./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.W.H.d.v.F.?.v.e.r.=.d.b.7.5...L.a.s.t.-.M.o.d.i.f.i.e.d.:. .T.u.e.,. .0.5. .J.u.l. .2.0.2.2. .2.1.:.4.4.:.3.3. .G.M.T...X.-.S.o.u.r.c.e.-.L.e.n.g.t.h.:. .1.6.0.3.2.9.5...X.-.D.a.t.a.c.e.n.t.e.r.:. .n.o.r.t.h.e.u...X.-.A.c.t.i.v.i.t.y.I.d.:. .e.6.6.a.6.3.2.d.-.1.4.1.7.-.4.a.8.0.-.a.e.4.1.-.b.3.d.1.9.e.c.9.8.4.f.c...T.i.m.i.n.g.-.A.l.l.o.w.-.O.r.i.g.i.n.:. ....X.-.F.r.a.m.e.-.O.p.t.i.o.n.s.:. .D.E.N.Y...X.-.R.e.s.i.z.e.r.V.e.r.s.i.o.n.:. .1...0...C.o.n.t.e.n.t.-.L.e.n.g.t.h.:. .1.6.0.3.2.9.5...C.a.c.h.e.-.C.o.n.t.r.o.l.:. .p.u.b.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\328613bb-d9fd-464d-8e18-36a56bfcd660.down_data

Download File

Process:	C:\Windows\System32\BackgroundTransferHost.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 21.2 (Windows), datetime=2021:05:28 16:53:16]
Category:	dropped
Size (bytes):	1603295
Entropy (8bit):	6.753308838105362
Encrypted:	false
SSDEEP:	24576:C4jNiVr4qh4txEPsZkDkUZXmxKnalR3HG/R0JyNHMnVWJhwW8+AcohdhgPq/Jh:C4jNiVr4qpYkOrINOhYq/X
MD5:	646B9FC287CA9DB22069A9DDF5ED981E
SHA1:	1EE0D47BD351A812A177A2EFFE06D600EBA34CA3
SHA-256:	B8AC5EB3B58303B0973EFE90B40DA4569826FDF24B7AB94016FB5C1BD5846E41
SHA-512:	81D84CE00BAD88CC38AFAE5C9995B51B527EF49C7717C487A6C38354F42FF87A42C7D60A794850E11E437E41EA4D68EDFE201D07D50E514EE8D67CFB8E22C8D8
Malicious:	false
Preview:	......Exif..MM..............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop 21.2 (Windows).2021:05:28 16:53:16.............................8..........................................."............(.....................2...........j.......H.......H..........Adobe_CM......Adobe.d...................................................................................................................................................Z.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..].....U../...8Z.Y......F~.......9.!......2wC.`.g......q.1s&......(....t..cM.@..A.Rn&.6.k@1...-..[F..\|..g_...#....."z...<P....6....2a....[..,A....U.wI

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\359095cb-bf2b-41bf-8103-13a2a8012235.a3ca69e3-e705-4f64-a747-3b1b77a563b2.down_meta

Download File

Process:	C:\Windows\System32\BackgroundTransferHost.exe
File Type:	data
Category:	dropped
Size (bytes):	1226
Entropy (8bit):	3.6016456604246807
Encrypted:	false
SSDEEP:	24:LLVR2mRiwXFXpjgWzgxjX+vUViwXooBf1+UMMsafxOc2CpX30bDZalXzw:LLD2mRiIXpjPgVX+v8igBNF3rfeIX303
MD5:	07B72D89B1ED8B61E535BC2ABDF597AF
SHA1:	500B80B8B6393EBA57FAE98411F6452BBCF6FBBF
SHA-256:	AFD347D0F717E24CD625960F3606D70E16244AA588F4467183C4AC433EDD6645
SHA-512:	B0B4B14891521B0BB32BD056CDFDB929C042F2B6143B1A43384711FFBE1305955C97E7A1942520AFFEAFA0FED29DE6D78B682A36A9F829B0D878CC2C74718462
Malicious:	false
Preview:	h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.I.v.z.u.?.v.e.r.=.4.f.7.d...C.o.n.t.e.n.t.-.T.y.p.e.:. .i.m.a.g.e./.j.p.e.g...A.c.c.e.s.s.-.C.o.n.t.r.o.l.-.A.l.l.o.w.-.O.r.i.g.i.n.:. ....C.o.n.t.e.n.t.-.L.o.c.a.t.i.o.n.:. .h.t.t.p.s.:././.i.m.a.g.e...p.r.o.d...c.m.s...r.t...m.i.c.r.o.s.o.f.t...c.o.m./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.I.v.z.u.?.v.e.r.=.4.f.7.d...L.a.s.t.-.M.o.d.i.f.i.e.d.:. .S.u.n.,. .1.7. .J.u.l. .2.0.2.2. .0.4.:.1.2.:.4.5. .G.M.T...X.-.S.o.u.r.c.e.-.L.e.n.g.t.h.:. .6.4.8.0.7.7...X.-.D.a.t.a.c.e.n.t.e.r.:. .n.o.r.t.h.e.u...X.-.A.c.t.i.v.i.t.y.I.d.:. .a.d.e.e.f.b.3.4.-.c.0.a.5.-.4.a.c.e.-.b.0.8.2.-.9.5.6.a.6.c.0.0.4.a.c.6...T.i.m.i.n.g.-.A.l.l.o.w.-.O.r.i.g.i.n.:. ....X.-.F.r.a.m.e.-.O.p.t.i.o.n.s.:. .D.E.N.Y...X.-.R.e.s.i.z.e.r.V.e.r.s.i.o.n.:. .1...0...C.o.n.t.e.n.t.-.L.e.n.g.t.h.:. .6.4.8.0.7.7...C.a.c.h.e.-.C.o.n.t.r.o.l.:. .p.u.b.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\359095cb-bf2b-41bf-8103-13a2a8012235.down_data

Download File

Process:	C:\Windows\System32\BackgroundTransferHost.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1920x1080, frames 3
Category:	dropped
Size (bytes):	648077
Entropy (8bit):	7.977806082173002
Encrypted:	false
SSDEEP:	12288:6h+OF4uoSA4dEqWveCOlWMKHepZGRnknrXMWDOxUV48SA8Mp4ZrG:6MOFLQ4dLGeCMWM9Qnknr8t+YA+ZS
MD5:	5458F7693784923195702174155D7B3C
SHA1:	7BD70CD83D89E000791953CF8AB54B87C0FEAD85
SHA-256:	FC52469E34A65090EEB9B0333273025AACD873C86C63AA12C915ED7641BFB8FD
SHA-512:	6AA3157057AC486CF64032FE4C20F864B047585DAA890B7F6F05F7D243AF5516EBE913A85224E53247C14AB4E1F198A75594DCBDF61B9CB5ADB531DAD51D0DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C.......................................................................8...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..2..Le....P.a..H..x.;..qLnjV.j&.Z..Z....u#......Q......H.;.M.....M...E..M..a..).h.LZ...K.......m;.]..a.h.O.F...{h.O...V...Z.ZB.n.....6..G..\..Xn.r...i.i.{.........v..M!.E........-.C(#4.zQ...n.@..8.P... .9........F.v.F.Up........E.J..*..J.4-.=).M(...0&9...}'4\..i6.~...\.....`Rm.,%/4...f..........4m5&.Zd.`OZp.....J..f....4.Z..$4.i<.J.c.5 ....S.S..J#...Z......E.7),~.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\6071454c-93cc-4d3c-88ff-dcf9b8a683e4.bf42fc66-610f-446d-84dd-ccdd2b6f9b34.down_meta

Download File

Process:	C:\Windows\System32\BackgroundTransferHost.exe
File Type:	data
Category:	dropped
Size (bytes):	1228
Entropy (8bit):	3.6254066880554796
Encrypted:	false
SSDEEP:	24:LLVR2mRi7z0XpjgWzgxjX+vUVi7zyBBKj1+LtOpsafxOc2CpX3KwbNdzE:LLD2mRiMXpjPgVX+v8iaBBKR4tOprfeV
MD5:	79767DA61764B38BD317A6BD8241C84A
SHA1:	B9F4C015F6BED65CC645FF1BF86FC88ACF15AA05
SHA-256:	AEDF4AB248A55F40FF2CDD9E983C28B5A3EF6CC2C24A6889F9B645248A8EE19A
SHA-512:	A4552DBB075AC957616C678FBAA2AA00714EBC353F5F436C107B12A3FCEA846BE0702C103D52C42EA73D6F48B1C519D9A564ABEB4AA38EC846D3EB647DD753F3
Malicious:	false
Preview:	h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.W.H.t.7.8.?.v.e.r.=.d.9.b.7...C.o.n.t.e.n.t.-.T.y.p.e.:. .i.m.a.g.e./.j.p.e.g...A.c.c.e.s.s.-.C.o.n.t.r.o.l.-.A.l.l.o.w.-.O.r.i.g.i.n.:. ....C.o.n.t.e.n.t.-.L.o.c.a.t.i.o.n.:. .h.t.t.p.s.:././.i.m.a.g.e...p.r.o.d...c.m.s...r.t...m.i.c.r.o.s.o.f.t...c.o.m./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.W.H.t.7.8.?.v.e.r.=.d.9.b.7...L.a.s.t.-.M.o.d.i.f.i.e.d.:. .T.u.e.,. .0.5. .J.u.l. .2.0.2.2. .2.1.:.4.4.:.3.3. .G.M.T...X.-.S.o.u.r.c.e.-.L.e.n.g.t.h.:. .1.6.8.9.8.3.0...X.-.D.a.t.a.c.e.n.t.e.r.:. .n.o.r.t.h.e.u...X.-.A.c.t.i.v.i.t.y.I.d.:. .a.0.3.9.3.c.9.2.-.5.6.1.5.-.4.d.f.8.-.8.d.5.4.-.d.f.7.b.2.b.b.a.e.5.4.d...T.i.m.i.n.g.-.A.l.l.o.w.-.O.r.i.g.i.n.:. ....X.-.F.r.a.m.e.-.O.p.t.i.o.n.s.:. .D.E.N.Y...X.-.R.e.s.i.z.e.r.V.e.r.s.i.o.n.:. .1...0...C.o.n.t.e.n.t.-.L.e.n.g.t.h.:. .1.6.8.9.8.3.0...C.a.c.h.e.-.C.o.n.t.r.o.l.:. .p.u.b.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\6071454c-93cc-4d3c-88ff-dcf9b8a683e4.down_data

Download File

Process:	C:\Windows\System32\BackgroundTransferHost.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 21.2 (Windows), datetime=2021:05:28 16:52:49]
Category:	dropped
Size (bytes):	1689830
Entropy (8bit):	6.861393432577005
Encrypted:	false
SSDEEP:	24576:edC81bzBAsO5ZWOklZjQxKnaDR3HG/R0JyN0qNoH4dX/GkZmO18Il1T/2/QkzJJa:edC81bzaW0CX/GbW841j2bJMe7U
MD5:	33E18071DB8D402840B4A62A95778A13
SHA1:	9E7546F1D11ACAB5A5F0B1AA243BBDF724E26BDA
SHA-256:	BF354FCF29C7BD03804F43ACFC74D916D3085F9015591C21C011F237FD311A05
SHA-512:	6B4863E21FA29D9B7D6E4FBC4B4C239F7DFE72C57C2151E58142B11384A785EDCB646C3BFDC888057F4CD410651C09F6CACB18A1677E39C3AC355F874C4AE091
Malicious:	false
Preview:	......Exif..MM..............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop 21.2 (Windows).2021:05:28 16:52:49.........................................8..............................."............(.....................2...................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................Z...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....yk).$."V.-.T.pc..d,....Q.p[,...$............6...K.89...U..SLK.V.y...........:.T....xA.Y..."...R.t.i.w.l......w...F..uB...@i..L~..LO..^!0.v..b...);

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\60f12053-d245-44a6-bc56-ad6e6ab7a7c9.f2d7e325-8812-419f-93c5-393f1d8412fe.down_meta

Download File

Process:	C:\Windows\System32\BackgroundTransferHost.exe
File Type:	data
Category:	dropped
Size (bytes):	1228
Entropy (8bit):	3.6072733039513065
Encrypted:	false
SSDEEP:	24:LLVR2mRiwinWzgx71+Bm6safxOc2CpXpjjX+vUViw/BdX3ibecIzzw:LLD2mRiTggvYm6rfeIXpjjX+v8ieBdXC
MD5:	2513140D9E5B98478FF38E3286EDF25D
SHA1:	71F1480A6A8547B85AAA25A45A045C763B4A0A41
SHA-256:	064955503F206AB1F15650438D870158005709B53DB7D40E6E3EDA64BF572E02
SHA-512:	819F089E97AE62434BE06A75CD59D1C7138844EF49DA17207D040F4825F3679DECFF5F925B30EDB194AA2C9C13C0E05E9ADFFB643F4447BFEC8EAC2707AF8D0F
Malicious:	false
Preview:	h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.I.h.j.W.?.v.e.r.=.1.f.7.0...L.a.s.t.-.M.o.d.i.f.i.e.d.:. .S.a.t.,. .0.2. .J.u.l. .2.0.2.2. .0.5.:.3.0.:.2.2. .G.M.T...A.c.c.e.s.s.-.C.o.n.t.r.o.l.-.A.l.l.o.w.-.O.r.i.g.i.n.:. ....X.-.D.a.t.a.c.e.n.t.e.r.:. .n.o.r.t.h.e.u...X.-.A.c.t.i.v.i.t.y.I.d.:. .8.6.c.d.e.c.a.5.-.2.5.5.a.-.4.5.6.5.-.9.f.f.d.-.0.d.d.2.6.1.c.f.1.b.e.b...T.i.m.i.n.g.-.A.l.l.o.w.-.O.r.i.g.i.n.:. ....X.-.F.r.a.m.e.-.O.p.t.i.o.n.s.:. .D.E.N.Y...X.-.R.e.s.i.z.e.r.V.e.r.s.i.o.n.:. .1...0...C.o.n.t.e.n.t.-.T.y.p.e.:. .i.m.a.g.e./.j.p.e.g...C.o.n.t.e.n.t.-.L.o.c.a.t.i.o.n.:. .h.t.t.p.s.:././.i.m.a.g.e...p.r.o.d...c.m.s...r.t...m.i.c.r.o.s.o.f.t...c.o.m./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.I.h.j.W.?.v.e.r.=.1.f.7.0...X.-.S.o.u.r.c.e.-.L.e.n.g.t.h.:. .6.1.3.5.6.7...C.o.n.t.e.n.t.-.L.e.n.g.t.h.:. .6.1.3.5.6.7...C.a.c.h.e.-.C.o.n.t.r.o.l.:. .p.u.b.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\60f12053-d245-44a6-bc56-ad6e6ab7a7c9.up_meta

Download File

Process:	C:\Windows\System32\BackgroundTransferHost.exe
File Type:	data
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.4350986465636852
Encrypted:	false
SSDEEP:	6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQwRsalWvl:ZxMghwLtHSM1Sb9mSMXAvwRr
MD5:	89D09B34609397415243075D49AF750D
SHA1:	9F3428A1B21686D99FF5ABB5D80EA55138353479
SHA-256:	669600E7861E4A92733B3366F718FE3BEFB6262E45F17B181F5BDE291AA3EAF1
SHA-512:	FE90351CC0810790A8050F8AF5989ABFD5B39F919381AE0F145436B322F1E6F6514763269E1BED31A600A752D847276E84651B4D46B05AC33947F8DFBAE3E678
Malicious:	false
Preview:	F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.I.h.j.W.?.v.e.r.=.1.f.7.0...........

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\6faba965-83b0-4727-9cf6-f717a8d19482.593aeaca-14dd-4f73-a505-b9177043fbb4.down_meta

Download File

Process:	C:\Windows\System32\BackgroundTransferHost.exe
File Type:	data
Category:	dropped
Size (bytes):	1232
Entropy (8bit):	3.62022264151444
Encrypted:	false
SSDEEP:	24:LLVR2mRiw5CuXpjgWzgxjX+vUViw5nrBB41+lPDipsafxOc2CpX3JbbOGFzw:LLD2mRi+1XpjPgVX+v8i+dBiqPD6rfex
MD5:	F005EE8A58481E0B1EA148A93D8A328E
SHA1:	0E843E5352E75BA0497BB1E97140C39EB238F5B5
SHA-256:	CA5B172DC99F6B2F92681397244946A563E8FC76E49D6A8AE8EC47CE7097C6E6
SHA-512:	62B14F0CEFCD48270255D64A67C8D2149299DD38670C8D1ACF274000F4C5EEC63228DDBAFD7015013C45DABA87E1270F3FB71A5EE1B05956B26253D11CD39B24
Malicious:	false
Preview:	h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.P.w.e.j.?.v.e.r.=.c.b.f.0...C.o.n.t.e.n.t.-.T.y.p.e.:. .i.m.a.g.e./.j.p.e.g...A.c.c.e.s.s.-.C.o.n.t.r.o.l.-.A.l.l.o.w.-.O.r.i.g.i.n.:. ....C.o.n.t.e.n.t.-.L.o.c.a.t.i.o.n.:. .h.t.t.p.s.:././.i.m.a.g.e...p.r.o.d...c.m.s...r.t...m.i.c.r.o.s.o.f.t...c.o.m./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.P.w.e.j.?.v.e.r.=.c.b.f.0...L.a.s.t.-.M.o.d.i.f.i.e.d.:. .M.o.n.,. .1.8. .J.u.l. .2.0.2.2. .0.3.:.1.6.:.1.8. .G.M.T...X.-.S.o.u.r.c.e.-.L.e.n.g.t.h.:. .1.7.0.8.8.6.5...X.-.D.a.t.a.c.e.n.t.e.r.:. .n.o.r.t.h.e.u...X.-.A.c.t.i.v.i.t.y.I.d.:. .3.b.3.0.3.f.5.5.-.c.4.4.f.-.4.4.5.a.-.8.0.b.2.-.3.9.0.2.9.1.7.3.7.1.c.3...T.i.m.i.n.g.-.A.l.l.o.w.-.O.r.i.g.i.n.:. ....X.-.F.r.a.m.e.-.O.p.t.i.o.n.s.:. .D.E.N.Y...X.-.R.e.s.i.z.e.r.V.e.r.s.i.o.n.:. .1...0...C.o.n.t.e.n.t.-.L.e.n.g.t.h.:. .1.7.0.8.8.6.5...C.a.c.h.e.-.C.o.n.t.r.o.l.:. .p.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\6faba965-83b0-4727-9cf6-f717a8d19482.up_meta

Download File

Process:	C:\Windows\System32\BackgroundTransferHost.exe
File Type:	data
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.422473556620063
Encrypted:	false
SSDEEP:	6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQwRKaMAo4:ZxMghwLtHSM1Sb9mSMXAvwR/M
MD5:	053A6748354C63633E9F064D374A3D64
SHA1:	F7392A988C29192C2DBB9192931C98C346A03B46
SHA-256:	1867022FBB28FC2A1F79ED84CFA93EFEE48C33EF120A7976E594BD497DA2ED3F
SHA-512:	175DB5E34D5D66ABCBA2DC76ADF44978A26A70A5CCEA46FF96D3EC85F4F34BA0B571785C3A912E87FD3D194F101339B2D0E988D4A611FFA91F9AC9204BDE5765
Malicious:	false
Preview:	F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.P.w.e.j.?.v.e.r.=.c.b.f.0...........

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\7d74c1c9-e7b4-43ae-af85-d91ef9a0b3dd.593aeaca-14dd-4f73-a505-b9177043fbb4.down_meta

Download File

Process:	C:\Windows\System32\BackgroundTransferHost.exe
File Type:	data
Category:	dropped
Size (bytes):	1232
Entropy (8bit):	3.62022264151444
Encrypted:	false
SSDEEP:	24:LLVR2mRiw5CuXpjgWzgxjX+vUViw5nrBB41+lPDipsafxOc2CpX3JbbOGFzw:LLD2mRi+1XpjPgVX+v8i+dBiqPD6rfex
MD5:	F005EE8A58481E0B1EA148A93D8A328E
SHA1:	0E843E5352E75BA0497BB1E97140C39EB238F5B5
SHA-256:	CA5B172DC99F6B2F92681397244946A563E8FC76E49D6A8AE8EC47CE7097C6E6
SHA-512:	62B14F0CEFCD48270255D64A67C8D2149299DD38670C8D1ACF274000F4C5EEC63228DDBAFD7015013C45DABA87E1270F3FB71A5EE1B05956B26253D11CD39B24
Malicious:	false
Preview:	h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.P.w.e.j.?.v.e.r.=.c.b.f.0...C.o.n.t.e.n.t.-.T.y.p.e.:. .i.m.a.g.e./.j.p.e.g...A.c.c.e.s.s.-.C.o.n.t.r.o.l.-.A.l.l.o.w.-.O.r.i.g.i.n.:. ....C.o.n.t.e.n.t.-.L.o.c.a.t.i.o.n.:. .h.t.t.p.s.:././.i.m.a.g.e...p.r.o.d...c.m.s...r.t...m.i.c.r.o.s.o.f.t...c.o.m./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.P.w.e.j.?.v.e.r.=.c.b.f.0...L.a.s.t.-.M.o.d.i.f.i.e.d.:. .M.o.n.,. .1.8. .J.u.l. .2.0.2.2. .0.3.:.1.6.:.1.8. .G.M.T...X.-.S.o.u.r.c.e.-.L.e.n.g.t.h.:. .1.7.0.8.8.6.5...X.-.D.a.t.a.c.e.n.t.e.r.:. .n.o.r.t.h.e.u...X.-.A.c.t.i.v.i.t.y.I.d.:. .3.b.3.0.3.f.5.5.-.c.4.4.f.-.4.4.5.a.-.8.0.b.2.-.3.9.0.2.9.1.7.3.7.1.c.3...T.i.m.i.n.g.-.A.l.l.o.w.-.O.r.i.g.i.n.:. ....X.-.F.r.a.m.e.-.O.p.t.i.o.n.s.:. .D.E.N.Y...X.-.R.e.s.i.z.e.r.V.e.r.s.i.o.n.:. .1...0...C.o.n.t.e.n.t.-.L.e.n.g.t.h.:. .1.7.0.8.8.6.5...C.a.c.h.e.-.C.o.n.t.r.o.l.:. .p.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\7d74c1c9-e7b4-43ae-af85-d91ef9a0b3dd.down_data

Download File

Process:	C:\Windows\System32\BackgroundTransferHost.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 21.1 (Windows), datetime=2022:03:02 13:22:10]
Category:	dropped
Size (bytes):	1708865
Entropy (8bit):	6.97847786200903
Encrypted:	false
SSDEEP:	24576:HdC81bzUVyezQkoZvNEyfcO/irM/R0JGSUxf8QQYVzaIPhwkXtpxODfAL9OeQZzE:HdC81bzIzMbXVzag5OjCOeQJkd
MD5:	BEA60D73FB1ECED3027734526438F17C
SHA1:	94EF9697C95742084DB52EDC303FD4DA31286FE3
SHA-256:	0F41D7DBC9F23B935077A920C03146802FFA26B1342E5A262E62750DDCDDAE21
SHA-512:	29BC20AA7B8C40E1E4B2738F2C9FAA23A1A0D37A34FF44866F81551FE9B374A6EE4EDED8D4292CF2DE3D928D7B008701922AE7A7DD48E9CDBC63A08D4F3CC6C7
Malicious:	false
Preview:	......Exif..MM..............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop 21.1 (Windows).2022:03:02 13:22:10.........................................8..............................."............(.....................2...................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................Z...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..M<.....5 hL..}%....{(.........d8..{+...9....$..r,.6t.J=?......g.....+.3.p..88.4...[.o.......qzu..k_..yf.hh...~....F..M.@7..x....+......?r..]o..6.E

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\883a00d1-26f9-46de-b0d6-299b64c5e1d5.8072ed17-626f-4b05-8d4e-e1f8c9d17eb3.down_meta

Download File

Process:	C:\Windows\System32\BackgroundTransferHost.exe
File Type:	data
Category:	dropped
Size (bytes):	1228
Entropy (8bit):	3.617886292983045
Encrypted:	false
SSDEEP:	24:LLVR2mRitvXpjgWzgxjX+vUVitzBBKE1+AMfh+IpsafxOc2CpX3KdbmISz7zzw:LLD2mRiVXpjPgVX+v8iBBBKuhMZ+IprM
MD5:	B41DEC6FFA96BCF82FBAF611911398FA
SHA1:	FB971E95023E6864481564F30D899CF04A6C357D
SHA-256:	3C3118990B8F2F3A274699C9C7AC1A6F958E7E181F7F582EBB4E641D6BFE4334
SHA-512:	5F02AD0357AEEF860D04C7BEDF396DBD8E5E3BD6A17FD404E1171B078CFA1014A15DA9BA66F614A807D614B6A5D9DF2956807CC6E5F6C8D8FEC1FDB44CE5BB71
Malicious:	false
Preview:	h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.W.H.d.v.F.?.v.e.r.=.d.b.7.5...C.o.n.t.e.n.t.-.T.y.p.e.:. .i.m.a.g.e./.j.p.e.g...A.c.c.e.s.s.-.C.o.n.t.r.o.l.-.A.l.l.o.w.-.O.r.i.g.i.n.:. ....C.o.n.t.e.n.t.-.L.o.c.a.t.i.o.n.:. .h.t.t.p.s.:././.i.m.a.g.e...p.r.o.d...c.m.s...r.t...m.i.c.r.o.s.o.f.t...c.o.m./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.W.H.d.v.F.?.v.e.r.=.d.b.7.5...L.a.s.t.-.M.o.d.i.f.i.e.d.:. .T.u.e.,. .0.5. .J.u.l. .2.0.2.2. .2.1.:.4.4.:.3.3. .G.M.T...X.-.S.o.u.r.c.e.-.L.e.n.g.t.h.:. .1.6.0.3.2.9.5...X.-.D.a.t.a.c.e.n.t.e.r.:. .n.o.r.t.h.e.u...X.-.A.c.t.i.v.i.t.y.I.d.:. .e.6.6.a.6.3.2.d.-.1.4.1.7.-.4.a.8.0.-.a.e.4.1.-.b.3.d.1.9.e.c.9.8.4.f.c...T.i.m.i.n.g.-.A.l.l.o.w.-.O.r.i.g.i.n.:. ....X.-.F.r.a.m.e.-.O.p.t.i.o.n.s.:. .D.E.N.Y...X.-.R.e.s.i.z.e.r.V.e.r.s.i.o.n.:. .1...0...C.o.n.t.e.n.t.-.L.e.n.g.t.h.:. .1.6.0.3.2.9.5...C.a.c.h.e.-.C.o.n.t.r.o.l.:. .p.u.b.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\883a00d1-26f9-46de-b0d6-299b64c5e1d5.up_meta

Download File

Process:	C:\Windows\System32\BackgroundTransferHost.exe
File Type:	data
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.438175784744095
Encrypted:	false
SSDEEP:	6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQiVmrAo:ZxMghwLtHSM1Sb9mSMXAvhr
MD5:	9F7A90D7E32FD4A4110DF064B1957D0A
SHA1:	2362EE9182E294EB85C75042E7489ABB5173D396
SHA-256:	8E828B723168F6DAD1D3D13B3667F1EB91BF9B226FED23AE0ED140D1C277A946
SHA-512:	924547ED720641EBECC589A573E3B68547D5D7693F8E2B8DAB689454C0BCCA872EBD8FB6C1EB8C3C39B26A1E4785C4E5AA3B204AA040A384016BCB269DB2DF5E
Malicious:	false
Preview:	F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.W.H.d.v.F.?.v.e.r.=.d.b.7.5...........

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\8b038c59-1bf5-4ad4-a29a-857cfc273d03.a3ca69e3-e705-4f64-a747-3b1b77a563b2.down_meta

Download File

Process:	C:\Windows\System32\BackgroundTransferHost.exe
File Type:	data
Category:	dropped
Size (bytes):	1226
Entropy (8bit):	3.6016456604246807
Encrypted:	false
SSDEEP:	24:LLVR2mRiwXFXpjgWzgxjX+vUViwXooBf1+UMMsafxOc2CpX30bDZalXzw:LLD2mRiIXpjPgVX+v8igBNF3rfeIX303
MD5:	07B72D89B1ED8B61E535BC2ABDF597AF
SHA1:	500B80B8B6393EBA57FAE98411F6452BBCF6FBBF
SHA-256:	AFD347D0F717E24CD625960F3606D70E16244AA588F4467183C4AC433EDD6645
SHA-512:	B0B4B14891521B0BB32BD056CDFDB929C042F2B6143B1A43384711FFBE1305955C97E7A1942520AFFEAFA0FED29DE6D78B682A36A9F829B0D878CC2C74718462
Malicious:	false
Preview:	h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.I.v.z.u.?.v.e.r.=.4.f.7.d...C.o.n.t.e.n.t.-.T.y.p.e.:. .i.m.a.g.e./.j.p.e.g...A.c.c.e.s.s.-.C.o.n.t.r.o.l.-.A.l.l.o.w.-.O.r.i.g.i.n.:. ....C.o.n.t.e.n.t.-.L.o.c.a.t.i.o.n.:. .h.t.t.p.s.:././.i.m.a.g.e...p.r.o.d...c.m.s...r.t...m.i.c.r.o.s.o.f.t...c.o.m./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.I.v.z.u.?.v.e.r.=.4.f.7.d...L.a.s.t.-.M.o.d.i.f.i.e.d.:. .S.u.n.,. .1.7. .J.u.l. .2.0.2.2. .0.4.:.1.2.:.4.5. .G.M.T...X.-.S.o.u.r.c.e.-.L.e.n.g.t.h.:. .6.4.8.0.7.7...X.-.D.a.t.a.c.e.n.t.e.r.:. .n.o.r.t.h.e.u...X.-.A.c.t.i.v.i.t.y.I.d.:. .a.d.e.e.f.b.3.4.-.c.0.a.5.-.4.a.c.e.-.b.0.8.2.-.9.5.6.a.6.c.0.0.4.a.c.6...T.i.m.i.n.g.-.A.l.l.o.w.-.O.r.i.g.i.n.:. ....X.-.F.r.a.m.e.-.O.p.t.i.o.n.s.:. .D.E.N.Y...X.-.R.e.s.i.z.e.r.V.e.r.s.i.o.n.:. .1...0...C.o.n.t.e.n.t.-.L.e.n.g.t.h.:. .6.4.8.0.7.7...C.a.c.h.e.-.C.o.n.t.r.o.l.:. .p.u.b.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\8b038c59-1bf5-4ad4-a29a-857cfc273d03.up_meta

Download File

Process:	C:\Windows\System32\BackgroundTransferHost.exe
File Type:	data
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.418353962995147
Encrypted:	false
SSDEEP:	6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQwRsZUoal:ZxMghwLtHSM1Sb9mSMXAvwRxn
MD5:	6E8889632FDEFA92D03416F4BCDCF6CA
SHA1:	E031BDACB6AB7C6F27DB20F38E47E397C4444F03
SHA-256:	4D291630362729565E519F5D33BD67FFD4EF5B4E1B43E71696A469F4380F5EA6
SHA-512:	BEC466A5BACABB32CE56962EB37056BEE67227D6BFD433602AE50E92AB2E7FFBC42F628E8E11FE10C131945DB8D4049F1463758343E1B8224F06EC0D33800ED0
Malicious:	false
Preview:	F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.I.v.z.u.?.v.e.r.=.4.f.7.d...........

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\aa32b058-0d4a-4dd4-a681-a185709cfe4c.c81d4019-1330-4010-8ca2-301e518d770c.down_meta

Download File

Process:	C:\Windows\System32\BackgroundTransferHost.exe
File Type:	data
Category:	dropped
Size (bytes):	1230
Entropy (8bit):	3.6110385152907045
Encrypted:	false
SSDEEP:	24:LLVR2mRiwmXpjgWzgxjX+vUViwH72tBKf1+BnXsafxOc2CpX3K0bwNzw:LLD2mRi3XpjPgVX+v8iG72tBKN4Xrfew
MD5:	B56ED40CAC267C282D8F4070A3A64510
SHA1:	F9C90BF670ABC4DC90B69F784A15797F44473934
SHA-256:	AC7E5ADF17AD92E800E034711B3ECE829CCFA209CD2A9EDC184972444B0049B1
SHA-512:	1D3A2EC341DE9F3AA859DBA9AC07C35FD30A0D4B8BCEFB2392A02130C81819BE8145145F6B57A23C52F5348F15707447CCC305F3E2E68A7DEFDA3CB9BE3EDD44
Malicious:	false
Preview:	h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.P.l.T.B.?.v.e.r.=.2.a.9.4...C.o.n.t.e.n.t.-.T.y.p.e.:. .i.m.a.g.e./.j.p.e.g...A.c.c.e.s.s.-.C.o.n.t.r.o.l.-.A.l.l.o.w.-.O.r.i.g.i.n.:. ....C.o.n.t.e.n.t.-.L.o.c.a.t.i.o.n.:. .h.t.t.p.s.:././.i.m.a.g.e...p.r.o.d...c.m.s...r.t...m.i.c.r.o.s.o.f.t...c.o.m./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.P.l.T.B.?.v.e.r.=.2.a.9.4...L.a.s.t.-.M.o.d.i.f.i.e.d.:. .S.u.n.,. .0.3. .J.u.l. .2.0.2.2. .0.5.:.0.2.:.3.7. .G.M.T...X.-.S.o.u.r.c.e.-.L.e.n.g.t.h.:. .1.6.6.0.8.3.3...X.-.D.a.t.a.c.e.n.t.e.r.:. .n.o.r.t.h.e.u...X.-.A.c.t.i.v.i.t.y.I.d.:. .a.e.8.d.a.1.5.5.-.9.0.f.0.-.4.f.7.0.-.a.5.f.d.-.3.d.e.c.7.8.3.e.c.9.6.9...T.i.m.i.n.g.-.A.l.l.o.w.-.O.r.i.g.i.n.:. ....X.-.F.r.a.m.e.-.O.p.t.i.o.n.s.:. .D.E.N.Y...X.-.R.e.s.i.z.e.r.V.e.r.s.i.o.n.:. .1...0...C.o.n.t.e.n.t.-.L.e.n.g.t.h.:. .1.6.6.0.8.3.3...C.a.c.h.e.-.C.o.n.t.r.o.l.:. .p.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\aa32b058-0d4a-4dd4-a681-a185709cfe4c.down_data

Download File

Process:	C:\Windows\System32\BackgroundTransferHost.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 21.1 (Windows), datetime=2022:03:02 13:23:15]
Category:	dropped
Size (bytes):	1660833
Entropy (8bit):	6.930794506164581
Encrypted:	false
SSDEEP:	24576:+4jNiVr4qksnz807k9ZliEKBcI/prV/RmJGoGa1KZTOsePRxaAxS2+gPu/Zj:+4jNiVr4qu0frZfWxaaqgG/Zj
MD5:	2CD6B59B5F9D8E356D332AA2E645CAFF
SHA1:	A981FFE89A6EC691AB4E5DAD320832D3236ECC12
SHA-256:	3E97C246B7A8DFB0590215FC3C7236583D4AFDFEF0315D89770BB8FE7305DF1C
SHA-512:	CB2A41C198ED4D119ABADA123A96359E923864E73AD3F937DA5DB0AB679C3095AD8E7608DBC737C433B417214716F08450D78FACCB395790B0249C4C6AE12868
Malicious:	false
Preview:	....!.Exif..MM..............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop 21.1 (Windows).2022:03:02 13:23:15.............................8..........................................."............(.....................2.......... I.......H.......H..........Adobe_CM......Adobe.d...................................................................................................................................................Z.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...H..{.....hNZ.un.../.%...yt.....Co......".+\..K..z.4...........c>.....6~.M.~=.N.?.......2.......w._..n.....W:..k...f.}':..7.......+.9.f.b.5

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\b435ff53-02ad-4cca-9767-787c263d0f27.bf42fc66-610f-446d-84dd-ccdd2b6f9b34.down_meta

Download File

Process:	C:\Windows\System32\BackgroundTransferHost.exe
File Type:	data
Category:	dropped
Size (bytes):	1228
Entropy (8bit):	3.6254066880554796
Encrypted:	false
SSDEEP:	24:LLVR2mRi7z0XpjgWzgxjX+vUVi7zyBBKj1+LtOpsafxOc2CpX3KwbNdzE:LLD2mRiMXpjPgVX+v8iaBBKR4tOprfeV
MD5:	79767DA61764B38BD317A6BD8241C84A
SHA1:	B9F4C015F6BED65CC645FF1BF86FC88ACF15AA05
SHA-256:	AEDF4AB248A55F40FF2CDD9E983C28B5A3EF6CC2C24A6889F9B645248A8EE19A
SHA-512:	A4552DBB075AC957616C678FBAA2AA00714EBC353F5F436C107B12A3FCEA846BE0702C103D52C42EA73D6F48B1C519D9A564ABEB4AA38EC846D3EB647DD753F3
Malicious:	false
Preview:	h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.W.H.t.7.8.?.v.e.r.=.d.9.b.7...C.o.n.t.e.n.t.-.T.y.p.e.:. .i.m.a.g.e./.j.p.e.g...A.c.c.e.s.s.-.C.o.n.t.r.o.l.-.A.l.l.o.w.-.O.r.i.g.i.n.:. ....C.o.n.t.e.n.t.-.L.o.c.a.t.i.o.n.:. .h.t.t.p.s.:././.i.m.a.g.e...p.r.o.d...c.m.s...r.t...m.i.c.r.o.s.o.f.t...c.o.m./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.W.H.t.7.8.?.v.e.r.=.d.9.b.7...L.a.s.t.-.M.o.d.i.f.i.e.d.:. .T.u.e.,. .0.5. .J.u.l. .2.0.2.2. .2.1.:.4.4.:.3.3. .G.M.T...X.-.S.o.u.r.c.e.-.L.e.n.g.t.h.:. .1.6.8.9.8.3.0...X.-.D.a.t.a.c.e.n.t.e.r.:. .n.o.r.t.h.e.u...X.-.A.c.t.i.v.i.t.y.I.d.:. .a.0.3.9.3.c.9.2.-.5.6.1.5.-.4.d.f.8.-.8.d.5.4.-.d.f.7.b.2.b.b.a.e.5.4.d...T.i.m.i.n.g.-.A.l.l.o.w.-.O.r.i.g.i.n.:. ....X.-.F.r.a.m.e.-.O.p.t.i.o.n.s.:. .D.E.N.Y...X.-.R.e.s.i.z.e.r.V.e.r.s.i.o.n.:. .1...0...C.o.n.t.e.n.t.-.L.e.n.g.t.h.:. .1.6.8.9.8.3.0...C.a.c.h.e.-.C.o.n.t.r.o.l.:. .p.u.b.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\b435ff53-02ad-4cca-9767-787c263d0f27.up_meta

Download File

Process:	C:\Windows\System32\BackgroundTransferHost.exe
File Type:	data
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.424945768604952
Encrypted:	false
SSDEEP:	6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQiVOlnaUoqnG/:ZxMghwLtHSM1Sb9mSMXAv7a8
MD5:	258640F6D6B36C93D7FA148F5167502B
SHA1:	6C2E439AA7B71D93FF77A9CE56B13F1F43A5AFED
SHA-256:	CB11046EDC373FFAF058247C58106FEF5F4123DACD619D696BA89BBE8120BFCA
SHA-512:	712334D9ED01B856ED8FADB48D74968220A98DBA7CD5E8362500BBB74EB5D7FC78F628F426D9AB66C68EDD62F131EAE2C45FF1EBF35EAB4183B8010BAA4C16C1
Malicious:	false
Preview:	F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.W.H.t.7.8.?.v.e.r.=.d.9.b.7...........

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\da1bddb5-07ff-4965-8851-78bdc89a18cf.down_data

Download File

Process:	C:\Windows\System32\BackgroundTransferHost.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1080x1920, frames 3
Category:	dropped
Size (bytes):	613567
Entropy (8bit):	7.905601627857833
Encrypted:	false
SSDEEP:	12288:MzT+UvqrMe4mdkr6gcCShKLz/CGh4Z1LnJjYaIlg:Bymdq6h8P/C1ZPNUg
MD5:	6D031AC336957A7B06E915DE5DD97A6A
SHA1:	4A3CC280924191A6675547792C957041E32B08B7
SHA-256:	656DD2410D701D0C64EFFC15EEB9AFA7FC0833DC201EC626CC77FC56671C1330
SHA-512:	8FF219CF020118C16C2CBDA921E9C3D28BD107663785FAC9A21355A0697128B60651C50218DE20F187DDFEEAE508ABFEB1DB72A1CC4E9C7BE489D512B2519DD9
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................8.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....N.LZzW.Y......E...H.7....s.-"U..\P...g..2..#-G.....fK...P....z..V...v.......&.I..U..QH....S...`..^... aK...]#(Z.G+ ..lSy.+.2.jV..2....e..3mQ.P..v...4...4QRh:.m..r.=Z.E&..ber.T....V..M..>`.+.]...).U.=d.S.)U...E....uJ.VzIS..R..j.J7...oR....*.OB.<.......h....4u...P.P...r...>...+K.5A...6...$l-1.u&.zk5.s\u2....v..ai..n.L.a..5...-BN.9J..j6......V...g

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\da1bddb5-07ff-4965-8851-78bdc89a18cf.f2d7e325-8812-419f-93c5-393f1d8412fe.down_meta

Download File

Process:	C:\Windows\System32\BackgroundTransferHost.exe
File Type:	data
Category:	dropped
Size (bytes):	1228
Entropy (8bit):	3.6072733039513065
Encrypted:	false
SSDEEP:	24:LLVR2mRiwinWzgx71+Bm6safxOc2CpXpjjX+vUViw/BdX3ibecIzzw:LLD2mRiTggvYm6rfeIXpjjX+v8ieBdXC
MD5:	2513140D9E5B98478FF38E3286EDF25D
SHA1:	71F1480A6A8547B85AAA25A45A045C763B4A0A41
SHA-256:	064955503F206AB1F15650438D870158005709B53DB7D40E6E3EDA64BF572E02
SHA-512:	819F089E97AE62434BE06A75CD59D1C7138844EF49DA17207D040F4825F3679DECFF5F925B30EDB194AA2C9C13C0E05E9ADFFB643F4447BFEC8EAC2707AF8D0F
Malicious:	false
Preview:	h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.I.h.j.W.?.v.e.r.=.1.f.7.0...L.a.s.t.-.M.o.d.i.f.i.e.d.:. .S.a.t.,. .0.2. .J.u.l. .2.0.2.2. .0.5.:.3.0.:.2.2. .G.M.T...A.c.c.e.s.s.-.C.o.n.t.r.o.l.-.A.l.l.o.w.-.O.r.i.g.i.n.:. ....X.-.D.a.t.a.c.e.n.t.e.r.:. .n.o.r.t.h.e.u...X.-.A.c.t.i.v.i.t.y.I.d.:. .8.6.c.d.e.c.a.5.-.2.5.5.a.-.4.5.6.5.-.9.f.f.d.-.0.d.d.2.6.1.c.f.1.b.e.b...T.i.m.i.n.g.-.A.l.l.o.w.-.O.r.i.g.i.n.:. ....X.-.F.r.a.m.e.-.O.p.t.i.o.n.s.:. .D.E.N.Y...X.-.R.e.s.i.z.e.r.V.e.r.s.i.o.n.:. .1...0...C.o.n.t.e.n.t.-.T.y.p.e.:. .i.m.a.g.e./.j.p.e.g...C.o.n.t.e.n.t.-.L.o.c.a.t.i.o.n.:. .h.t.t.p.s.:././.i.m.a.g.e...p.r.o.d...c.m.s...r.t...m.i.c.r.o.s.o.f.t...c.o.m./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.I.h.j.W.?.v.e.r.=.1.f.7.0...X.-.S.o.u.r.c.e.-.L.e.n.g.t.h.:. .6.1.3.5.6.7...C.o.n.t.e.n.t.-.L.e.n.g.t.h.:. .6.1.3.5.6.7...C.a.c.h.e.-.C.o.n.t.r.o.l.:. .p.u.b.

C:\Windows\System32\wbem\Performance\WmiApRpl_new.h

Download File

Process:	C:\Windows\System32\wbem\WMIADAP.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3444
Entropy (8bit):	5.011954215267298
Encrypted:	false
SSDEEP:	48:ADPo+gDMIuK54DeHNg9dqbEzCJGGgGDU3XgLBgaGKFijiVJtVAAF/XRgW:ADw+gDMhK54qHC7aBvGKFijiV7XRgW
MD5:	B133A676D139032A27DE3D9619E70091
SHA1:	1248AA89938A13640252A79113930EDE2F26F1FA
SHA-256:	AE2B6236D3EEB4822835714AE9444E5DCD21BC60F7A909F2962C43BC743C7B15
SHA-512:	C6B99E13D854CE7A6874497473614EE4BD81C490802783DB1349AB851CD80D1DC06DF8C1F6E434ABA873A5BBF6125CC64104709064E19A9DC1C66DCDE3F898F5
Malicious:	false
Preview:	//////////////////////////////////////////////////////////////////////////////////////////////..//..// Copyright (C) 2000 Microsoft Corporation..//..// Module Name:..// WmiApRpl..//..// Abstract:..//..// Include file for object and counters definitions...//..//////////////////////////////////////////////////////////////////////////////////////////////......#define.WMI_Objects.0..#define.HiPerf_Classes.2..#define.HiPerf_Validity.4....#define.MSiSCSI_ConnectionStatistics_00000.6....#define.BytesReceived_00000.8..#define.BytesSent_00000.10..#define.PDUCommandsSent_00000.12..#define.PDUResponsesReceived_00000.14....#define.MSiSCSI_InitiatorInstanceStatistics_00001.16....#define.SessionConnectionTimeoutErrorCount_00001.18..#define.SessionDigestErrorCount_00001.20..#define.SessionFailureCount_00001.22..#define.SessionFormatErrorCount_00001.24....#define.MSiSCSI_InitiatorLoginStatistics_00002.26....#define.LoginAcceptRsps_00002.28..#define.LoginAuthenticateFails_00002.30..#define.LoginAuthFai

C:\Windows\mssecsvc.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3751936
Entropy (8bit):	5.726947076292018
Encrypted:	false
SSDEEP:	49152:BnREMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvR:lSPoBhz1aRxcSUDk36SAEdhv
MD5:	2391E0DBB3A7862306913032CE72F302
SHA1:	A92A91E847986494AFBD182D2711BC50FB02F51D
SHA-256:	55D3B4DFEC21BD0B1FDEF783FD8967654D949F4D06534E87CB8F96C91CD08436
SHA-512:	12321B2C9133887090B1762ACC2E44B9A5635A2707AB622A28BBA186D860BF3CEE98D369B69937D42AEA340327FF73A48A9E48921746550241AA06C6D3B11258
Malicious:	true
Yara Hits:	Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (with the help of binar.ly) Rule: WannaCry_Ransomware_Gen, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (based on rule by US CERT) Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\mssecsvc.exe, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\mssecsvc.exe, Author: us-cert code analysis team
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U<S..]=..]=..]=.jA1..]=.A3..]=.~B7..]=.~B6..]=.~B9..]=..R`..]=..]<.J]=.'{6..]=..[;..]=.Rich.]=.........................PE..L.....J.....................08.......f...........@..........................0g......................................................1.. 6..........................................................................................................text.............................. ..`.rdata..............................@..@.data....H0......p..................@....rsrc.... 6...1.. 6.. ..............`...lkuhvek...... g......@9.................................................................................................................................................................................................................................................................................................................................

C:\Windows\system32\wbem\Performance\WmiApRpl.h (copy)

Download File

Process:	C:\Windows\System32\wbem\WMIADAP.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3444
Entropy (8bit):	5.011954215267298
Encrypted:	false
SSDEEP:	48:ADPo+gDMIuK54DeHNg9dqbEzCJGGgGDU3XgLBgaGKFijiVJtVAAF/XRgW:ADw+gDMhK54qHC7aBvGKFijiV7XRgW
MD5:	B133A676D139032A27DE3D9619E70091
SHA1:	1248AA89938A13640252A79113930EDE2F26F1FA
SHA-256:	AE2B6236D3EEB4822835714AE9444E5DCD21BC60F7A909F2962C43BC743C7B15
SHA-512:	C6B99E13D854CE7A6874497473614EE4BD81C490802783DB1349AB851CD80D1DC06DF8C1F6E434ABA873A5BBF6125CC64104709064E19A9DC1C66DCDE3F898F5
Malicious:	false
Preview:	//////////////////////////////////////////////////////////////////////////////////////////////..//..// Copyright (C) 2000 Microsoft Corporation..//..// Module Name:..// WmiApRpl..//..// Abstract:..//..// Include file for object and counters definitions...//..//////////////////////////////////////////////////////////////////////////////////////////////......#define.WMI_Objects.0..#define.HiPerf_Classes.2..#define.HiPerf_Validity.4....#define.MSiSCSI_ConnectionStatistics_00000.6....#define.BytesReceived_00000.8..#define.BytesSent_00000.10..#define.PDUCommandsSent_00000.12..#define.PDUResponsesReceived_00000.14....#define.MSiSCSI_InitiatorInstanceStatistics_00001.16....#define.SessionConnectionTimeoutErrorCount_00001.18..#define.SessionDigestErrorCount_00001.20..#define.SessionFailureCount_00001.22..#define.SessionFormatErrorCount_00001.24....#define.MSiSCSI_InitiatorLoginStatistics_00002.26....#define.LoginAcceptRsps_00002.28..#define.LoginAuthenticateFails_00002.30..#define.LoginAuthFai

C:\Windows\tasksche.exe

Download File

Process:	C:\Windows\mssecsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2061938
Entropy (8bit):	7.993464768178038
Encrypted:	true
SSDEEP:	49152:SEMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvm:ZPoBhz1aRxcSUDk36SAEdhvm
MD5:	A0D0B20286669B4664AE1AEFFAF07A88
SHA1:	28BCAFBD85E84479B575CC1F3C5B3C39875A3A5F
SHA-256:	96D7B2D83E30FED4EEC2CBF2E1FBE426DAD705F918AE8ABBDA0DB4B4AFB82865
SHA-512:	CFF6F64549B7E2961181A041ECBFBE9C90B6B9AAB970609785FCD8A6AD69BE9915B0A6F22C3481EA4E07DC8BE3E4591FB49C551ABC22CEDA2239935ADFEC0249
Malicious:	true
Yara Hits:	Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\tasksche.exe, Author: Florian Roth (with the help of binar.ly) Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\tasksche.exe, Author: us-cert code analysis team
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 75%, Browse Antivirus: ReversingLabs, Detection: 100%
Joe Sandbox View:	Filename: 2yQ8hmXyz0.dll, Detection: malicious, Browse Filename: 4Maoj78D1f.dll, Detection: malicious, Browse Filename: 9UxtlcUBmY.dll, Detection: malicious, Browse Filename: 41ECj4EgTY.dll, Detection: malicious, Browse Filename: NANG-104355_mssecsvr.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&K.WG%.WG%.WG%.^?..LG%.^?...G%.^?..BG%.WG$.G%.^?..0G%.^?..VG%.^?..VG%.^?..VG%.RichWG%.................PE..L......U..........................................@..........................`......................................p...3............ ..(9..............................................................@............................................text.............................. ..`.rdata...P.......R..................@..@.data...(...........................@....rsrc...(9... ...:..................@..@........................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	4.370660965526769
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	UBpReASuEC.dll
File size:	5267459
MD5:	66df13c96db53128fee1997dc75cd1b9
SHA1:	96b538087dd52cdd71b753e25d3f208ad45efc1b
SHA256:	3743363b9a2845554eed086c43ee5756bd8878867b4cb0a3c0ba6f096596aa5d
SHA512:	3cc55afc2900bbe2d329f0da121251123395b178435c08c1e62bcbaec58c90b2824698a2702fe84be4f26b6b9bfc40d3b396def497c3dcbedcf5d14bae683cba
SSDEEP:	49152:onREMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvR:YSPoBhz1aRxcSUDk36SAEdhv
TLSH:	D7363399717C92FCD10529B444ABCA53B2B27C6D12FE6A0F9F4049761D03F5AFB90A43
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.r_9...9...9.......=...9...6.....A.:.......8.......8.......:...Rich9...........................PE..L...QW.Y...........!.......

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General

Entrypoint:	0x100011e9
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL
DLL Characteristics:
Time Stamp:	0x59145751 [Thu May 11 12:21:37 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2e5708ae5fed0403e8117c645fb23e5b

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push ebx
mov ebx, dword ptr [ebp+08h]
push esi
mov esi, dword ptr [ebp+0Ch]
push edi
mov edi, dword ptr [ebp+10h]
test esi, esi
jne 00007F8388BC522Bh
cmp dword ptr [10003140h], 00000000h
jmp 00007F8388BC5248h
cmp esi, 01h
je 00007F8388BC5227h
cmp esi, 02h
jne 00007F8388BC5244h
mov eax, dword ptr [10003150h]
test eax, eax
je 00007F8388BC522Bh
push edi
push esi
push ebx
call eax
test eax, eax
je 00007F8388BC522Eh
push edi
push esi
push ebx
call 00007F8388BC513Ah
test eax, eax
jne 00007F8388BC5226h
xor eax, eax
jmp 00007F8388BC5270h
push edi
push esi
push ebx
call 00007F8388BC4FECh
cmp esi, 01h
mov dword ptr [ebp+0Ch], eax
jne 00007F8388BC522Eh
test eax, eax
jne 00007F8388BC5259h
push edi
push eax
push ebx
call 00007F8388BC5116h
test esi, esi
je 00007F8388BC5227h
cmp esi, 03h
jne 00007F8388BC5248h
push edi
push esi
push ebx
call 00007F8388BC5105h
test eax, eax
jne 00007F8388BC5225h
and dword ptr [ebp+0Ch], eax
cmp dword ptr [ebp+0Ch], 00000000h
je 00007F8388BC5233h
mov eax, dword ptr [10003150h]
test eax, eax
je 00007F8388BC522Ah
push edi
push esi
push ebx
call eax
mov dword ptr [ebp+0Ch], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
pop esi
pop ebx
pop ebp
retn 000Ch
jmp dword ptr [10002028h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[ C ] VS98 (6.0) build 8168
[C++] VS98 (6.0) build 8168
[RES] VS98 (6.0) cvtres build 1720
[LNK] VS98 (6.0) imp/exp build 8168

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x2190	0x48	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x203c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x500060	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x505000	0x5c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x28c	0x1000	False	0.13037109375	data	1.4429971244731552	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2000	0x1d8	0x1000	False	0.072509765625	data	0.7346018133622799	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3000	0x154	0x1000	False	0.016845703125	data	0.085238686413312	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4000	0x500060	0x501000	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x505000	0x2ac	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
W	0x4060	0x500000	data	English	United States

Imports

DLL	Import
KERNEL32.dll	CloseHandle, WriteFile, CreateFileA, SizeofResource, LockResource, LoadResource, FindResourceA, CreateProcessA
MSVCRT.dll	free, _initterm, malloc, _adjust_fdiv, sprintf

Exports

Name	Ordinal	Address
PlayGame	1	0x10001114

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
8.8.8.8192.168.2.653620792811577 07/21/22-05:05:02.361266	UDP	2811577	ETPRO TROJAN Possible Virut DGA NXDOMAIN Responses (com)	53	62079	8.8.8.8	192.168.2.6
8.8.8.8192.168.2.653642892811577 07/21/22-05:03:37.145468	UDP	2811577	ETPRO TROJAN Possible Virut DGA NXDOMAIN Responses (com)	53	64289	8.8.8.8	192.168.2.6
8.8.8.8192.168.2.653492872811577 07/21/22-05:03:59.403745	UDP	2811577	ETPRO TROJAN Possible Virut DGA NXDOMAIN Responses (com)	53	49287	8.8.8.8	192.168.2.6
8.8.8.8192.168.2.653584682811577 07/21/22-05:04:20.247307	UDP	2811577	ETPRO TROJAN Possible Virut DGA NXDOMAIN Responses (com)	53	58468	8.8.8.8	192.168.2.6
192.168.2.68.8.8.851748532830018 07/21/22-05:00:40.717318	UDP	2830018	ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup)	51748	53	192.168.2.6	8.8.8.8
192.168.2.68.8.8.852225532830018 07/21/22-05:03:02.787279	UDP	2830018	ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup)	52225	53	192.168.2.6	8.8.8.8

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 21, 2022 05:00:40.717318058 CEST	51748	53	192.168.2.6	8.8.8.8
Jul 21, 2022 05:00:40.737085104 CEST	53	51748	8.8.8.8	192.168.2.6
Jul 21, 2022 05:02:36.417407036 CEST	53	59106	8.8.8.8	192.168.2.6
Jul 21, 2022 05:02:36.493227005 CEST	53	61113	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:02.787278891 CEST	52225	53	192.168.2.6	8.8.8.8
Jul 21, 2022 05:03:02.806766033 CEST	53	52225	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:07.751549959 CEST	53	64597	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:09.965878963 CEST	53	64150	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:10.793631077 CEST	53	64150	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:11.789839983 CEST	53	64150	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:36.460840940 CEST	53	62041	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:36.495937109 CEST	53	57669	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:36.550949097 CEST	53	57178	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:36.660929918 CEST	53	62483	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:37.145467997 CEST	53	64289	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:37.206502914 CEST	53	52328	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:37.241739035 CEST	53	58051	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:37.322237968 CEST	53	55788	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:37.353966951 CEST	53	62448	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:37.409765959 CEST	53	58563	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:37.444437027 CEST	53	64995	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:37.521945000 CEST	53	57629	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:37.556238890 CEST	53	57422	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:37.621068954 CEST	53	50453	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:37.762723923 CEST	53	55745	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:59.264153004 CEST	53	57269	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:59.293865919 CEST	53	56928	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:59.327878952 CEST	53	51645	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:59.362380981 CEST	53	65010	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:59.403744936 CEST	53	49287	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:59.440141916 CEST	53	51884	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:59.478115082 CEST	53	64442	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:59.518281937 CEST	53	56146	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:59.552108049 CEST	53	50520	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:59.580945015 CEST	53	57861	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:59.611022949 CEST	53	56845	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:59.649991035 CEST	53	52548	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:59.697968006 CEST	53	55300	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:59.732279062 CEST	53	51853	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:59.761785984 CEST	53	62417	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:59.790285110 CEST	53	62834	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:59.820902109 CEST	53	61037	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:59.861679077 CEST	53	58053	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:59.894556046 CEST	53	56031	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:59.924665928 CEST	53	58054	8.8.8.8	192.168.2.6
Jul 21, 2022 05:03:59.968715906 CEST	53	59374	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:00.006570101 CEST	53	49815	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:00.041260958 CEST	53	52277	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:01.053401947 CEST	53	52069	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:01.213428974 CEST	53	56949	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:20.124878883 CEST	53	53169	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:20.152489901 CEST	53	57179	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:20.184056044 CEST	53	55331	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:20.218264103 CEST	53	64325	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:20.247307062 CEST	53	58468	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:20.287319899 CEST	53	56984	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:20.324913979 CEST	53	51640	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:20.359482050 CEST	53	63852	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:20.389333963 CEST	53	56203	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:20.419078112 CEST	53	54570	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:20.529089928 CEST	53	56793	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:20.558710098 CEST	53	61651	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:20.585855007 CEST	53	59925	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:20.614231110 CEST	53	61236	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:20.641856909 CEST	53	55169	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:20.677270889 CEST	53	49811	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:20.714093924 CEST	53	62639	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:20.749123096 CEST	53	54945	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:20.783030987 CEST	53	59603	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:20.818799973 CEST	53	56939	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:20.862175941 CEST	53	57059	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:20.892589092 CEST	53	54647	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:20.922207117 CEST	53	58490	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:20.963897943 CEST	53	56465	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:20.994998932 CEST	53	61436	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:21.025641918 CEST	53	57048	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:21.069025993 CEST	53	54558	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:21.100743055 CEST	53	56333	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:21.127832890 CEST	53	59824	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:21.162177086 CEST	53	61328	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:32.489795923 CEST	53	59344	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:34.699992895 CEST	53	55403	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:35.507515907 CEST	53	55403	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:36.698256016 CEST	53	55403	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:41.441159964 CEST	56625	53	192.168.2.6	8.8.8.8
Jul 21, 2022 05:04:41.474972963 CEST	53	56625	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:41.476295948 CEST	52606	53	192.168.2.6	8.8.8.8
Jul 21, 2022 05:04:41.504416943 CEST	53	52606	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:41.512510061 CEST	57731	53	192.168.2.6	8.8.8.8
Jul 21, 2022 05:04:41.541178942 CEST	53	57731	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:41.547054052 CEST	49282	53	192.168.2.6	8.8.8.8
Jul 21, 2022 05:04:41.584184885 CEST	53	49282	8.8.8.8	192.168.2.6
Jul 21, 2022 05:04:41.591639042 CEST	60760	53	192.168.2.6	8.8.8.8
Jul 21, 2022 05:04:41.705638885 CEST	53	60760	8.8.8.8	192.168.2.6
Jul 21, 2022 05:05:01.722599030 CEST	64941	53	192.168.2.6	8.8.8.8
Jul 21, 2022 05:05:01.757044077 CEST	53	64941	8.8.8.8	192.168.2.6
Jul 21, 2022 05:05:01.758811951 CEST	53690	53	192.168.2.6	8.8.8.8
Jul 21, 2022 05:05:02.224889040 CEST	53	53690	8.8.8.8	192.168.2.6
Jul 21, 2022 05:05:02.229168892 CEST	62723	53	192.168.2.6	8.8.8.8
Jul 21, 2022 05:05:02.262406111 CEST	53	62723	8.8.8.8	192.168.2.6
Jul 21, 2022 05:05:02.263662100 CEST	55760	53	192.168.2.6	8.8.8.8
Jul 21, 2022 05:05:02.297456980 CEST	53	55760	8.8.8.8	192.168.2.6
Jul 21, 2022 05:05:02.298800945 CEST	65452	53	192.168.2.6	8.8.8.8
Jul 21, 2022 05:05:02.326379061 CEST	53	65452	8.8.8.8	192.168.2.6
Jul 21, 2022 05:05:02.327914953 CEST	62079	53	192.168.2.6	8.8.8.8
Jul 21, 2022 05:05:02.361265898 CEST	53	62079	8.8.8.8	192.168.2.6
Jul 21, 2022 05:05:02.362802982 CEST	51566	53	192.168.2.6	8.8.8.8
Jul 21, 2022 05:05:02.392694950 CEST	53	51566	8.8.8.8	192.168.2.6
Jul 21, 2022 05:05:02.398444891 CEST	50050	53	192.168.2.6	8.8.8.8
Jul 21, 2022 05:05:02.445231915 CEST	53	50050	8.8.8.8	192.168.2.6
Jul 21, 2022 05:05:02.447536945 CEST	59439	53	192.168.2.6	8.8.8.8
Jul 21, 2022 05:05:02.481606960 CEST	53	59439	8.8.8.8	192.168.2.6
Jul 21, 2022 05:05:02.483441114 CEST	64529	53	192.168.2.6	8.8.8.8
Jul 21, 2022 05:05:02.510925055 CEST	53	64529	8.8.8.8	192.168.2.6
Jul 21, 2022 05:05:02.513360023 CEST	56759	53	192.168.2.6	8.8.8.8
Jul 21, 2022 05:05:02.547997952 CEST	53	56759	8.8.8.8	192.168.2.6
Jul 21, 2022 05:05:02.549376965 CEST	65252	53	192.168.2.6	8.8.8.8
Jul 21, 2022 05:05:02.575488091 CEST	53	65252	8.8.8.8	192.168.2.6
Jul 21, 2022 05:05:02.576930046 CEST	65250	53	192.168.2.6	8.8.8.8
Jul 21, 2022 05:05:02.603158951 CEST	53	65250	8.8.8.8	192.168.2.6
Jul 21, 2022 05:05:02.604532957 CEST	60801	53	192.168.2.6	8.8.8.8
Jul 21, 2022 05:05:02.632193089 CEST	53	60801	8.8.8.8	192.168.2.6
Jul 21, 2022 05:05:02.633825064 CEST	60446	53	192.168.2.6	8.8.8.8
Jul 21, 2022 05:05:02.659459114 CEST	53	60446	8.8.8.8	192.168.2.6
Jul 21, 2022 05:05:02.660839081 CEST	51671	53	192.168.2.6	8.8.8.8
Jul 21, 2022 05:05:02.688256025 CEST	53	51671	8.8.8.8	192.168.2.6
Jul 21, 2022 05:05:02.689795017 CEST	50442	53	192.168.2.6	8.8.8.8
Jul 21, 2022 05:05:02.716351032 CEST	53	50442	8.8.8.8	192.168.2.6
Jul 21, 2022 05:05:02.717899084 CEST	53314	53	192.168.2.6	8.8.8.8
Jul 21, 2022 05:05:02.743705034 CEST	53	53314	8.8.8.8	192.168.2.6
Jul 21, 2022 05:05:02.745717049 CEST	61516	53	192.168.2.6	8.8.8.8
Jul 21, 2022 05:05:02.778855085 CEST	53	61516	8.8.8.8	192.168.2.6
Jul 21, 2022 05:05:02.780255079 CEST	50213	53	192.168.2.6	8.8.8.8
Jul 21, 2022 05:05:02.808152914 CEST	53	50213	8.8.8.8	192.168.2.6
Jul 21, 2022 05:05:02.810801983 CEST	61793	53	192.168.2.6	8.8.8.8
Jul 21, 2022 05:05:02.838634968 CEST	53	61793	8.8.8.8	192.168.2.6
Jul 21, 2022 05:05:02.841947079 CEST	51699	53	192.168.2.6	8.8.8.8
Jul 21, 2022 05:05:02.869591951 CEST	53	51699	8.8.8.8	192.168.2.6
Jul 21, 2022 05:05:02.871273994 CEST	64781	53	192.168.2.6	8.8.8.8
Jul 21, 2022 05:05:02.905797958 CEST	53	64781	8.8.8.8	192.168.2.6
Jul 21, 2022 05:05:02.907171965 CEST	51185	53	192.168.2.6	8.8.8.8
Jul 21, 2022 05:05:02.939260960 CEST	53	51185	8.8.8.8	192.168.2.6
Jul 21, 2022 05:05:25.797447920 CEST	53	63198	8.8.8.8	192.168.2.6
Jul 21, 2022 05:05:25.906717062 CEST	53	57158	8.8.8.8	192.168.2.6

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jul 21, 2022 05:03:10.793848991 CEST	192.168.2.6	8.8.8.8	cff1	(Port unreachable)	Destination Unreachable
Jul 21, 2022 05:03:11.789988041 CEST	192.168.2.6	8.8.8.8	cff1	(Port unreachable)	Destination Unreachable
Jul 21, 2022 05:04:35.507611990 CEST	192.168.2.6	8.8.8.8	cff1	(Port unreachable)	Destination Unreachable
Jul 21, 2022 05:04:36.698510885 CEST	192.168.2.6	8.8.8.8	cff1	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jul 21, 2022 05:00:40.717318058 CEST	192.168.2.6	8.8.8.8	0x2249	Standard query (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:02.787278891 CEST	192.168.2.6	8.8.8.8	0xff6a	Standard query (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:41.441159964 CEST	192.168.2.6	8.8.8.8	0xef79	Standard query (0)	eetebu.com	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:41.476295948 CEST	192.168.2.6	8.8.8.8	0xf616	Standard query (0)	ufmuub.com	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:41.512510061 CEST	192.168.2.6	8.8.8.8	0x443e	Standard query (0)	euxngi.com	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:41.547054052 CEST	192.168.2.6	8.8.8.8	0xe7c4	Standard query (0)	auyazv.com	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:41.591639042 CEST	192.168.2.6	8.8.8.8	0x5e57	Standard query (0)	hiapba.com	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:01.722599030 CEST	192.168.2.6	8.8.8.8	0x7ac6	Standard query (0)	iqzvcy.com	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:01.758811951 CEST	192.168.2.6	8.8.8.8	0x2856	Standard query (0)	yuyuol.com	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.229168892 CEST	192.168.2.6	8.8.8.8	0xcd61	Standard query (0)	mlgjto.com	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.263662100 CEST	192.168.2.6	8.8.8.8	0x62a9	Standard query (0)	muyuou.com	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.298800945 CEST	192.168.2.6	8.8.8.8	0xc93b	Standard query (0)	ihfjtf.com	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.327914953 CEST	192.168.2.6	8.8.8.8	0x38d4	Standard query (0)	jueuby.com	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.362802982 CEST	192.168.2.6	8.8.8.8	0xb0e0	Standard query (0)	oivayb.com	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.398444891 CEST	192.168.2.6	8.8.8.8	0xc093	Standard query (0)	easecy.com	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.447536945 CEST	192.168.2.6	8.8.8.8	0xc85e	Standard query (0)	mlsjzu.com	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.483441114 CEST	192.168.2.6	8.8.8.8	0xeae5	Standard query (0)	oqiqee.com	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.513360023 CEST	192.168.2.6	8.8.8.8	0x5772	Standard query (0)	rmdyox.com	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.549376965 CEST	192.168.2.6	8.8.8.8	0xa768	Standard query (0)	jkjztp.com	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.576930046 CEST	192.168.2.6	8.8.8.8	0x2eee	Standard query (0)	jyruxe.com	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.604532957 CEST	192.168.2.6	8.8.8.8	0xb18c	Standard query (0)	bswdic.com	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.633825064 CEST	192.168.2.6	8.8.8.8	0x2e31	Standard query (0)	shyykl.com	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.660839081 CEST	192.168.2.6	8.8.8.8	0x8a75	Standard query (0)	ylyguq.com	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.689795017 CEST	192.168.2.6	8.8.8.8	0xa9a8	Standard query (0)	iietwy.com	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.717899084 CEST	192.168.2.6	8.8.8.8	0x18cc	Standard query (0)	ovalzq.com	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.745717049 CEST	192.168.2.6	8.8.8.8	0x56e6	Standard query (0)	kymlxf.com	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.780255079 CEST	192.168.2.6	8.8.8.8	0xbaec	Standard query (0)	zwstuy.com	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.810801983 CEST	192.168.2.6	8.8.8.8	0x64f	Standard query (0)	qxuyel.com	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.841947079 CEST	192.168.2.6	8.8.8.8	0x1ad2	Standard query (0)	nuejea.com	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.871273994 CEST	192.168.2.6	8.8.8.8	0x93c4	Standard query (0)	ytyepn.com	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.907171965 CEST	192.168.2.6	8.8.8.8	0xaab6	Standard query (0)	pfdpty.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jul 21, 2022 05:00:40.737085104 CEST	8.8.8.8	192.168.2.6	0x2249	Server failure (2)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:01:11.055315971 CEST	8.8.8.8	192.168.2.6	0x19fa	No error (0)	www-bing-com.dual-a-0001.a-msedge.net	dual-a-0001.a-msedge.net		CNAME (Canonical name)	IN (0x0001)
Jul 21, 2022 05:01:11.055315971 CEST	8.8.8.8	192.168.2.6	0x19fa	No error (0)	dual-a-0001.a-msedge.net		204.79.197.200	A (IP address)	IN (0x0001)
Jul 21, 2022 05:01:11.055315971 CEST	8.8.8.8	192.168.2.6	0x19fa	No error (0)	dual-a-0001.a-msedge.net		13.107.21.200	A (IP address)	IN (0x0001)
Jul 21, 2022 05:02:36.417407036 CEST	8.8.8.8	192.168.2.6	0x60e9	Name error (3)	src.gide.at	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:02:36.493227005 CEST	8.8.8.8	192.168.2.6	0x607c	Name error (3)	ww.ziten.ru	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:02.806766033 CEST	8.8.8.8	192.168.2.6	0xff6a	Server failure (2)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:07.751549959 CEST	8.8.8.8	192.168.2.6	0x409e	Name error (3)	kto.gind.at	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:09.965878963 CEST	8.8.8.8	192.168.2.6	0x146a	Server failure (2)	lnn.maft.at	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:10.793631077 CEST	8.8.8.8	192.168.2.6	0x146a	Server failure (2)	lnn.maft.at	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:11.789839983 CEST	8.8.8.8	192.168.2.6	0x146a	Server failure (2)	lnn.maft.at	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:36.460840940 CEST	8.8.8.8	192.168.2.6	0xf8f0	Name error (3)	agrwiq.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:36.495937109 CEST	8.8.8.8	192.168.2.6	0xa73b	Name error (3)	bnylmd.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:36.550949097 CEST	8.8.8.8	192.168.2.6	0x29c	Name error (3)	wofqss.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:36.660929918 CEST	8.8.8.8	192.168.2.6	0x6af	Name error (3)	akiypc.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:37.145467997 CEST	8.8.8.8	192.168.2.6	0xc064	Name error (3)	mjrztu.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:37.206502914 CEST	8.8.8.8	192.168.2.6	0xda11	Name error (3)	knajpk.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:37.241739035 CEST	8.8.8.8	192.168.2.6	0x6e97	Name error (3)	oyebru.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:37.322237968 CEST	8.8.8.8	192.168.2.6	0x6e9c	Name error (3)	voirue.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:37.353966951 CEST	8.8.8.8	192.168.2.6	0xae4d	Name error (3)	ovlicu.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:37.409765959 CEST	8.8.8.8	192.168.2.6	0x37d8	Name error (3)	qsyrmp.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:37.444437027 CEST	8.8.8.8	192.168.2.6	0xf156	Name error (3)	gvkzcm.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:37.521945000 CEST	8.8.8.8	192.168.2.6	0x64d6	Name error (3)	oirlzx.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:37.556238890 CEST	8.8.8.8	192.168.2.6	0x3d62	Name error (3)	kqmkgp.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:37.621068954 CEST	8.8.8.8	192.168.2.6	0x2c4f	Name error (3)	anyqaz.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:37.762723923 CEST	8.8.8.8	192.168.2.6	0xf514	Name error (3)	haqipv.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:59.264153004 CEST	8.8.8.8	192.168.2.6	0x254f	Name error (3)	flpuej.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:59.293865919 CEST	8.8.8.8	192.168.2.6	0x381c	Name error (3)	mwhmpz.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:59.327878952 CEST	8.8.8.8	192.168.2.6	0x840b	Name error (3)	yxdidf.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:59.362380981 CEST	8.8.8.8	192.168.2.6	0xf360	Name error (3)	edbeos.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:59.403744936 CEST	8.8.8.8	192.168.2.6	0xe154	Name error (3)	oletfa.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:59.440141916 CEST	8.8.8.8	192.168.2.6	0xa8a5	Name error (3)	qrmrxa.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:59.478115082 CEST	8.8.8.8	192.168.2.6	0x16c8	Name error (3)	edmwpe.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:59.518281937 CEST	8.8.8.8	192.168.2.6	0xd837	Name error (3)	cjebbx.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:59.552108049 CEST	8.8.8.8	192.168.2.6	0xe775	Name error (3)	zeufbm.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:59.580945015 CEST	8.8.8.8	192.168.2.6	0x97bb	Name error (3)	qsuuox.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:59.611022949 CEST	8.8.8.8	192.168.2.6	0x2d9e	Name error (3)	dhmqvm.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:59.649991035 CEST	8.8.8.8	192.168.2.6	0x6abc	Name error (3)	auowel.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:59.697968006 CEST	8.8.8.8	192.168.2.6	0xc4b5	Name error (3)	mbbaux.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:59.732279062 CEST	8.8.8.8	192.168.2.6	0xa484	Name error (3)	tpoxvi.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:59.761785984 CEST	8.8.8.8	192.168.2.6	0x3109	Name error (3)	vqzvfi.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:59.790285110 CEST	8.8.8.8	192.168.2.6	0xbee3	Name error (3)	qfsper.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:59.820902109 CEST	8.8.8.8	192.168.2.6	0xa1e	Name error (3)	akelqu.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:59.861679077 CEST	8.8.8.8	192.168.2.6	0x74f8	Name error (3)	yfgraf.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:59.894556046 CEST	8.8.8.8	192.168.2.6	0x2c55	Name error (3)	uwyrsy.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:59.924665928 CEST	8.8.8.8	192.168.2.6	0x7288	Name error (3)	hoqayg.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:03:59.968715906 CEST	8.8.8.8	192.168.2.6	0xe7f6	Name error (3)	odivfj.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:00.006570101 CEST	8.8.8.8	192.168.2.6	0x5a60	Name error (3)	mjdvvw.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:00.041260958 CEST	8.8.8.8	192.168.2.6	0xb078	Name error (3)	pfntvw.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:01.053401947 CEST	8.8.8.8	192.168.2.6	0x5ddc	Name error (3)	src.gide.at	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:01.213428974 CEST	8.8.8.8	192.168.2.6	0x7ef6	Name error (3)	ww.ziten.ru	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:20.124878883 CEST	8.8.8.8	192.168.2.6	0xe568	Name error (3)	nkewuc.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:20.152489901 CEST	8.8.8.8	192.168.2.6	0xce79	Name error (3)	wkedxi.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:20.184056044 CEST	8.8.8.8	192.168.2.6	0xf953	Name error (3)	julanu.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:20.218264103 CEST	8.8.8.8	192.168.2.6	0xedc8	Name error (3)	lntyhe.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:20.247307062 CEST	8.8.8.8	192.168.2.6	0xa072	Name error (3)	vusvyj.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:20.287319899 CEST	8.8.8.8	192.168.2.6	0x4a85	Name error (3)	pniyeh.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:20.324913979 CEST	8.8.8.8	192.168.2.6	0x8a0d	Name error (3)	pgmuok.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:20.359482050 CEST	8.8.8.8	192.168.2.6	0x3091	Name error (3)	skpqjl.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:20.389333963 CEST	8.8.8.8	192.168.2.6	0xc317	Name error (3)	oevgnn.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:20.419078112 CEST	8.8.8.8	192.168.2.6	0x3a1	Name error (3)	unuyas.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:20.529089928 CEST	8.8.8.8	192.168.2.6	0xb9e3	Name error (3)	ohqasc.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:20.558710098 CEST	8.8.8.8	192.168.2.6	0x51fa	Name error (3)	oyadis.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:20.585855007 CEST	8.8.8.8	192.168.2.6	0xd32e	Name error (3)	akufuf.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:20.614231110 CEST	8.8.8.8	192.168.2.6	0xd780	Name error (3)	yexisu.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:20.641856909 CEST	8.8.8.8	192.168.2.6	0x47c6	Name error (3)	nrwwej.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:20.677270889 CEST	8.8.8.8	192.168.2.6	0x8b13	Name error (3)	pxzoao.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:20.714093924 CEST	8.8.8.8	192.168.2.6	0x97dc	Name error (3)	iooaai.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:20.749123096 CEST	8.8.8.8	192.168.2.6	0xbe6d	Name error (3)	vaaoff.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:20.783030987 CEST	8.8.8.8	192.168.2.6	0x482	Name error (3)	uptrqo.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:20.818799973 CEST	8.8.8.8	192.168.2.6	0x83a	Name error (3)	usecvu.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:20.862175941 CEST	8.8.8.8	192.168.2.6	0x11c	Name error (3)	eixjei.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:20.892589092 CEST	8.8.8.8	192.168.2.6	0x72f5	Name error (3)	yfobli.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:20.922207117 CEST	8.8.8.8	192.168.2.6	0x7656	Name error (3)	weuanq.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:20.963897943 CEST	8.8.8.8	192.168.2.6	0x63c2	Name error (3)	dzwrvg.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:20.994998932 CEST	8.8.8.8	192.168.2.6	0x1328	Name error (3)	bhhhpq.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:21.025641918 CEST	8.8.8.8	192.168.2.6	0x21d7	Name error (3)	yldizc.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:21.069025993 CEST	8.8.8.8	192.168.2.6	0x6190	Name error (3)	aueolp.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:21.100743055 CEST	8.8.8.8	192.168.2.6	0x9f79	Name error (3)	raniod.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:21.127832890 CEST	8.8.8.8	192.168.2.6	0x24e9	Name error (3)	guseek.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:21.162177086 CEST	8.8.8.8	192.168.2.6	0x5beb	Name error (3)	vvwxii.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:32.489795923 CEST	8.8.8.8	192.168.2.6	0x1167	Name error (3)	kto.gind.at	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:34.699992895 CEST	8.8.8.8	192.168.2.6	0xff6	Server failure (2)	lnn.maft.at	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:35.507515907 CEST	8.8.8.8	192.168.2.6	0xff6	Server failure (2)	lnn.maft.at	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:36.698256016 CEST	8.8.8.8	192.168.2.6	0xff6	Server failure (2)	lnn.maft.at	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:41.474972963 CEST	8.8.8.8	192.168.2.6	0xef79	Name error (3)	eetebu.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:41.504416943 CEST	8.8.8.8	192.168.2.6	0xf616	Name error (3)	ufmuub.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:41.541178942 CEST	8.8.8.8	192.168.2.6	0x443e	Name error (3)	euxngi.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:41.584184885 CEST	8.8.8.8	192.168.2.6	0xe7c4	Name error (3)	auyazv.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:41.705638885 CEST	8.8.8.8	192.168.2.6	0x5e57	No error (0)	hiapba.com	traff-2.hugedomains.com		CNAME (Canonical name)	IN (0x0001)
Jul 21, 2022 05:04:41.705638885 CEST	8.8.8.8	192.168.2.6	0x5e57	No error (0)	traff-2.hugedomains.com	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jul 21, 2022 05:04:41.705638885 CEST	8.8.8.8	192.168.2.6	0x5e57	No error (0)	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		3.130.204.160	A (IP address)	IN (0x0001)
Jul 21, 2022 05:04:41.705638885 CEST	8.8.8.8	192.168.2.6	0x5e57	No error (0)	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		3.130.253.23	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:01.757044077 CEST	8.8.8.8	192.168.2.6	0x7ac6	Name error (3)	iqzvcy.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.262406111 CEST	8.8.8.8	192.168.2.6	0xcd61	Name error (3)	mlgjto.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.297456980 CEST	8.8.8.8	192.168.2.6	0x62a9	Name error (3)	muyuou.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.326379061 CEST	8.8.8.8	192.168.2.6	0xc93b	Name error (3)	ihfjtf.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.361265898 CEST	8.8.8.8	192.168.2.6	0x38d4	Name error (3)	jueuby.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.392694950 CEST	8.8.8.8	192.168.2.6	0xb0e0	Name error (3)	oivayb.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.445231915 CEST	8.8.8.8	192.168.2.6	0xc093	Name error (3)	easecy.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.481606960 CEST	8.8.8.8	192.168.2.6	0xc85e	Name error (3)	mlsjzu.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.510925055 CEST	8.8.8.8	192.168.2.6	0xeae5	Name error (3)	oqiqee.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.547997952 CEST	8.8.8.8	192.168.2.6	0x5772	Name error (3)	rmdyox.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.575488091 CEST	8.8.8.8	192.168.2.6	0xa768	Name error (3)	jkjztp.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.603158951 CEST	8.8.8.8	192.168.2.6	0x2eee	Name error (3)	jyruxe.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.632193089 CEST	8.8.8.8	192.168.2.6	0xb18c	Name error (3)	bswdic.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.659459114 CEST	8.8.8.8	192.168.2.6	0x2e31	Name error (3)	shyykl.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.688256025 CEST	8.8.8.8	192.168.2.6	0x8a75	Name error (3)	ylyguq.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.716351032 CEST	8.8.8.8	192.168.2.6	0xa9a8	Name error (3)	iietwy.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.743705034 CEST	8.8.8.8	192.168.2.6	0x18cc	Name error (3)	ovalzq.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.778855085 CEST	8.8.8.8	192.168.2.6	0x56e6	Name error (3)	kymlxf.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.808152914 CEST	8.8.8.8	192.168.2.6	0xbaec	Name error (3)	zwstuy.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.838634968 CEST	8.8.8.8	192.168.2.6	0x64f	Name error (3)	qxuyel.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.869591951 CEST	8.8.8.8	192.168.2.6	0x1ad2	Name error (3)	nuejea.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.905797958 CEST	8.8.8.8	192.168.2.6	0x93c4	Name error (3)	ytyepn.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:02.939260960 CEST	8.8.8.8	192.168.2.6	0xaab6	Name error (3)	pfdpty.com	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:25.797447920 CEST	8.8.8.8	192.168.2.6	0x85b7	Name error (3)	src.gide.at	none	none	A (IP address)	IN (0x0001)
Jul 21, 2022 05:05:25.906717062 CEST	8.8.8.8	192.168.2.6	0x6afc	Name error (3)	ww.ziten.ru	none	none	A (IP address)	IN (0x0001)

Target ID:	0
Start time:	05:00:30
Start date:	21/07/2022
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\UBpReASuEC.dll"
Imagebase:	0x920000
File size:	116736 bytes
MD5 hash:	7DEB5DB86C0AC789123DEC286286B938
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	1
Start time:	05:00:31
Start date:	21/07/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\UBpReASuEC.dll",#1
Imagebase:	0xed0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	2
Start time:	05:00:31
Start date:	21/07/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\UBpReASuEC.dll,PlayGame
Imagebase:	0xef0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	3
Start time:	05:00:31
Start date:	21/07/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\UBpReASuEC.dll",#1
Imagebase:	0xef0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	4
Start time:	05:00:33
Start date:	21/07/2022
Path:	C:\Windows\mssecsvc.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvc.exe
Imagebase:	0x400000
File size:	3751936 bytes
MD5 hash:	2391E0DBB3A7862306913032CE72F302
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.390692739.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000002.712940908.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000004.00000000.390830304.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000004.00000000.395187719.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.392189177.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000004.00000000.392372689.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.396523616.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.395038973.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000004.00000002.713109877.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000004.00000000.396673500.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (with the help of binar.ly) Rule: WannaCry_Ransomware_Gen, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (based on rule by US CERT) Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\mssecsvc.exe, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\mssecsvc.exe, Author: us-cert code analysis team
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low

Show Windows behavior

Target ID:	5
Start time:	05:00:35
Start date:	21/07/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\UBpReASuEC.dll",PlayGame
Imagebase:	0xef0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	6
Start time:	05:00:36
Start date:	21/07/2022
Path:	C:\Windows\mssecsvc.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvc.exe
Imagebase:	0x400000
File size:	3751936 bytes
MD5 hash:	2391E0DBB3A7862306913032CE72F302
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.395643051.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.400396194.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000006.00000000.398897193.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000006.00000000.397658913.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000006.00000000.400479545.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000006.00000000.395761146.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.398730935.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.397443595.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000002.470437987.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000006.00000002.470687764.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team

Show Windows behavior

Target ID:	7
Start time:	05:00:38
Start date:	21/07/2022
Path:	C:\Windows\System32\winlogon.exe
Wow64 process (32bit):	false
Commandline:	winlogon.exe
Imagebase:	0x7ff7addb0000
File size:	677376 bytes
MD5 hash:	F9017F2DC455AD373DF036F5817A8870
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	9
Start time:	05:00:40
Start date:	21/07/2022
Path:	C:\Windows\mssecsvc.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvc.exe -m security
Imagebase:	0x400000
File size:	3751936 bytes
MD5 hash:	2391E0DBB3A7862306913032CE72F302
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000009.00000000.403899564.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000009.00000002.517302066.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000009.00000002.517693947.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000009.00000000.403788291.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security

Show Windows behavior

Target ID:	10
Start time:	05:00:40
Start date:	21/07/2022
Path:	C:\Windows\System32\lsass.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\lsass.exe
Imagebase:	0x7ff698380000
File size:	57976 bytes
MD5 hash:	317340CD278A374BCEF6A30194557227
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	12
Start time:	05:00:43
Start date:	21/07/2022
Path:	C:\Windows\System32\fontdrvhost.exe
Wow64 process (32bit):	false
Commandline:	fontdrvhost.exe
Imagebase:	0x7ff729420000
File size:	790304 bytes
MD5 hash:	31113981180E69C2773BCADA4051738A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	14
Start time:	05:00:44
Start date:	21/07/2022
Path:	C:\Windows\System32\fontdrvhost.exe
Wow64 process (32bit):	false
Commandline:	fontdrvhost.exe
Imagebase:	0x7ff729420000
File size:	790304 bytes
MD5 hash:	31113981180E69C2773BCADA4051738A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	17
Start time:	05:00:50
Start date:	21/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k dcomlaunch -p -s PlugPlay
Imagebase:	0x7ff726010000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	18
Start time:	05:00:51
Start date:	21/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p
Imagebase:	0x7ff726010000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	19
Start time:	05:00:57
Start date:	21/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k rpcss -p
Imagebase:	0x7ff726010000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	20
Start time:	05:01:00
Start date:	21/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k dcomlaunch -p -s LSM
Imagebase:	0x7ff726010000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	21
Start time:	05:01:01
Start date:	21/07/2022
Path:	C:\Windows\System32\dwm.exe
Wow64 process (32bit):	false
Commandline:	dwm.exe
Imagebase:	0x7ff769df0000
File size:	62464 bytes
MD5 hash:	70073A05B2B43FFB7A625708BB29E7C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	22
Start time:	05:01:05
Start date:	21/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff726010000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	23
Start time:	05:01:10
Start date:	21/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff726010000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	24
Start time:	05:01:10
Start date:	21/07/2022
Path:	C:\Windows\System32\backgroundTaskHost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca
Imagebase:	0x7ff783d30000
File size:	19352 bytes
MD5 hash:	B7FC4A29431D4F795BBAB1FB182B759A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	25
Start time:	05:01:27
Start date:	21/07/2022
Path:	C:\Windows\System32\BackgroundTransferHost.exe
Wow64 process (32bit):	false
Commandline:	"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
Imagebase:	0x7ff6536a0000
File size:	36864 bytes
MD5 hash:	02BA81746B929ECC9DB6665589B68335
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	26
Start time:	05:01:33
Start date:	21/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k netsvcs -p -s gpsvc
Imagebase:	0x7ff726010000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	27
Start time:	05:01:36
Start date:	21/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
Imagebase:	0x7ff726010000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	28
Start time:	05:01:41
Start date:	21/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s lmhosts
Imagebase:	0x7ff726010000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	29
Start time:	05:01:42
Start date:	21/07/2022
Path:	C:\Windows\System32\BackgroundTransferHost.exe
Wow64 process (32bit):	false
Commandline:	"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
Imagebase:	0x7ff6536a0000
File size:	36864 bytes
MD5 hash:	02BA81746B929ECC9DB6665589B68335
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	30
Start time:	05:01:42
Start date:	21/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k netsvcs -p -s Schedule
Imagebase:	0x7ff726010000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	31
Start time:	05:01:46
Start date:	21/07/2022
Path:	C:\Windows\System32\wbem\WMIADAP.exe
Wow64 process (32bit):	false
Commandline:	wmiadap.exe /F /T /R
Imagebase:	0x7ff633440000
File size:	177664 bytes
MD5 hash:	9783D0765F31980950445DFD40DB15DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	32
Start time:	05:01:47
Start date:	21/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff726010000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	33
Start time:	05:01:48
Start date:	21/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s TimeBrokerSvc
Imagebase:	0x7ff726010000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	34
Start time:	05:01:49
Start date:	21/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
Imagebase:	0x7ff726010000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	35
Start time:	05:01:51
Start date:	21/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k netsvcs -p -s UserManager
Imagebase:	0x7ff726010000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	37
Start time:	05:01:57
Start date:	21/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s EventLog
Imagebase:	0x7ff726010000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	38
Start time:	05:02:08
Start date:	21/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservice -p -s EventSystem
Imagebase:	0x7ff726010000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	39
Start time:	05:02:09
Start date:	21/07/2022
Path:	C:\Windows\System32\backgroundTaskHost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXv783p9dqgsc3mek8m05c3tj95wa9p858.mca
Imagebase:	0x7ff783d30000
File size:	19352 bytes
MD5 hash:	B7FC4A29431D4F795BBAB1FB182B759A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	40
Start time:	05:02:15
Start date:	21/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff726010000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	41
Start time:	05:02:16
Start date:	21/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k netsvcs -p -s Themes
Imagebase:	0x7ff726010000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	63.3%
Total number of Nodes:	622
Total number of Limit Nodes:	2

Executed Functions

Function 00BD042D Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 288
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 00BD04BE
GetVersion.KERNEL32 ref: 00BD0500
VirtualAlloc.KERNEL32(00000000,00007700,08001000,00000040), ref: 00BD0528
FindCloseChangeNotification.KERNELBASE(?), ref: 00BD05AD

Strings

\BaseNamedObjects\rgltVt, xrefs: 00BD0709, 00BD072C, 00BD073A
csrs, xrefs: 00BD082C
\BaseNamedObjects\rgltVt, xrefs: 00BD0708

Memory Dump Source

Source File: 00000004.00000002.714310186.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_mssecsvc.jbxd

Similarity

API ID: AllocChangeCloseFindHandleModuleNotificationVersionVirtual
String ID: \BaseNamedObjects\rgltVt$\BaseNamedObjects\rgltVt$csrs
API String ID: 2920002527-2534361129
Opcode ID: 1c9046a76cd4f9cc91b46eb41cc31d523b20a60f6ceb114047097b2d910fbad8
Instruction ID: f4f24aa57a66110a462c12d79527a1b9f1471ef7a56a2ee25242dfca5079a70c
Opcode Fuzzy Hash: 1c9046a76cd4f9cc91b46eb41cc31d523b20a60f6ceb114047097b2d910fbad8
Instruction Fuzzy Hash: 73B1D031514249FFEB21AF20C849BAA7BE9EF45314F10016AFD089E281E7F19F45DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00BD05F2 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 193
stringnativeprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00BD05AD
GetModuleHandleA.KERNEL32(00BD05EC), ref: 00BD05F2
lstrcpyW.KERNEL32(\BaseNamedObjects\rgltVt,\BaseNamedObjects\rgltVt), ref: 00BD070A
lstrcpyW.KERNEL32(\BaseNamedObjects\rgltVt,?), ref: 00BD072D
lstrcatW.KERNEL32(\BaseNamedObjects\rgltVt,\rgltVt), ref: 00BD073B
NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,00007700,00000000,?,00000002,00000000,00000040), ref: 00BD076B
NtOpenProcessToken.NTDLL(000000FF,00000020), ref: 00BD0786
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00BD07C9
Process32First.KERNEL32 ref: 00BD07DC
Process32Next.KERNEL32 ref: 00BD07ED
OpenProcess.KERNEL32(0000002A,00000000,?,?,?,?,?,?,00000002,00000000,00000040,00000000,00007700), ref: 00BD0805
CreateRemoteThread.KERNELBASE(?,00000000,00000000,-00003BD0,00000002,00000000), ref: 00BD0842
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,00000002,00000000,00000040,00000000,00007700), ref: 00BD085D
FindCloseChangeNotification.KERNELBASE ref: 00BD086C

Strings

\BaseNamedObjects\rgltVt, xrefs: 00BD0709, 00BD072C, 00BD073A
csrs, xrefs: 00BD082C
\BaseNamedObjects\rgltVt, xrefs: 00BD0708

Memory Dump Source

Source File: 00000004.00000002.714310186.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_mssecsvc.jbxd

Similarity

API ID: ChangeCloseFindNotification$CreateOpenProcessProcess32lstrcpy$FirstHandleModuleNextRemoteSectionSnapshotThreadTokenToolhelp32Viewlstrcat
String ID: \BaseNamedObjects\rgltVt$\BaseNamedObjects\rgltVt$csrs
API String ID: 3804105423-2534361129
Opcode ID: 17150f67079a076ac3b54c180adee95029a37e06bb0e30beb99ad34a9de5a8e6
Instruction ID: 378d3725de3f4262408533c668a57e1d76649311e22e62a34b3935d3fba3e8a9
Opcode Fuzzy Hash: 17150f67079a076ac3b54c180adee95029a37e06bb0e30beb99ad34a9de5a8e6
Instruction Fuzzy Hash: 5571CD31210205FFDB21AF10C849BAE7BADEF55315F0400AAFD099E291E7B1AF45EB59

Uniqueness

Uniqueness Score: -1.00%

Function 00BD116F Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 323
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(00BD1162,00BD0796,00000000,00007700,00000000,?,00000002,00000000,00000040,00000000,00007700), ref: 00BD116F

Part of subcall function 00BD1196: GetProcAddress.KERNEL32(00000000,00BD1180), ref: 00BD1197

Strings

\rgltVt, xrefs: 00BD11C6

Memory Dump Source

Source File: 00000004.00000002.714310186.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_mssecsvc.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: \rgltVt
API String ID: 2574300362-2371919082
Opcode ID: 6b25eae9ee9b83da6e5f8c056e2c57b87ce23cad4183cb8f8d95ab1501d07893
Instruction ID: 1eb82352ea9b6f0e023c1ded0a03b72e24f984fe0b017eaf1e62264d773c39ff
Opcode Fuzzy Hash: 6b25eae9ee9b83da6e5f8c056e2c57b87ce23cad4183cb8f8d95ab1501d07893
Instruction Fuzzy Hash: B3814861C1D2827EC735AA7C48454ADFFE6EA2276070C5EDFC4B59BB53F2228D038649

Uniqueness

Uniqueness Score: -1.00%

Function 00BD252F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtOpenSection.NTDLL(?,0000000E), ref: 00BD255E

Strings

\BaseNamedObjects\rgltVt, xrefs: 00BD254B

Memory Dump Source

Source File: 00000004.00000002.714310186.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_mssecsvc.jbxd

Similarity

API ID: OpenSection
String ID: \BaseNamedObjects\rgltVt
API String ID: 1950954290-2940223550
Opcode ID: d78bf25e7d60e3ca5bd26387aae6e314818fabfb1d4b2e27edbc6fd945c633ca
Instruction ID: be79e926c7ba3cdd2c7dd474d1815d54d5159c487d34c6ebacd093897ac0aaf8
Opcode Fuzzy Hash: d78bf25e7d60e3ca5bd26387aae6e314818fabfb1d4b2e27edbc6fd945c633ca
Instruction Fuzzy Hash: 75E09AF17402063AFB288A29CC17FA7228DCB80602F0C8604F918DA080E5B4AB108268

Uniqueness

Uniqueness Score: -1.00%

Function 00BD2574 Relevance: 3.1, APIs: 2, Instructions: 66
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BD252F: NtOpenSection.NTDLL(?,0000000E), ref: 00BD255E

NtMapViewOfSection.NTDLL(00000000,?,?,00000000,0000B700,00000000,?,00000002,00100000,00000040), ref: 00BD25A4
FindCloseChangeNotification.KERNELBASE(00000000,0000B700,00000000,?,00000002,00100000,00000040,00000000,0000B700,00000000,?,00BD0815), ref: 00BD25AC

Memory Dump Source

Source File: 00000004.00000002.714310186.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_mssecsvc.jbxd

Similarity

API ID: Section$ChangeCloseFindNotificationOpenView
String ID:
API String ID: 1694706092-0
Opcode ID: 7bef6bf2a50047ffc7f3cd4018dfe575c0559d17770fc5c6e4c634ed419af6cd
Instruction ID: fba7564c955865994041103534af4fbb5dca34036aa4610135b8a96514dca663
Opcode Fuzzy Hash: 7bef6bf2a50047ffc7f3cd4018dfe575c0559d17770fc5c6e4c634ed419af6cd
Instruction Fuzzy Hash: F2218370300685ABDB24DF25DC56FA9B3A9FFA0744F404159F9198F394EBB1AE10CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00BD1422 Relevance: 3.0, APIs: 2, Instructions: 38
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 00BD145A
NtAdjustPrivilegesToken.NTDLL(?,?,00000000,?), ref: 00BD146A

Memory Dump Source

Source File: 00000004.00000002.714310186.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_mssecsvc.jbxd

Similarity

API ID: AdjustLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 3615134276-0
Opcode ID: cc86f677ff09b61866951c90db79301e57ffd1e2cff1b35255cc9d89dc5b2434
Instruction ID: d6f38f481fcad269b120698a2c1356ff37e0dff7a02be2eff211d383f83c851a
Opcode Fuzzy Hash: cc86f677ff09b61866951c90db79301e57ffd1e2cff1b35255cc9d89dc5b2434
Instruction Fuzzy Hash: F8F0E932542010BBD6201B42CC8EED73E28EF533A0F040455F4484E151C2624BA1D3F4

Uniqueness

Uniqueness Score: -1.00%

Function 00BD2477 Relevance: 3.0, APIs: 2, Instructions: 25
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,00000040), ref: 00BD249B
NtWriteVirtualMemory.NTDLL ref: 00BD24A4

Memory Dump Source

Source File: 00000004.00000002.714310186.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_mssecsvc.jbxd

Similarity

API ID: MemoryVirtual$ProtectWrite
String ID:
API String ID: 151266762-0
Opcode ID: 3b89ad314080acfcfa5e752e4380cd5b7e8fc3aa7940f56e0bfe36a9f1ccff9c
Instruction ID: 6bbb67ea70d6ee96dfa5f1d7b4d314b28acc786a60d934acbd3f762ecc45b662
Opcode Fuzzy Hash: 3b89ad314080acfcfa5e752e4380cd5b7e8fc3aa7940f56e0bfe36a9f1ccff9c
Instruction Fuzzy Hash: 2AE012E07502007FF5185F55DC5FF7B391DDB41751F410208FA0A981C4F9A15E18467A

Uniqueness

Uniqueness Score: -1.00%

Function 00BD144A Relevance: 3.0, APIs: 2, Instructions: 22
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 00BD145A
NtAdjustPrivilegesToken.NTDLL(?,?,00000000,?), ref: 00BD146A

Memory Dump Source

Source File: 00000004.00000002.714310186.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_mssecsvc.jbxd

Similarity

API ID: AdjustLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 3615134276-0
Opcode ID: 516db6a43922e3348a8f3b60dc7b7b81588e67f26302b6e21a5b03875f902ac7
Instruction ID: 47fd2fdfef69c01f2383a78087d1294dd7e4f4bd71475d1ca0affc6c0d2f20e2
Opcode Fuzzy Hash: 516db6a43922e3348a8f3b60dc7b7b81588e67f26302b6e21a5b03875f902ac7
Instruction Fuzzy Hash: 1BD06771643034BBD6312A568C0EEE77D1DEF577A0F015441F9089A1A1C5A28EA1C6F5

Uniqueness

Uniqueness Score: -1.00%

Function 00BD07AC Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 62
processthreadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BD144A: LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 00BD145A
Part of subcall function 00BD144A: NtAdjustPrivilegesToken.NTDLL(?,?,00000000,?), ref: 00BD146A

FindCloseChangeNotification.KERNELBASE(?), ref: 00BD05AD
FreeLibrary.KERNEL32(76DF0000,?,00BD079B,00000000,00007700,00000000,?,00000002,00000000,00000040,00000000,00007700), ref: 00BD07B8
FindCloseChangeNotification.KERNELBASE(?,?,00BD079B,00000000,00007700,00000000,?,00000002,00000000,00000040,00000000,00007700), ref: 00BD07BF
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00BD07C9
Process32First.KERNEL32 ref: 00BD07DC
Process32Next.KERNEL32 ref: 00BD07ED
OpenProcess.KERNEL32(0000002A,00000000,?,?,?,?,?,?,00000002,00000000,00000040,00000000,00007700), ref: 00BD0805
CreateRemoteThread.KERNELBASE(?,00000000,00000000,-00003BD0,00000002,00000000), ref: 00BD0842
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,00000002,00000000,00000040,00000000,00007700), ref: 00BD085D
FindCloseChangeNotification.KERNELBASE ref: 00BD086C

Strings

csrs, xrefs: 00BD082C

Memory Dump Source

Source File: 00000004.00000002.714310186.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_mssecsvc.jbxd

Similarity

API ID: ChangeCloseFindNotification$CreateProcess32$AdjustFirstFreeLibraryLookupNextOpenPrivilegePrivilegesProcessRemoteSnapshotThreadTokenToolhelp32Value
String ID: csrs
API String ID: 238827593-2321902090
Opcode ID: f5f5cebb265d1853f7019ca829e2ca1ff70c3e720cc08ba597563a20905a2943
Instruction ID: 20793470305b0372e2c8e9442d645e664afb572364709bdab046bf4af8132426
Opcode Fuzzy Hash: f5f5cebb265d1853f7019ca829e2ca1ff70c3e720cc08ba597563a20905a2943
Instruction Fuzzy Hash: FB112130516105FBEB256F21CC4DFBF7AADEF54701F00006EFD4699151E6B19E019A6A

Uniqueness

Uniqueness Score: -1.00%

Function 7FEA43D8 Relevance: 4.6, APIs: 3, Instructions: 83
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,C0000000,00000001,00000000,00000003,00000000,00000000,?,65676E61,?,?,7FEA4345,?,7FEA4327,?,7FEA4303), ref: 7FEA442C
CreateFileMappingA.KERNEL32(?,00000000,00000004,00000000,00000000,00000000,?,C0000000,00000001,00000000,00000003,00000000,00000000,?,65676E61), ref: 7FEA44A4
MapViewOfFile.KERNELBASE(00000000,000F001F,00000000,00000000,00000000,?,C0000000,00000001,00000000,00000003,00000000,00000000,?,65676E61), ref: 7FEA44D9

Memory Dump Source

Source File: 00000004.00000002.716248732.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd

Similarity

API ID: File$Create$MappingView
String ID:
API String ID: 1299149932-0
Opcode ID: a25d0a244bd87399e907a8ca4fb165620c37478fabe61e369b42e3abbdd64840
Instruction ID: f642a9f299f9543a5b0287ba49c011da509250de9aef83acac8e8c1155f8e25e
Opcode Fuzzy Hash: a25d0a244bd87399e907a8ca4fb165620c37478fabe61e369b42e3abbdd64840
Instruction Fuzzy Hash: 6C21327020430ABAEB229E60CC45BFE356DEF00619F104629E91B9E0A4E7F2AF158754

Uniqueness

Uniqueness Score: -1.00%

Function 00BD05BA Relevance: 1.3, APIs: 1, Instructions: 7
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(0000000A,00BD085C,?,00000000,00000000,-00003BD0,00000002,00000000,?,00000000), ref: 00BD05C1

Memory Dump Source

Source File: 00000004.00000002.714310186.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_mssecsvc.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 3c1f989dfd13240381299ec7adf5382b251643946d8aa86ca05208ab7bb78418
Instruction ID: b1aed1fec3f7ffaf06a748bbb7ee4bbf08b75a26198777f2459c3dc5ee88d06e
Opcode Fuzzy Hash: 3c1f989dfd13240381299ec7adf5382b251643946d8aa86ca05208ab7bb78418
Instruction Fuzzy Hash: AAB0122C25030095DA14291064CEB4457A47F11B15FE000DBEA064C1C417E507001D0D

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 7FEA3BD5 Relevance: 40.7, APIs: 19, Strings: 4, Instructions: 472
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe,00000104), ref: 7FEA3C39
GetProcAddress.KERNEL32(00000000,00000002), ref: 7FEA3C6C
GetProcAddress.KERNEL32(00000000,7FEA3CD9), ref: 7FEA3CE4
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FEA3CF7
GetTickCount.KERNEL32 ref: 7FEA3D2B
GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FEA6E36,00000000,00000000,00000000,00000000), ref: 7FEA3DFD

Strings

ADVAPI32.DLL, xrefs: 7FEA3CF6
C:\WINDOWS\TASKSCHE.EXE, xrefs: 7FEA4157
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FEA3EA4
C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe, xrefs: 7FEA3C38, 7FEA3C9E, 7FEA3CAE, 7FEA4119, 7FEA4158

Memory Dump Source

Source File: 00000004.00000002.716248732.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd

Similarity

API ID: AddressProc$CountDirectoryInformationLibraryLoadTickVolumeWindows
String ID: ADVAPI32.DLL$C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
API String ID: 3969011833-3441452408
Opcode ID: 6fec74ca2565ad77cf16187e820aa09f4f743d7765ef450cb713a8fe50d10e2c
Instruction ID: 9aca7d3b7fb460b858eaf3e0e80c99dd93525a92ac7923124c4fd82c469f76f2
Opcode Fuzzy Hash: 6fec74ca2565ad77cf16187e820aa09f4f743d7765ef450cb713a8fe50d10e2c
Instruction Fuzzy Hash: 36F1E571519348BEDB229F24CC4ABFA7BACEF42304F00451AE8559F081DBF66F0597A6

Uniqueness

Uniqueness Score: -1.00%

Function 00BD3BD5 Relevance: 40.7, APIs: 19, Strings: 4, Instructions: 472
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe,00000104), ref: 00BD3C39
GetProcAddress.KERNEL32(00000000,00000002), ref: 00BD3C6C
GetProcAddress.KERNEL32(00000000,00BD3CD9), ref: 00BD3CE4
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00BD3CF7
GetTickCount.KERNEL32 ref: 00BD3D2B
GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00BD6E36,00000000,00000000,00000000,00000000), ref: 00BD3DFD

Strings

C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe, xrefs: 00BD3C38, 00BD3C9E, 00BD3CAE, 00BD4119, 00BD4158
ADVAPI32.DLL, xrefs: 00BD3CF6
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00BD3EA4
C:\WINDOWS\TASKSCHE.EXE, xrefs: 00BD4157

Memory Dump Source

Source File: 00000004.00000002.714310186.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_mssecsvc.jbxd

Similarity

API ID: AddressProc$CountDirectoryInformationLibraryLoadTickVolumeWindows
String ID: ADVAPI32.DLL$C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
API String ID: 3969011833-3441452408
Opcode ID: 6fec74ca2565ad77cf16187e820aa09f4f743d7765ef450cb713a8fe50d10e2c
Instruction ID: 1145100158bff55dd90138f8527f27fe4f7e1bdf2e61f05ca02155e42005c5da
Opcode Fuzzy Hash: 6fec74ca2565ad77cf16187e820aa09f4f743d7765ef450cb713a8fe50d10e2c
Instruction Fuzzy Hash: B9F12871519248BFDB35AF24CC4ABEABBECEF41700F04059AE8459F182E7F05F4586A6

Uniqueness

Uniqueness Score: -1.00%

Function 7FEA3C5A Relevance: 38.9, APIs: 18, Strings: 4, Instructions: 417libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(7FEA3C52), ref: 7FEA3C5A
GetProcAddress.KERNEL32(00000000,00000002), ref: 7FEA3C6C
GetProcAddress.KERNEL32(00000000,7FEA3CD9), ref: 7FEA3CE4
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FEA3CF7
GetTickCount.KERNEL32 ref: 7FEA3D2B

Strings

ADVAPI32.DLL, xrefs: 7FEA3CF6
C:\WINDOWS\TASKSCHE.EXE, xrefs: 7FEA4157
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FEA3EA4
C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe, xrefs: 7FEA3CAE, 7FEA4119, 7FEA4158

Memory Dump Source

Source File: 00000004.00000002.716248732.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd

Similarity

API ID: AddressProc$CountHandleLibraryLoadModuleTick
String ID: ADVAPI32.DLL$C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
API String ID: 2837544101-3441452408
Opcode ID: 027acb289342bb118d02a87de8172ec9d27ea8879ecf6df1c79d6d68dda35319
Instruction ID: 5a25107989713debb64ec6711dd094ee3109f09e8278f9dd4288a618bb6666d3
Opcode Fuzzy Hash: 027acb289342bb118d02a87de8172ec9d27ea8879ecf6df1c79d6d68dda35319
Instruction Fuzzy Hash: 24E10671519348BEDB229F34CC5ABFA7BACEF42300F00455AEC559E081DAF65F0587A6

Uniqueness

Uniqueness Score: -1.00%

Function 00BD3C5A Relevance: 38.9, APIs: 18, Strings: 4, Instructions: 417
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00BD3C52), ref: 00BD3C5A
GetProcAddress.KERNEL32(00000000,00000002), ref: 00BD3C6C
GetProcAddress.KERNEL32(00000000,00BD3CD9), ref: 00BD3CE4
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00BD3CF7
GetTickCount.KERNEL32 ref: 00BD3D2B

Strings

C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe, xrefs: 00BD3CAE, 00BD4119, 00BD4158
ADVAPI32.DLL, xrefs: 00BD3CF6
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00BD3EA4
C:\WINDOWS\TASKSCHE.EXE, xrefs: 00BD4157

Memory Dump Source

Source File: 00000004.00000002.714310186.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_mssecsvc.jbxd

Similarity

API ID: AddressProc$CountHandleLibraryLoadModuleTick
String ID: ADVAPI32.DLL$C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
API String ID: 2837544101-3441452408
Opcode ID: 027acb289342bb118d02a87de8172ec9d27ea8879ecf6df1c79d6d68dda35319
Instruction ID: f37c06629c6679f86b76a8c9f809ed4c80d74510f38b8c6e62e7e54f09a7c6ad
Opcode Fuzzy Hash: 027acb289342bb118d02a87de8172ec9d27ea8879ecf6df1c79d6d68dda35319
Instruction Fuzzy Hash: 3AE13771519248BFDB25AF24CC4ABEABBECEF42700F04059AEC449E182E7F45F458666

Uniqueness

Uniqueness Score: -1.00%

Function 7FEA3C88 Relevance: 38.9, APIs: 18, Strings: 4, Instructions: 394COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(7FEA3C7D), ref: 7FEA3C88
GetSystemDirectoryA.KERNEL32(C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe,00000104), ref: 7FEA3C9F

Part of subcall function 7FEA3CB7: lstrcat.KERNEL32(C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe,7FEA3CAA), ref: 7FEA3CB8
Part of subcall function 7FEA3CB7: GetProcAddress.KERNEL32(00000000,7FEA3CD9), ref: 7FEA3CE4
Part of subcall function 7FEA3CB7: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FEA3CF7
Part of subcall function 7FEA3CB7: GetTickCount.KERNEL32 ref: 7FEA3D2B
Part of subcall function 7FEA3CB7: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FEA6E36,00000000,00000000,00000000,00000000), ref: 7FEA3DFD

Strings

ADVAPI32.DLL, xrefs: 7FEA3CF6
C:\WINDOWS\TASKSCHE.EXE, xrefs: 7FEA4157
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FEA3EA4
C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe, xrefs: 7FEA3C9E, 7FEA3CAE, 7FEA4119, 7FEA4158

Memory Dump Source

Source File: 00000004.00000002.716248732.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd

Similarity

API ID: AddressCountDirectoryHandleInformationLibraryLoadModuleProcSystemTickVolumelstrcat
String ID: ADVAPI32.DLL$C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
API String ID: 215653160-3441452408
Opcode ID: 655e1f48a5b14d5ebf2e49081fd326607dd54f27207fd34772f1e266f9ded85e
Instruction ID: aeaaef09d323b934acf6576f031b8d72fc496fbf9d0374d28b6ab2dc06a08c56
Opcode Fuzzy Hash: 655e1f48a5b14d5ebf2e49081fd326607dd54f27207fd34772f1e266f9ded85e
Instruction Fuzzy Hash: 71D1E671519348BEDB229F30CC5ABFA7BACEF42300F00455AEC559E091D6F65F058766

Uniqueness

Uniqueness Score: -1.00%

Function 00BD3C88 Relevance: 38.9, APIs: 18, Strings: 4, Instructions: 394COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00BD3C7D), ref: 00BD3C88
GetSystemDirectoryA.KERNEL32(C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe,00000104), ref: 00BD3C9F

Part of subcall function 00BD3CB7: lstrcat.KERNEL32(C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe,00BD3CAA), ref: 00BD3CB8
Part of subcall function 00BD3CB7: GetProcAddress.KERNEL32(00000000,00BD3CD9), ref: 00BD3CE4
Part of subcall function 00BD3CB7: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00BD3CF7
Part of subcall function 00BD3CB7: GetTickCount.KERNEL32 ref: 00BD3D2B
Part of subcall function 00BD3CB7: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00BD6E36,00000000,00000000,00000000,00000000), ref: 00BD3DFD

Strings

C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe, xrefs: 00BD3C9E, 00BD3CAE, 00BD4119, 00BD4158
ADVAPI32.DLL, xrefs: 00BD3CF6
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00BD3EA4
C:\WINDOWS\TASKSCHE.EXE, xrefs: 00BD4157

Memory Dump Source

Source File: 00000004.00000002.714310186.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_mssecsvc.jbxd

Similarity

API ID: AddressCountDirectoryHandleInformationLibraryLoadModuleProcSystemTickVolumelstrcat
String ID: ADVAPI32.DLL$C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
API String ID: 215653160-3441452408
Opcode ID: 655e1f48a5b14d5ebf2e49081fd326607dd54f27207fd34772f1e266f9ded85e
Instruction ID: b9d80f887e5f3bf24a62443d8e635fa7e9ac877d84d0f63f12e7da48b88be998
Opcode Fuzzy Hash: 655e1f48a5b14d5ebf2e49081fd326607dd54f27207fd34772f1e266f9ded85e
Instruction Fuzzy Hash: 33D14771515248BFDB25AF20CC4ABEABBECEF01700F00059AEC589E182E7F45F458666

Uniqueness

Uniqueness Score: -1.00%

Function 7FEA3CB7 Relevance: 37.1, APIs: 17, Strings: 4, Instructions: 374stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe,7FEA3CAA), ref: 7FEA3CB8

Part of subcall function 7FEA3CCE: LoadLibraryA.KERNEL32(7FEA3CC3), ref: 7FEA3CCE
Part of subcall function 7FEA3CCE: GetProcAddress.KERNEL32(00000000,7FEA3CD9), ref: 7FEA3CE4
Part of subcall function 7FEA3CCE: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FEA3CF7
Part of subcall function 7FEA3CCE: GetTickCount.KERNEL32 ref: 7FEA3D2B
Part of subcall function 7FEA3CCE: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FEA6E36,00000000,00000000,00000000,00000000), ref: 7FEA3DFD

Strings

ADVAPI32.DLL, xrefs: 7FEA3CF6
C:\WINDOWS\TASKSCHE.EXE, xrefs: 7FEA4157
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FEA3EA4
C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe, xrefs: 7FEA3CB7, 7FEA4119, 7FEA4158

Memory Dump Source

Source File: 00000004.00000002.716248732.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd

Similarity

API ID: LibraryLoad$AddressCountInformationProcTickVolumelstrcat
String ID: ADVAPI32.DLL$C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
API String ID: 2038497427-3441452408
Opcode ID: 6015bc910092ae8f3cfbb4603391d7f6777f93900d010c705f53bc10b9c9ab02
Instruction ID: e965e319ca092c4b75a0ff691012f0174cc64fcd4b44b9f7ff1122fc9856030a
Opcode Fuzzy Hash: 6015bc910092ae8f3cfbb4603391d7f6777f93900d010c705f53bc10b9c9ab02
Instruction Fuzzy Hash: C8D10571519348BEDB229F34CC4ABFA7BACEF42300F00455AEC599E091DAF66F058766

Uniqueness

Uniqueness Score: -1.00%

Function 00BD3CB7 Relevance: 37.1, APIs: 17, Strings: 4, Instructions: 374stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe,00BD3CAA), ref: 00BD3CB8

Part of subcall function 00BD3CCE: LoadLibraryA.KERNEL32(00BD3CC3), ref: 00BD3CCE
Part of subcall function 00BD3CCE: GetProcAddress.KERNEL32(00000000,00BD3CD9), ref: 00BD3CE4
Part of subcall function 00BD3CCE: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00BD3CF7
Part of subcall function 00BD3CCE: GetTickCount.KERNEL32 ref: 00BD3D2B
Part of subcall function 00BD3CCE: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00BD6E36,00000000,00000000,00000000,00000000), ref: 00BD3DFD

Strings

C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe, xrefs: 00BD3CB7, 00BD4119, 00BD4158
ADVAPI32.DLL, xrefs: 00BD3CF6
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00BD3EA4
C:\WINDOWS\TASKSCHE.EXE, xrefs: 00BD4157

Memory Dump Source

Source File: 00000004.00000002.714310186.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_mssecsvc.jbxd

Similarity

API ID: LibraryLoad$AddressCountInformationProcTickVolumelstrcat
String ID: ADVAPI32.DLL$C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
API String ID: 2038497427-3441452408
Opcode ID: 6015bc910092ae8f3cfbb4603391d7f6777f93900d010c705f53bc10b9c9ab02
Instruction ID: f98602038c5131626f3bbd3b00bee1c07d535ec4d72eec7e783059f115b85248
Opcode Fuzzy Hash: 6015bc910092ae8f3cfbb4603391d7f6777f93900d010c705f53bc10b9c9ab02
Instruction Fuzzy Hash: 45D14571515248BFDB25AF24CC4ABEABBECEF01700F04059AE8489E182E7F45F458666

Uniqueness

Uniqueness Score: -1.00%

Function 7FEA3CCE Relevance: 37.1, APIs: 17, Strings: 4, Instructions: 364libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(7FEA3CC3), ref: 7FEA3CCE

Part of subcall function 7FEA3CE3: GetProcAddress.KERNEL32(00000000,7FEA3CD9), ref: 7FEA3CE4
Part of subcall function 7FEA3CE3: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FEA3CF7
Part of subcall function 7FEA3CE3: GetTickCount.KERNEL32 ref: 7FEA3D2B
Part of subcall function 7FEA3CE3: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FEA6E36,00000000,00000000,00000000,00000000), ref: 7FEA3DFD

Strings

ADVAPI32.DLL, xrefs: 7FEA3CF6
C:\WINDOWS\TASKSCHE.EXE, xrefs: 7FEA4157
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FEA3EA4
C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe, xrefs: 7FEA4119, 7FEA4158

Memory Dump Source

Source File: 00000004.00000002.716248732.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd

Similarity

API ID: LibraryLoad$AddressCountInformationProcTickVolume
String ID: ADVAPI32.DLL$C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
API String ID: 3734769084-3441452408
Opcode ID: 2493f2ca0a9d17d60b0ae92595658eb790e1a8e0bd0394b2349fd16cbfe48cab
Instruction ID: 347449e041cf090d5cde17e7f90b40bb8426bab528207790e0da05e8a845151b
Opcode Fuzzy Hash: 2493f2ca0a9d17d60b0ae92595658eb790e1a8e0bd0394b2349fd16cbfe48cab
Instruction Fuzzy Hash: 0DD1067151A348BEDB229F34CC5ABFA7BACEF41300F00055AEC5A9E091DAF66F058765

Uniqueness

Uniqueness Score: -1.00%

Function 00BD3CCE Relevance: 37.1, APIs: 17, Strings: 4, Instructions: 364libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00BD3CC3), ref: 00BD3CCE

Part of subcall function 00BD3CE3: GetProcAddress.KERNEL32(00000000,00BD3CD9), ref: 00BD3CE4
Part of subcall function 00BD3CE3: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00BD3CF7
Part of subcall function 00BD3CE3: GetTickCount.KERNEL32 ref: 00BD3D2B
Part of subcall function 00BD3CE3: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00BD6E36,00000000,00000000,00000000,00000000), ref: 00BD3DFD

Strings

C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe, xrefs: 00BD4119, 00BD4158
ADVAPI32.DLL, xrefs: 00BD3CF6
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00BD3EA4
C:\WINDOWS\TASKSCHE.EXE, xrefs: 00BD4157

Memory Dump Source

Source File: 00000004.00000002.714310186.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_mssecsvc.jbxd

Similarity

API ID: LibraryLoad$AddressCountInformationProcTickVolume
String ID: ADVAPI32.DLL$C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
API String ID: 3734769084-3441452408
Opcode ID: 2493f2ca0a9d17d60b0ae92595658eb790e1a8e0bd0394b2349fd16cbfe48cab
Instruction ID: fab416862cc414f5a2bab4e5eefafa1e8c6802f682816cea700f630c2fcbaf2d
Opcode Fuzzy Hash: 2493f2ca0a9d17d60b0ae92595658eb790e1a8e0bd0394b2349fd16cbfe48cab
Instruction Fuzzy Hash: 1DD14671515248BFDB35AF24CC4ABEABBECEF01700F00059AF8499E182E7F05F458666

Uniqueness

Uniqueness Score: -1.00%

Function 7FEA3CE3 Relevance: 35.4, APIs: 16, Strings: 4, Instructions: 371networklibrarythreadCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,7FEA3CD9), ref: 7FEA3CE4
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FEA3CF7
GetTickCount.KERNEL32 ref: 7FEA3D2B
GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FEA6E36,00000000,00000000,00000000,00000000), ref: 7FEA3DFD
CreateThread.KERNEL32(00000000,00000000,7FEA3629,00000000,00000000), ref: 7FEA3ED8
CloseHandle.KERNEL32(?,54521404), ref: 7FEA3EE1
WSAStartup.WS2_32(00000101), ref: 7FEA3F66
CreateThread.KERNEL32(00000000,00000000,Function_00003820,00000000,00000000), ref: 7FEA3F81
CloseHandle.KERNEL32(?,00000000), ref: 7FEA3F8A
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FEA3F97
socket.WS2_32(00000002,00000001,00000000), ref: 7FEA4028
connect.WS2_32(63727305,7FEA3AA1,00000010), ref: 7FEA4042
GetVersionExA.KERNEL32(?,?,00000000), ref: 7FEA408C
wsprintfA.USER32 ref: 7FEA410A
SetEvent.KERNEL32(000002A0,?,00000000), ref: 7FEA4225
Sleep.KERNEL32(00007530,?,00000000), ref: 7FEA4236
ResetEvent.KERNEL32(000002A0,?,00000000), ref: 7FEA4249

Strings

ADVAPI32.DLL, xrefs: 7FEA3CF6
C:\WINDOWS\TASKSCHE.EXE, xrefs: 7FEA4157
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FEA3EA4
C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe, xrefs: 7FEA4119, 7FEA4158

Memory Dump Source

Source File: 00000004.00000002.716248732.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd

Similarity

API ID: CreateEvent$CloseHandleThread$AddressCountInformationLibraryLoadProcResetSleepStartupTickVersionVolumeconnectsocketwsprintf
String ID: ADVAPI32.DLL$C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
API String ID: 927156256-3441452408
Opcode ID: 947b9679796d591e9ada89db576f74309ff53d0a5c4f8047994469cffe21920d
Instruction ID: 41f8a3244067a1c8dd509b3612971c8a0996764845d8b26299085c2c851ffe36
Opcode Fuzzy Hash: 947b9679796d591e9ada89db576f74309ff53d0a5c4f8047994469cffe21920d
Instruction Fuzzy Hash: 67D1E57151A348BEDB229F34CC5ABFA7BACEF41300F00465AE8599F081DAF66F058765

Uniqueness

Uniqueness Score: -1.00%

Function 00BD3CE3 Relevance: 35.4, APIs: 16, Strings: 4, Instructions: 371networklibrarythreadCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,00BD3CD9), ref: 00BD3CE4
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00BD3CF7
GetTickCount.KERNEL32 ref: 00BD3D2B
GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00BD6E36,00000000,00000000,00000000,00000000), ref: 00BD3DFD
CreateThread.KERNEL32(00000000,00000000,00BD3629,00000000,00000000), ref: 00BD3ED8
CloseHandle.KERNEL32(?,54521404), ref: 00BD3EE1
WSAStartup.WS2_32(00000101), ref: 00BD3F66
CreateThread.KERNEL32(00000000,00000000,Function_00003820,00000000,00000000), ref: 00BD3F81
CloseHandle.KERNEL32(?,00000000), ref: 00BD3F8A
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00BD3F97
socket.WS2_32(00000002,00000001,00000000), ref: 00BD4028
connect.WS2_32(63727305,00BD3AA1,00000010), ref: 00BD4042
GetVersionExA.KERNEL32(?,?,00000000), ref: 00BD408C
wsprintfA.USER32 ref: 00BD410A
SetEvent.KERNEL32(000002A0,?,00000000), ref: 00BD4225
Sleep.KERNEL32(00007530,?,00000000), ref: 00BD4236
ResetEvent.KERNEL32(000002A0,?,00000000), ref: 00BD4249

Strings

C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe, xrefs: 00BD4119, 00BD4158
ADVAPI32.DLL, xrefs: 00BD3CF6
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00BD3EA4
C:\WINDOWS\TASKSCHE.EXE, xrefs: 00BD4157

Memory Dump Source

Source File: 00000004.00000002.714310186.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_mssecsvc.jbxd

Similarity

API ID: CreateEvent$CloseHandleThread$AddressCountInformationLibraryLoadProcResetSleepStartupTickVersionVolumeconnectsocketwsprintf
String ID: ADVAPI32.DLL$C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
API String ID: 927156256-3441452408
Opcode ID: 947b9679796d591e9ada89db576f74309ff53d0a5c4f8047994469cffe21920d
Instruction ID: 0b180e410ea04e0a002a2de4285247c59f0146313c4cc8f201b32f6d98ad8b92
Opcode Fuzzy Hash: 947b9679796d591e9ada89db576f74309ff53d0a5c4f8047994469cffe21920d
Instruction Fuzzy Hash: 8BD12471515248BFDB35AF24CC4ABEABBECEF41700F04059AE8489E182E7F45F458666

Uniqueness

Uniqueness Score: -1.00%

Function 7FEA042D Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 288memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 7FEA04BE
GetVersion.KERNEL32 ref: 7FEA0500
VirtualAlloc.KERNEL32(00000000,00007700,08001000,00000040), ref: 7FEA0528
CloseHandle.KERNEL32(?), ref: 7FEA05AD

Strings

csrs, xrefs: 7FEA082C
\BaseNamedObjects\rgltVt, xrefs: 7FEA0708
\BaseNamedObjects\rgltVt, xrefs: 7FEA0709, 7FEA072C, 7FEA073A

Memory Dump Source

Source File: 00000004.00000002.716248732.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd

Similarity

API ID: Handle$AllocCloseModuleVersionVirtual
String ID: \BaseNamedObjects\rgltVt$\BaseNamedObjects\rgltVt$csrs
API String ID: 3017432202-2534361129
Opcode ID: 1c9046a76cd4f9cc91b46eb41cc31d523b20a60f6ceb114047097b2d910fbad8
Instruction ID: 7453ff9238031f863b2d147c82ab63f78e87516cde53e26c39151d6fd9cdc771
Opcode Fuzzy Hash: 1c9046a76cd4f9cc91b46eb41cc31d523b20a60f6ceb114047097b2d910fbad8
Instruction Fuzzy Hash: DBB19E31505349FFEB229F20C809BFA3BA9EF45715F100528EE0A9E181D7F2AB45CB59

Uniqueness

Uniqueness Score: -1.00%

Function 7FEA05F2 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 193stringnativeprocessCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 7FEA05AD
GetModuleHandleA.KERNEL32(7FEA05EC), ref: 7FEA05F2
lstrcpyW.KERNEL32(\BaseNamedObjects\rgltVt,\BaseNamedObjects\rgltVt), ref: 7FEA070A
lstrcpyW.KERNEL32(\BaseNamedObjects\rgltVt,?), ref: 7FEA072D
lstrcatW.KERNEL32(\BaseNamedObjects\rgltVt,\rgltVt), ref: 7FEA073B
NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,00007700,00000000,?,00000002,00000000,00000040), ref: 7FEA076B
NtOpenProcessToken.NTDLL(000000FF,00000020), ref: 7FEA0786
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 7FEA07C9
Process32First.KERNEL32 ref: 7FEA07DC
Process32Next.KERNEL32 ref: 7FEA07ED
OpenProcess.KERNEL32(0000002A,00000000,?,?,?,?,?,?,00000002,00000000,00000040,00000000,00007700), ref: 7FEA0805
CreateRemoteThread.KERNEL32(?,00000000,00000000,-00003BD0,00000002,00000000), ref: 7FEA0842
CloseHandle.KERNEL32(?,?,?,?,?,?,00000002,00000000,00000040,00000000,00007700), ref: 7FEA085D
CloseHandle.KERNEL32 ref: 7FEA086C

Strings

csrs, xrefs: 7FEA082C
\BaseNamedObjects\rgltVt, xrefs: 7FEA0708
\BaseNamedObjects\rgltVt, xrefs: 7FEA0709, 7FEA072C, 7FEA073A

Memory Dump Source

Source File: 00000004.00000002.716248732.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd

Similarity

API ID: Handle$Close$CreateOpenProcessProcess32lstrcpy$FirstModuleNextRemoteSectionSnapshotThreadTokenToolhelp32Viewlstrcat
String ID: \BaseNamedObjects\rgltVt$\BaseNamedObjects\rgltVt$csrs
API String ID: 1545766225-2534361129
Opcode ID: 17150f67079a076ac3b54c180adee95029a37e06bb0e30beb99ad34a9de5a8e6
Instruction ID: e642c59752a96cf2e9a29b673145a5f75ff07002b0fcf2144558137ad18020e6
Opcode Fuzzy Hash: 17150f67079a076ac3b54c180adee95029a37e06bb0e30beb99ad34a9de5a8e6
Instruction Fuzzy Hash: CE718D31505205FFDB219F20C849BBE3BBEEF85725F100128EE0A9E190C7B6AB45DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00BD3826 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 127networksleeptimeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(00BD74C4), ref: 00BD3837
Sleep.KERNEL32(0000EA60), ref: 00BD38A9
InternetGetConnectedState.WININET(?,00000000), ref: 00BD38C2
gethostbyname.WS2_32(0D278065), ref: 00BD3904
socket.WS2_32(00000002,00000001,00000000), ref: 00BD3919
ioctlsocket.WS2_32(?,8004667E), ref: 00BD3932
connect.WS2_32(?,?,00000010), ref: 00BD394B
Sleep.KERNEL32(?,00000010,BB010002,00000000,8004667E,?,00000001), ref: 00BD3959
closesocket.WS2_32 ref: 00BD39B8

Strings

oirlzx.com, xrefs: 00BD3889

Memory Dump Source

Source File: 00000004.00000002.714310186.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_mssecsvc.jbxd

Similarity

API ID: Sleep$ConnectedInternetStateSystemTimeclosesocketconnectgethostbynameioctlsocketsocket
String ID: oirlzx.com
API String ID: 159131500-700772952
Opcode ID: 8a686a087b9ca882c45b70cfb202359d5926509ce2d560687b0ead4f7edf597d
Instruction ID: 46009450f3b729982c486c56f14633320e39183d40db44e16b393cd46f7d11aa
Opcode Fuzzy Hash: 8a686a087b9ca882c45b70cfb202359d5926509ce2d560687b0ead4f7edf597d
Instruction Fuzzy Hash: 6541F371705249BADB315F208C5DBA9BADEEF85B10F04445AFA099E2C2E7F59F00C726

Uniqueness

Uniqueness Score: -1.00%

Function 7FEA3378 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 220filenativeCOMMON

Download Yara Rule

APIs

NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 7FEA33E2
NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 7FEA3401
MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 7FEA342B
CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 7FEA3438
UnmapViewOfFile.KERNEL32(?), ref: 7FEA3450

Strings

C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe:*:enabled:@shell32.dll,-1, xrefs: 7FEA33AC
\Device\PhysicalMemory, xrefs: 7FEA3378

Memory Dump Source

Source File: 00000004.00000002.716248732.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd

Similarity

API ID: FileView$CloseHandleInformationOpenQuerySectionSystemUnmap
String ID: C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe:*:enabled:@shell32.dll,-1$\Device\PhysicalMemory
API String ID: 2985292042-3481447464
Opcode ID: 561ceb251a9ee27251f20cf668687e795924f4ca3d2f92a1e9259e8415ac6dd8
Instruction ID: 56a11edcbb1c689dbd1713449122b98a438c0060f72ca6f09a76162296ec45fe
Opcode Fuzzy Hash: 561ceb251a9ee27251f20cf668687e795924f4ca3d2f92a1e9259e8415ac6dd8
Instruction Fuzzy Hash: AE81AB71500208FFEB258F14CC89ABA7BBDEF44711F104618ED1A9F291D7B2AF558BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00BD3378 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 220filenativeCOMMON

Download Yara Rule

APIs

NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 00BD33E2
NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 00BD3401
MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 00BD342B
CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 00BD3438
UnmapViewOfFile.KERNEL32(?), ref: 00BD3450

Strings

C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe:*:enabled:@shell32.dll,-1, xrefs: 00BD33AC
\Device\PhysicalMemory, xrefs: 00BD3378

Memory Dump Source

Source File: 00000004.00000002.714310186.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_mssecsvc.jbxd

Similarity

API ID: FileView$CloseHandleInformationOpenQuerySectionSystemUnmap
String ID: C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe:*:enabled:@shell32.dll,-1$\Device\PhysicalMemory
API String ID: 2985292042-3481447464
Opcode ID: 561ceb251a9ee27251f20cf668687e795924f4ca3d2f92a1e9259e8415ac6dd8
Instruction ID: 921068f7424ffd0bf1e420561fb211a438beca28069d4040c905c51635ab28e0
Opcode Fuzzy Hash: 561ceb251a9ee27251f20cf668687e795924f4ca3d2f92a1e9259e8415ac6dd8
Instruction Fuzzy Hash: F681AE71500208FFEB249F14CC89ABA77ACEF44B10F104559ED199B292E7F0AF55CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 7FEA339D Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 61filenativeCOMMON

Download Yara Rule

APIs

NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 7FEA33E2
NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 7FEA3401
MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 7FEA342B
CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 7FEA3438
UnmapViewOfFile.KERNEL32(?), ref: 7FEA3450

Strings

C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe:*:enabled:@shell32.dll,-1, xrefs: 7FEA33AC
ysic, xrefs: 7FEA33E8, 7FEA33FE

Memory Dump Source

Source File: 00000004.00000002.716248732.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd

Similarity

API ID: FileView$CloseHandleInformationOpenQuerySectionSystemUnmap
String ID: C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe:*:enabled:@shell32.dll,-1$ysic
API String ID: 2985292042-3421363416
Opcode ID: 83cfc29f16e685118e4cac80380ae0b62c24e54c169c44b406135decc174f522
Instruction ID: ff6e1720a4d5288448ee75bc0faa3df6a4e6c75d0573f4a9372b1c80ae80cf43
Opcode Fuzzy Hash: 83cfc29f16e685118e4cac80380ae0b62c24e54c169c44b406135decc174f522
Instruction Fuzzy Hash: D1118B70140709BFEB248F10CC56FAB367CEF88704F004618EA1A9F290EBF56F148A68

Uniqueness

Uniqueness Score: -1.00%

Function 00BD339D Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 61filenativeCOMMON

Download Yara Rule

APIs

NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 00BD33E2
NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 00BD3401
MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 00BD342B
CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 00BD3438
UnmapViewOfFile.KERNEL32(?), ref: 00BD3450

Strings

C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe:*:enabled:@shell32.dll,-1, xrefs: 00BD33AC
ysic, xrefs: 00BD33E8, 00BD33FE

Memory Dump Source

Source File: 00000004.00000002.714310186.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_mssecsvc.jbxd

Similarity

API ID: FileView$CloseHandleInformationOpenQuerySectionSystemUnmap
String ID: C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe:*:enabled:@shell32.dll,-1$ysic
API String ID: 2985292042-3421363416
Opcode ID: 83cfc29f16e685118e4cac80380ae0b62c24e54c169c44b406135decc174f522
Instruction ID: 02c24b4086e277a1f81c9183920d93db36f17b955cc190bd17e3f7f8c4615d98
Opcode Fuzzy Hash: 83cfc29f16e685118e4cac80380ae0b62c24e54c169c44b406135decc174f522
Instruction Fuzzy Hash: 8A11B270140609FBEB348F10CC56FAB76BCEF88B10F104519EA199B2D1E7F4AF148A69

Uniqueness

Uniqueness Score: -1.00%

Function 00BD27A7 Relevance: 12.1, APIs: 8, Instructions: 65filenetworkprocessCOMMON

Download Yara Rule

APIs

GetTempFileNameA.KERNEL32(?,00BD27A3,00000000,?), ref: 00BD27A8
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000,?,00BD27A3,00000000,?), ref: 00BD27C3
InternetReadFile.WININET(?,?,00000104), ref: 00BD27DD
WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000104,?,00000000,?,00BD27A3,00000000,?), ref: 00BD27F3
CloseHandle.KERNEL32(?,00000104,?,00000000,?,00BD27A3,00000000,?), ref: 00BD27FF
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?,00000000,?,00BD27A3), ref: 00BD2823
InternetCloseHandle.WININET(?), ref: 00BD2833
InternetCloseHandle.WININET(00000000), ref: 00BD283A

Memory Dump Source

Source File: 00000004.00000002.714310186.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_mssecsvc.jbxd

Similarity

API ID: File$CloseHandleInternet$Create$NameProcessReadTempWrite
String ID:
API String ID: 3452404049-0
Opcode ID: 79ba4446e2a00169ac63f746143a5fe332799a213c8ddaac65906699330d25c2
Instruction ID: 75959b7f275fb15effc2aa3d336b653262907242207358d60b28518f80cce1f1
Opcode Fuzzy Hash: 79ba4446e2a00169ac63f746143a5fe332799a213c8ddaac65906699330d25c2
Instruction Fuzzy Hash: 78116DB1101645FBEB350B20CC4AFFB7A6DEF94B10F004519FA0599190EBF59E5096A8

Uniqueness

Uniqueness Score: -1.00%

Function 7FEA4BDD Relevance: 7.1, Strings: 5, Instructions: 887COMMON

Download Yara Rule

Strings

&, xrefs: 7FEA5550
(, xrefs: 7FEA58E3
@, xrefs: 7FEA5057
!, xrefs: 7FEA4CA9
&, xrefs: 7FEA5556

Memory Dump Source

Source File: 00000004.00000002.716248732.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd

Similarity

API ID: File$Create$MappingView
String ID: !$&$&$($@
API String ID: 1299149932-3998544071
Opcode ID: 25fd66c91c24a4fd03ddee83c8a1d13ddf3750b043df019a0650e26a20b1b082
Instruction ID: 9a47f9b56868187d74c23fa501e9b99ff18267223aec4681d09f20923d468791
Opcode Fuzzy Hash: 25fd66c91c24a4fd03ddee83c8a1d13ddf3750b043df019a0650e26a20b1b082
Instruction Fuzzy Hash: F0821131504349EFDB26CF28C8457A97BBAEF40328F245219C82A8F195D3F6AF94CB55

Uniqueness

Uniqueness Score: -1.00%

Function 7FEA24AE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46stringnativeCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(?,\BaseNamedObjects\rgltVt), ref: 7FEA24BA
lstrlenW.KERNEL32(?), ref: 7FEA24C1
NtCreateSection.NTDLL(?,0000000E,?,?,00000040,08000000,00000000), ref: 7FEA2516

Strings

\BaseNamedObjects\rgltVt, xrefs: 7FEA24B8

Memory Dump Source

Source File: 00000004.00000002.716248732.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd

Similarity

API ID: CreateSectionlstrcpylstrlen
String ID: \BaseNamedObjects\rgltVt
API String ID: 2597515329-2940223550
Opcode ID: 6df0d3fc1f16acd4470fa2c95d69911b6900c7005e3f5048832692c16ca5b6c3
Instruction ID: 3d658928266ddf13e57175c854466b86464fdc84b0814c26b1264ca4c3db85b9
Opcode Fuzzy Hash: 6df0d3fc1f16acd4470fa2c95d69911b6900c7005e3f5048832692c16ca5b6c3
Instruction Fuzzy Hash: 7901A4B0791304BBF7305B29CC4BF5F7969DF81B51F548154F718AE1C4DAB89A0483A9

Uniqueness

Uniqueness Score: -1.00%

Function 00BD24AE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46stringnativeCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(?,\BaseNamedObjects\rgltVt), ref: 00BD24BA
lstrlenW.KERNEL32(?), ref: 00BD24C1
NtCreateSection.NTDLL(?,0000000E,?,?,00000040,08000000,00000000), ref: 00BD2516

Strings

\BaseNamedObjects\rgltVt, xrefs: 00BD24B8

Memory Dump Source

Source File: 00000004.00000002.714310186.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_mssecsvc.jbxd

Similarity

API ID: CreateSectionlstrcpylstrlen
String ID: \BaseNamedObjects\rgltVt
API String ID: 2597515329-2940223550
Opcode ID: 6df0d3fc1f16acd4470fa2c95d69911b6900c7005e3f5048832692c16ca5b6c3
Instruction ID: 846742326d140018b256c80f0446e25c34b617fdd11b7c01e698797142f7f708
Opcode Fuzzy Hash: 6df0d3fc1f16acd4470fa2c95d69911b6900c7005e3f5048832692c16ca5b6c3
Instruction Fuzzy Hash: 1A01AFB0791305BBF7305B29CC8BF5F7969DF81B50F948158F718AE1C4DAB89A0483A9

Uniqueness

Uniqueness Score: -1.00%

Function 7FEA252F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29nativeCOMMON

Download Yara Rule

APIs

NtOpenSection.NTDLL(?,0000000E), ref: 7FEA255E

Strings

\BaseNamedObjects\rgltVt, xrefs: 7FEA254B

Memory Dump Source

Source File: 00000004.00000002.716248732.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd

Similarity

API ID: OpenSection
String ID: \BaseNamedObjects\rgltVt
API String ID: 1950954290-2940223550
Opcode ID: d78bf25e7d60e3ca5bd26387aae6e314818fabfb1d4b2e27edbc6fd945c633ca
Instruction ID: be79e926c7ba3cdd2c7dd474d1815d54d5159c487d34c6ebacd093897ac0aaf8
Opcode Fuzzy Hash: d78bf25e7d60e3ca5bd26387aae6e314818fabfb1d4b2e27edbc6fd945c633ca
Instruction Fuzzy Hash: 75E09AF17402063AFB288A29CC17FA7228DCB80602F0C8604F918DA080E5B4AB108268

Uniqueness

Uniqueness Score: -1.00%

Function 7FEA2574 Relevance: 3.1, APIs: 2, Instructions: 66nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 7FEA252F: NtOpenSection.NTDLL(?,0000000E), ref: 7FEA255E

NtMapViewOfSection.NTDLL(00000000,?,?,00000000,0000B700,00000000,?,00000002,00100000,00000040), ref: 7FEA25A4
CloseHandle.KERNEL32(00000000,0000B700,00000000,?,00000002,00100000,00000040,00000000,0000B700,00000000,?,7FEA0815), ref: 7FEA25AC

Memory Dump Source

Source File: 00000004.00000002.716248732.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd

Similarity

API ID: Section$CloseHandleOpenView
String ID:
API String ID: 2731707328-0
Opcode ID: 7bef6bf2a50047ffc7f3cd4018dfe575c0559d17770fc5c6e4c634ed419af6cd
Instruction ID: 1146768d7d0c0653ae7c65a746e47e6098816a1e91a2f6cfed56a84069563c97
Opcode Fuzzy Hash: 7bef6bf2a50047ffc7f3cd4018dfe575c0559d17770fc5c6e4c634ed419af6cd
Instruction Fuzzy Hash: B7213B70301746ABDB18DE65CC95FBA7369FF80684F401118E81ABE1D4DBB2BE14CB58

Uniqueness

Uniqueness Score: -1.00%

Function 7FEA1422 Relevance: 3.0, APIs: 2, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 7FEA145A
NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000), ref: 7FEA146A

Memory Dump Source

Source File: 00000004.00000002.716248732.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd

Similarity

API ID: AdjustLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 3615134276-0
Opcode ID: cc86f677ff09b61866951c90db79301e57ffd1e2cff1b35255cc9d89dc5b2434
Instruction ID: d6f38f481fcad269b120698a2c1356ff37e0dff7a02be2eff211d383f83c851a
Opcode Fuzzy Hash: cc86f677ff09b61866951c90db79301e57ffd1e2cff1b35255cc9d89dc5b2434
Instruction Fuzzy Hash: F8F0E932542010BBD6201B42CC8EED73E28EF533A0F040455F4484E151C2624BA1D3F4

Uniqueness

Uniqueness Score: -1.00%

Function 7FEA2477 Relevance: 3.0, APIs: 2, Instructions: 25nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,00000040), ref: 7FEA249B
NtWriteVirtualMemory.NTDLL ref: 7FEA24A4

Memory Dump Source

Source File: 00000004.00000002.716248732.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd

Similarity

API ID: MemoryVirtual$ProtectWrite
String ID:
API String ID: 151266762-0
Opcode ID: 3b89ad314080acfcfa5e752e4380cd5b7e8fc3aa7940f56e0bfe36a9f1ccff9c
Instruction ID: 6bbb67ea70d6ee96dfa5f1d7b4d314b28acc786a60d934acbd3f762ecc45b662
Opcode Fuzzy Hash: 3b89ad314080acfcfa5e752e4380cd5b7e8fc3aa7940f56e0bfe36a9f1ccff9c
Instruction Fuzzy Hash: 2AE012E07502007FF5185F55DC5FF7B391DDB41751F410208FA0A981C4F9A15E18467A

Uniqueness

Uniqueness Score: -1.00%

Function 7FEA144A Relevance: 3.0, APIs: 2, Instructions: 22nativeCOMMON

Download Yara Rule

APIs

LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 7FEA145A
NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000), ref: 7FEA146A

Memory Dump Source

Source File: 00000004.00000002.716248732.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd

Similarity

API ID: AdjustLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 3615134276-0
Opcode ID: 516db6a43922e3348a8f3b60dc7b7b81588e67f26302b6e21a5b03875f902ac7
Instruction ID: 47fd2fdfef69c01f2383a78087d1294dd7e4f4bd71475d1ca0affc6c0d2f20e2
Opcode Fuzzy Hash: 516db6a43922e3348a8f3b60dc7b7b81588e67f26302b6e21a5b03875f902ac7
Instruction Fuzzy Hash: 1BD06771643034BBD6312A568C0EEE77D1DEF577A0F015441F9089A1A1C5A28EA1C6F5

Uniqueness

Uniqueness Score: -1.00%

Function 7FEA28C8 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.716248732.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0642b33d3ce8112a54256d33be083f0dc48b56f423af93a4a8a3c14605054926
Instruction ID: 599e4210a27b95691828082bf071d632d483ec5813d8a2b375e76b2b2bcd3a21
Opcode Fuzzy Hash: 0642b33d3ce8112a54256d33be083f0dc48b56f423af93a4a8a3c14605054926
Instruction Fuzzy Hash: 6A31F5326006158BEB148E38C94079AB7F2FB84704F10C63CE557FB594D676F6898BC0

Uniqueness

Uniqueness Score: -1.00%

Function 00BD28C8 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.714310186.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_mssecsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0642b33d3ce8112a54256d33be083f0dc48b56f423af93a4a8a3c14605054926
Instruction ID: 73fecf105264d62452fb9899f96a34b48ea67d95b07828405ce22351cb0d92e6
Opcode Fuzzy Hash: 0642b33d3ce8112a54256d33be083f0dc48b56f423af93a4a8a3c14605054926
Instruction Fuzzy Hash: 3D3128326006558BEB148F38C85579AF7E2FBA4304F10C67DE556E7680E679FA898BC0

Uniqueness

Uniqueness Score: -1.00%

Function 7FEA025E Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.716248732.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8218de38323479a09e09664737f0271114d8ef91b7d521b1daf9042e2ccc4ac
Instruction ID: f0f9d25d209616971c0a9408303952b9b6fab7fe69a8d4d9e188e35ba333143e
Opcode Fuzzy Hash: c8218de38323479a09e09664737f0271114d8ef91b7d521b1daf9042e2ccc4ac
Instruction Fuzzy Hash: A00124326053455ED721DE38CD88FADBBA1EBC5324F118325E6944F08AD637A28186A1

Uniqueness

Uniqueness Score: -1.00%

Function 00BD025E Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.714310186.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_mssecsvc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8218de38323479a09e09664737f0271114d8ef91b7d521b1daf9042e2ccc4ac
Instruction ID: 2055c70c792a8a4706949f77a70733e08a1b3724ede9ee8f2de011d2cad672df
Opcode Fuzzy Hash: c8218de38323479a09e09664737f0271114d8ef91b7d521b1daf9042e2ccc4ac
Instruction Fuzzy Hash: E60164322011455ED720FE28CC89F9DF3E1ABC4320F00C3BAF4945B28AE636A2818681

Uniqueness

Uniqueness Score: -1.00%

Function 7FEA3F27 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 205networkthreadlibraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(7FEA3F1B), ref: 7FEA3F27
WSAStartup.WS2_32(00000101), ref: 7FEA3F66
CreateThread.KERNEL32(00000000,00000000,Function_00003820,00000000,00000000), ref: 7FEA3F81
CloseHandle.KERNEL32(?,00000000), ref: 7FEA3F8A
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FEA3F97
lstrlen.KERNEL32(src.gide.at,?,00000000), ref: 7FEA3FE8
gethostbyname.WS2_32(src.gide.at), ref: 7FEA3FF7
socket.WS2_32(00000002,00000001,00000000), ref: 7FEA4028
connect.WS2_32(63727305,7FEA3AA1,00000010), ref: 7FEA4042
GetVersionExA.KERNEL32(?,?,00000000), ref: 7FEA408C
wsprintfA.USER32 ref: 7FEA410A
CreateThread.KERNEL32(?,?,Function_000037B1,63727305), ref: 7FEA4138
CloseHandle.KERNEL32(?,?,Function_000037B1,63727305,?,?,00000023,7FEA6E36,000000A8,63727305,63727305,7FEA3AEA,00000014,00000000), ref: 7FEA4141
RtlExitUserThread.NTDLL(00000000), ref: 7FEA4261

Strings

C:\WINDOWS\TASKSCHE.EXE, xrefs: 7FEA4157
src.gide.at, xrefs: 7FEA3FE7, 7FEA3FF6
C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe, xrefs: 7FEA4119, 7FEA4158

Memory Dump Source

Source File: 00000004.00000002.716248732.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd

Similarity

API ID: CreateThread$CloseHandle$EventExitLibraryLoadStartupUserVersionconnectgethostbynamelstrlensocketwsprintf
String ID: C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe$C:\WINDOWS\TASKSCHE.EXE$src.gide.at
API String ID: 3947895852-2196962613
Opcode ID: cd3075aa6ac5a1b2a324a193c1ece853ea8a8685f00cea4c4ff8086d10106105
Instruction ID: 1f19dfe30ab9c43e13b8bae516eeccfb55818e60c833b419f6a1145a3973a7c9
Opcode Fuzzy Hash: cd3075aa6ac5a1b2a324a193c1ece853ea8a8685f00cea4c4ff8086d10106105
Instruction Fuzzy Hash: F181D171119349BFDB229F30C819BEE7BADEF81304F000559E85A9E091D7F6AF058B69

Uniqueness

Uniqueness Score: -1.00%

Function 00BD3F27 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 205networkthreadlibraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00BD3F1B), ref: 00BD3F27
WSAStartup.WS2_32(00000101), ref: 00BD3F66
CreateThread.KERNEL32(00000000,00000000,Function_00003820,00000000,00000000), ref: 00BD3F81
CloseHandle.KERNEL32(?,00000000), ref: 00BD3F8A
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00BD3F97
lstrlen.KERNEL32(src.gide.at,?,00000000), ref: 00BD3FE8
gethostbyname.WS2_32(src.gide.at), ref: 00BD3FF7
socket.WS2_32(00000002,00000001,00000000), ref: 00BD4028
connect.WS2_32(63727305,00BD3AA1,00000010), ref: 00BD4042
GetVersionExA.KERNEL32(?,?,00000000), ref: 00BD408C
wsprintfA.USER32 ref: 00BD410A
CreateThread.KERNEL32(?,?,Function_000037B1,63727305), ref: 00BD4138
CloseHandle.KERNEL32(?,?,Function_000037B1,63727305,?,?,00000023,00BD6E36,000000A8,63727305,63727305,00BD3AEA,00000014,00000000), ref: 00BD4141
RtlExitUserThread.NTDLL(00000000), ref: 00BD4261

Strings

src.gide.at, xrefs: 00BD3FE7, 00BD3FF6
C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe, xrefs: 00BD4119, 00BD4158
C:\WINDOWS\TASKSCHE.EXE, xrefs: 00BD4157

Memory Dump Source

Source File: 00000004.00000002.714310186.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_mssecsvc.jbxd

Similarity

API ID: CreateThread$CloseHandle$EventExitLibraryLoadStartupUserVersionconnectgethostbynamelstrlensocketwsprintf
String ID: C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe$C:\WINDOWS\TASKSCHE.EXE$src.gide.at
API String ID: 3947895852-2196962613
Opcode ID: cd3075aa6ac5a1b2a324a193c1ece853ea8a8685f00cea4c4ff8086d10106105
Instruction ID: c034815f4d7ca6c59874a26810c9f51fa951e5bb6de1747b685feada98d5dfd2
Opcode Fuzzy Hash: cd3075aa6ac5a1b2a324a193c1ece853ea8a8685f00cea4c4ff8086d10106105
Instruction Fuzzy Hash: E081D171515249BFDB219F24C85ABEABBECEF41700F04058AF8595E281E3F09F458B6A

Uniqueness

Uniqueness Score: -1.00%

Function 7FEA3E64 Relevance: 33.5, APIs: 15, Strings: 4, Instructions: 246threadlibraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,7FEA3E58), ref: 7FEA3E65
GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe,000000C8), ref: 7FEA3E7A
wsprintfA.USER32 ref: 7FEA3E8F
CreateThread.KERNEL32(00000000,00000000,7FEA3629,00000000,00000000), ref: 7FEA3ED8
CloseHandle.KERNEL32(?,54521404), ref: 7FEA3EE1
WSAStartup.WS2_32(00000101), ref: 7FEA3F66
CreateThread.KERNEL32(00000000,00000000,Function_00003820,00000000,00000000), ref: 7FEA3F81
CloseHandle.KERNEL32(?,00000000), ref: 7FEA3F8A
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FEA3F97

Part of subcall function 7FEA339D: NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 7FEA33E2
Part of subcall function 7FEA339D: NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 7FEA3401
Part of subcall function 7FEA339D: MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 7FEA342B
Part of subcall function 7FEA339D: CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 7FEA3438
Part of subcall function 7FEA339D: UnmapViewOfFile.KERNEL32(?), ref: 7FEA3450

Strings

C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe:*:enabled:@shell32.dll,-1, xrefs: 7FEA3E8E
C:\WINDOWS\TASKSCHE.EXE, xrefs: 7FEA4157
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FEA3EA4
C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe, xrefs: 7FEA3E77, 7FEA3E8C, 7FEA4119, 7FEA4158

Memory Dump Source

Source File: 00000004.00000002.716248732.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd

Similarity

API ID: CloseCreateFileHandle$ThreadView$AddressEventInformationModuleNameOpenProcQuerySectionStartupSystemUnmapwsprintf
String ID: C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe$C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe:*:enabled:@shell32.dll,-1$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
API String ID: 3630706530-3782157705
Opcode ID: 3b4c00c77de353b703b27fe9e0b05dac0049b0b034d594c042b1972db7874499
Instruction ID: 9d17da7c4a2217e4ad46382ead5c8f654a5b3290fe2f47b08ae3b003c422590d
Opcode Fuzzy Hash: 3b4c00c77de353b703b27fe9e0b05dac0049b0b034d594c042b1972db7874499
Instruction Fuzzy Hash: 2891C17151A348BFDB229F24CC5ABEB7BACEF81304F000659E8595E091D6F26F0587A6

Uniqueness

Uniqueness Score: -1.00%

Function 00BD3E64 Relevance: 33.5, APIs: 15, Strings: 4, Instructions: 246threadlibraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,00BD3E58), ref: 00BD3E65
GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe,000000C8), ref: 00BD3E7A
wsprintfA.USER32 ref: 00BD3E8F
CreateThread.KERNEL32(00000000,00000000,00BD3629,00000000,00000000), ref: 00BD3ED8
CloseHandle.KERNEL32(?,54521404), ref: 00BD3EE1
WSAStartup.WS2_32(00000101), ref: 00BD3F66
CreateThread.KERNEL32(00000000,00000000,Function_00003820,00000000,00000000), ref: 00BD3F81
CloseHandle.KERNEL32(?,00000000), ref: 00BD3F8A
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00BD3F97

Part of subcall function 00BD339D: NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 00BD33E2
Part of subcall function 00BD339D: NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 00BD3401
Part of subcall function 00BD339D: MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 00BD342B
Part of subcall function 00BD339D: CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 00BD3438
Part of subcall function 00BD339D: UnmapViewOfFile.KERNEL32(?), ref: 00BD3450

Strings

C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe:*:enabled:@shell32.dll,-1, xrefs: 00BD3E8E
C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe, xrefs: 00BD3E77, 00BD3E8C, 00BD4119, 00BD4158
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00BD3EA4
C:\WINDOWS\TASKSCHE.EXE, xrefs: 00BD4157

Memory Dump Source

Source File: 00000004.00000002.714310186.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_mssecsvc.jbxd

Similarity

API ID: CloseCreateFileHandle$ThreadView$AddressEventInformationModuleNameOpenProcQuerySectionStartupSystemUnmapwsprintf
String ID: C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe$C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe:*:enabled:@shell32.dll,-1$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
API String ID: 3630706530-3782157705
Opcode ID: 3b4c00c77de353b703b27fe9e0b05dac0049b0b034d594c042b1972db7874499
Instruction ID: 9df4efdff615a93cec6e4b9d16b5dae767ff7878cb247c9cd6b4df6789683f64
Opcode Fuzzy Hash: 3b4c00c77de353b703b27fe9e0b05dac0049b0b034d594c042b1972db7874499
Instruction Fuzzy Hash: 2691E471515248BFDB21AF24CC4ABEBBBACEF41300F04069AF8595E182E7F05F4587A6

Uniqueness

Uniqueness Score: -1.00%

Function 7FEA3E4D Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 262networklibrarythreadCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(7FEA3E41), ref: 7FEA3E4D

Part of subcall function 7FEA3E64: GetProcAddress.KERNEL32(00000000,7FEA3E58), ref: 7FEA3E65
Part of subcall function 7FEA3E64: GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe,000000C8), ref: 7FEA3E7A
Part of subcall function 7FEA3E64: wsprintfA.USER32 ref: 7FEA3E8F
Part of subcall function 7FEA3E64: CreateThread.KERNEL32(00000000,00000000,7FEA3629,00000000,00000000), ref: 7FEA3ED8
Part of subcall function 7FEA3E64: CloseHandle.KERNEL32(?,54521404), ref: 7FEA3EE1
Part of subcall function 7FEA3E64: WSAStartup.WS2_32(00000101), ref: 7FEA3F66

CreateThread.KERNEL32(00000000,00000000,Function_00003820,00000000,00000000), ref: 7FEA3F81
CloseHandle.KERNEL32(?,00000000), ref: 7FEA3F8A
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FEA3F97
socket.WS2_32(00000002,00000001,00000000), ref: 7FEA4028
connect.WS2_32(63727305,7FEA3AA1,00000010), ref: 7FEA4042
GetVersionExA.KERNEL32(?,?,00000000), ref: 7FEA408C
wsprintfA.USER32 ref: 7FEA410A

Strings

C:\WINDOWS\TASKSCHE.EXE, xrefs: 7FEA4157
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FEA3EA4
C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe, xrefs: 7FEA4119, 7FEA4158

Memory Dump Source

Source File: 00000004.00000002.716248732.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd

Similarity

API ID: Create$CloseHandleThreadwsprintf$AddressEventFileLibraryLoadModuleNameProcStartupVersionconnectsocket
String ID: C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
API String ID: 2507355515-2145749575
Opcode ID: 87f197dd41939147b2960925833c34f02f8e43997e3fe373c143eff21418308d
Instruction ID: 6b43f42d33c473ca34d55eb3a46b2bfc1632f845a8dbf175e61849a723126759
Opcode Fuzzy Hash: 87f197dd41939147b2960925833c34f02f8e43997e3fe373c143eff21418308d
Instruction Fuzzy Hash: FE910471519344BEDB229F34CC5ABFB7BACEF81300F004659E85A9E091D6F26F0587A6

Uniqueness

Uniqueness Score: -1.00%

Function 00BD3E4D Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 262networklibrarythreadCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00BD3E41), ref: 00BD3E4D

Part of subcall function 00BD3E64: GetProcAddress.KERNEL32(00000000,00BD3E58), ref: 00BD3E65
Part of subcall function 00BD3E64: GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe,000000C8), ref: 00BD3E7A
Part of subcall function 00BD3E64: wsprintfA.USER32 ref: 00BD3E8F
Part of subcall function 00BD3E64: CreateThread.KERNEL32(00000000,00000000,00BD3629,00000000,00000000), ref: 00BD3ED8
Part of subcall function 00BD3E64: CloseHandle.KERNEL32(?,54521404), ref: 00BD3EE1
Part of subcall function 00BD3E64: WSAStartup.WS2_32(00000101), ref: 00BD3F66

CreateThread.KERNEL32(00000000,00000000,Function_00003820,00000000,00000000), ref: 00BD3F81
CloseHandle.KERNEL32(?,00000000), ref: 00BD3F8A
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00BD3F97
socket.WS2_32(00000002,00000001,00000000), ref: 00BD4028
connect.WS2_32(63727305,00BD3AA1,00000010), ref: 00BD4042
GetVersionExA.KERNEL32(?,?,00000000), ref: 00BD408C
wsprintfA.USER32 ref: 00BD410A

Strings

C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe, xrefs: 00BD4119, 00BD4158
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00BD3EA4
C:\WINDOWS\TASKSCHE.EXE, xrefs: 00BD4157

Memory Dump Source

Source File: 00000004.00000002.714310186.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_mssecsvc.jbxd

Similarity

API ID: Create$CloseHandleThreadwsprintf$AddressEventFileLibraryLoadModuleNameProcStartupVersionconnectsocket
String ID: C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
API String ID: 2507355515-2145749575
Opcode ID: 87f197dd41939147b2960925833c34f02f8e43997e3fe373c143eff21418308d
Instruction ID: 92ffaf6ada7bfcbcc02d55ece21a1e7420c210ee5b12940ee80d1bc7139e56ae
Opcode Fuzzy Hash: 87f197dd41939147b2960925833c34f02f8e43997e3fe373c143eff21418308d
Instruction Fuzzy Hash: 55910571519244BFDB21AF24CC5ABEBBBECEF41300F04059AF8599E182E6F05F4586A6

Uniqueness

Uniqueness Score: -1.00%

Function 7FEA4109 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 178sleepnetworkthreadCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000000), ref: 7FEA4028
connect.WS2_32(63727305,7FEA3AA1,00000010), ref: 7FEA4042
wsprintfA.USER32 ref: 7FEA410A
CreateThread.KERNEL32(?,?,Function_000037B1,63727305), ref: 7FEA4138
CloseHandle.KERNEL32(?,?,Function_000037B1,63727305,?,?,00000023,7FEA6E36,000000A8,63727305,63727305,7FEA3AEA,00000014,00000000), ref: 7FEA4141
Sleep.KERNEL32(00000064,?,?,?,Function_000037B1,63727305,?,?,00000023,7FEA6E36,000000A8,63727305,63727305,7FEA3AEA,00000014,00000000), ref: 7FEA41DA
GetTickCount.KERNEL32 ref: 7FEA41E3
closesocket.WS2_32(63727305), ref: 7FEA4207
SetEvent.KERNEL32(000002A0,?,00000000), ref: 7FEA4225
Sleep.KERNEL32(00007530,?,00000000), ref: 7FEA4236
ResetEvent.KERNEL32(000002A0,?,00000000), ref: 7FEA4249

Strings

C:\WINDOWS\TASKSCHE.EXE, xrefs: 7FEA4157
C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe, xrefs: 7FEA4109, 7FEA4119, 7FEA4158

Memory Dump Source

Source File: 00000004.00000002.716248732.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd

Similarity

API ID: EventSleep$CloseCountCreateHandleResetThreadTickclosesocketconnectsocketwsprintf
String ID: C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe$C:\WINDOWS\TASKSCHE.EXE
API String ID: 2506426657-3731079479
Opcode ID: fc55b44dffeed9f0fa34af6d0f9333e7e97c5298c09aa9a8cf59fe694ab0a9b6
Instruction ID: 89d05568f6f0f74edd9da8b322cf757c92d4c5c9e4e33640a8c574e91f1d73db
Opcode Fuzzy Hash: fc55b44dffeed9f0fa34af6d0f9333e7e97c5298c09aa9a8cf59fe694ab0a9b6
Instruction Fuzzy Hash: 1C610571119349BEDB229F34C819BEE7BADEF92304F040649E85A5E091C7F6AF018769

Uniqueness

Uniqueness Score: -1.00%

Function 00BD4109 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 178sleepnetworkthreadCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000000), ref: 00BD4028
connect.WS2_32(63727305,00BD3AA1,00000010), ref: 00BD4042
wsprintfA.USER32 ref: 00BD410A
CreateThread.KERNEL32(?,?,Function_000037B1,63727305), ref: 00BD4138
CloseHandle.KERNEL32(?,?,Function_000037B1,63727305,?,?,00000023,00BD6E36,000000A8,63727305,63727305,00BD3AEA,00000014,00000000), ref: 00BD4141
Sleep.KERNEL32(00000064,?,?,?,Function_000037B1,63727305,?,?,00000023,00BD6E36,000000A8,63727305,63727305,00BD3AEA,00000014,00000000), ref: 00BD41DA
GetTickCount.KERNEL32 ref: 00BD41E3
closesocket.WS2_32(63727305), ref: 00BD4207
SetEvent.KERNEL32(000002A0,?,00000000), ref: 00BD4225
Sleep.KERNEL32(00007530,?,00000000), ref: 00BD4236
ResetEvent.KERNEL32(000002A0,?,00000000), ref: 00BD4249

Strings

C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe, xrefs: 00BD4109, 00BD4119, 00BD4158
C:\WINDOWS\TASKSCHE.EXE, xrefs: 00BD4157

Memory Dump Source

Source File: 00000004.00000002.714310186.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_mssecsvc.jbxd

Similarity

API ID: EventSleep$CloseCountCreateHandleResetThreadTickclosesocketconnectsocketwsprintf
String ID: C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe$C:\WINDOWS\TASKSCHE.EXE
API String ID: 2506426657-3731079479
Opcode ID: fc55b44dffeed9f0fa34af6d0f9333e7e97c5298c09aa9a8cf59fe694ab0a9b6
Instruction ID: 86f3f805dd60dc6e910b68ce788efd0980732e907f3598897cd2f55940397c86
Opcode Fuzzy Hash: fc55b44dffeed9f0fa34af6d0f9333e7e97c5298c09aa9a8cf59fe694ab0a9b6
Instruction Fuzzy Hash: 9D611571114249BBDF219F24C85ABDEBFECEF41700F14058AE8595E281E3F09F41876A

Uniqueness

Uniqueness Score: -1.00%

Function 7FEA3EF8 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 192libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(7FEA3EEC), ref: 7FEA3EF8

Part of subcall function 7FEA3F27: LoadLibraryA.KERNEL32(7FEA3F1B), ref: 7FEA3F27
Part of subcall function 7FEA3F27: WSAStartup.WS2_32(00000101), ref: 7FEA3F66
Part of subcall function 7FEA3F27: CreateThread.KERNEL32(00000000,00000000,Function_00003820,00000000,00000000), ref: 7FEA3F81
Part of subcall function 7FEA3F27: CloseHandle.KERNEL32(?,00000000), ref: 7FEA3F8A
Part of subcall function 7FEA3F27: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FEA3F97
Part of subcall function 7FEA3F27: socket.WS2_32(00000002,00000001,00000000), ref: 7FEA4028
Part of subcall function 7FEA3F27: connect.WS2_32(63727305,7FEA3AA1,00000010), ref: 7FEA4042
Part of subcall function 7FEA3F27: GetVersionExA.KERNEL32(?,?,00000000), ref: 7FEA408C

Strings

C:\WINDOWS\TASKSCHE.EXE, xrefs: 7FEA4157
C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe, xrefs: 7FEA4119, 7FEA4158

Memory Dump Source

Source File: 00000004.00000002.716248732.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd

Similarity

API ID: CreateLibraryLoad$CloseEventHandleStartupThreadVersionconnectsocket
String ID: C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe$C:\WINDOWS\TASKSCHE.EXE
API String ID: 3793714048-3731079479
Opcode ID: 25854abc98b3accc8cf8ec0414aa342a2e8bceb29aad210d583b08b6067569f1
Instruction ID: b67a33e171a28624ddfe8ab1e5238558b27c32c4c3291d9317fedc6211665881
Opcode Fuzzy Hash: 25854abc98b3accc8cf8ec0414aa342a2e8bceb29aad210d583b08b6067569f1
Instruction Fuzzy Hash: B961E471119349BEDB229F34CC1ABEA7BACEF81304F000659E8595F091D6F66F0587A6

Uniqueness

Uniqueness Score: -1.00%

Function 00BD3EF8 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 192libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00BD3EEC), ref: 00BD3EF8

Part of subcall function 00BD3F27: LoadLibraryA.KERNEL32(00BD3F1B), ref: 00BD3F27
Part of subcall function 00BD3F27: WSAStartup.WS2_32(00000101), ref: 00BD3F66
Part of subcall function 00BD3F27: CreateThread.KERNEL32(00000000,00000000,Function_00003820,00000000,00000000), ref: 00BD3F81
Part of subcall function 00BD3F27: CloseHandle.KERNEL32(?,00000000), ref: 00BD3F8A
Part of subcall function 00BD3F27: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00BD3F97
Part of subcall function 00BD3F27: socket.WS2_32(00000002,00000001,00000000), ref: 00BD4028
Part of subcall function 00BD3F27: connect.WS2_32(63727305,00BD3AA1,00000010), ref: 00BD4042
Part of subcall function 00BD3F27: GetVersionExA.KERNEL32(?,?,00000000), ref: 00BD408C

Strings

C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe, xrefs: 00BD4119, 00BD4158
C:\WINDOWS\TASKSCHE.EXE, xrefs: 00BD4157

Memory Dump Source

Source File: 00000004.00000002.714310186.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_mssecsvc.jbxd

Similarity

API ID: CreateLibraryLoad$CloseEventHandleStartupThreadVersionconnectsocket
String ID: C:\Program Files (x86)\UcSHtshAXpIeFikosOpnMKxLOaGwqPwoIdcBkfuyrmT\RfsaVDBoWSoGjxwXebEIpiWge.exe$C:\WINDOWS\TASKSCHE.EXE
API String ID: 3793714048-3731079479
Opcode ID: 25854abc98b3accc8cf8ec0414aa342a2e8bceb29aad210d583b08b6067569f1
Instruction ID: 07ec0fb70af4b129373670cd5923d27448a74d28fa0d0f16eb17cfca05a5ed8c
Opcode Fuzzy Hash: 25854abc98b3accc8cf8ec0414aa342a2e8bceb29aad210d583b08b6067569f1
Instruction Fuzzy Hash: AA61D671515249BFDB21AF24CC5ABEABBECEF41300F04059AF8595E182E3F05F4587A6

Uniqueness

Uniqueness Score: -1.00%

Function 7FEA3826 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 127networksleeptimeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(7FEA74C4), ref: 7FEA3837
Sleep.KERNEL32(0000EA60), ref: 7FEA38A9
InternetGetConnectedState.WININET(?,00000000), ref: 7FEA38C2
gethostbyname.WS2_32(0D278065), ref: 7FEA3904
socket.WS2_32(00000002,00000001,00000000), ref: 7FEA3919
ioctlsocket.WS2_32(?,8004667E), ref: 7FEA3932
connect.WS2_32(?,?,00000010), ref: 7FEA394B
Sleep.KERNEL32(?,00000010,BB010002,00000000,8004667E,?,00000001), ref: 7FEA3959
closesocket.WS2_32 ref: 7FEA39B8

Strings

oirlzx.com, xrefs: 7FEA3889

Memory Dump Source

Source File: 00000004.00000002.716248732.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd

Similarity

API ID: Sleep$ConnectedInternetStateSystemTimeclosesocketconnectgethostbynameioctlsocketsocket
String ID: oirlzx.com
API String ID: 159131500-700772952
Opcode ID: 8a686a087b9ca882c45b70cfb202359d5926509ce2d560687b0ead4f7edf597d
Instruction ID: 679708d68e1f1f1ff3adb2774e65a255b4cfa23130b2b7b2cbe7d81c0c76102a
Opcode Fuzzy Hash: 8a686a087b9ca882c45b70cfb202359d5926509ce2d560687b0ead4f7edf597d
Instruction Fuzzy Hash: 5641B371606349BEDB219F208C0DBE97B6EEF86715F004459FA0AAE0C0DBF79B419664

Uniqueness

Uniqueness Score: -1.00%

Function 7FEA07AC Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 62processthreadinjectionCOMMON

Download Yara Rule

APIs

Part of subcall function 7FEA144A: LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 7FEA145A
Part of subcall function 7FEA144A: NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000), ref: 7FEA146A

CloseHandle.KERNEL32(?), ref: 7FEA05AD
FreeLibrary.KERNEL32(76DF0000,?,7FEA079B,00000000,00007700,00000000,?,00000002,00000000,00000040,00000000,00007700), ref: 7FEA07B8
CloseHandle.KERNEL32(?,?,7FEA079B,00000000,00007700,00000000,?,00000002,00000000,00000040,00000000,00007700), ref: 7FEA07BF
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 7FEA07C9
Process32First.KERNEL32 ref: 7FEA07DC
Process32Next.KERNEL32 ref: 7FEA07ED
OpenProcess.KERNEL32(0000002A,00000000,?,?,?,?,?,?,00000002,00000000,00000040,00000000,00007700), ref: 7FEA0805
CreateRemoteThread.KERNEL32(?,00000000,00000000,-00003BD0,00000002,00000000), ref: 7FEA0842
CloseHandle.KERNEL32(?,?,?,?,?,?,00000002,00000000,00000040,00000000,00007700), ref: 7FEA085D
CloseHandle.KERNEL32 ref: 7FEA086C

Strings

csrs, xrefs: 7FEA082C

Memory Dump Source

Source File: 00000004.00000002.716248732.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd

Similarity

API ID: CloseHandle$CreateProcess32$AdjustFirstFreeLibraryLookupNextOpenPrivilegePrivilegesProcessRemoteSnapshotThreadTokenToolhelp32Value
String ID: csrs
API String ID: 3908997113-2321902090
Opcode ID: f5f5cebb265d1853f7019ca829e2ca1ff70c3e720cc08ba597563a20905a2943
Instruction ID: 2cd7a14c00b21565bcb56f83c63b20fe79d5af0ee737aa92731432fe19230117
Opcode Fuzzy Hash: f5f5cebb265d1853f7019ca829e2ca1ff70c3e720cc08ba597563a20905a2943
Instruction Fuzzy Hash: 35113030506205FBEB256F31CD49BBF3A6DEF44711F00016DFE4B9D051D6B5AA019A6A

Uniqueness

Uniqueness Score: -1.00%

Function 7FEA2768 Relevance: 12.1, APIs: 8, Instructions: 85networkCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000104), ref: 7FEA278C

Part of subcall function 7FEA27A7: GetTempFileNameA.KERNEL32(?,7FEA27A3,00000000,?), ref: 7FEA27A8
Part of subcall function 7FEA27A7: CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000,?,7FEA27A3,00000000,?), ref: 7FEA27C3
Part of subcall function 7FEA27A7: InternetReadFile.WININET(?,?,00000104), ref: 7FEA27DD
Part of subcall function 7FEA27A7: WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000104,?,00000000,?,7FEA27A3,00000000,?), ref: 7FEA27F3
Part of subcall function 7FEA27A7: CloseHandle.KERNEL32(?,00000104,?,00000000,?,7FEA27A3,00000000,?), ref: 7FEA27FF
Part of subcall function 7FEA27A7: CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?,00000000,?,7FEA27A3), ref: 7FEA2823
Part of subcall function 7FEA27A7: InternetCloseHandle.WININET(?), ref: 7FEA2833

InternetCloseHandle.WININET(00000000), ref: 7FEA283A

Memory Dump Source

Source File: 00000004.00000002.716248732.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd

Similarity

API ID: File$CloseHandleInternet$CreateTemp$NamePathProcessReadWrite
String ID:
API String ID: 1995088466-0
Opcode ID: 9442bed387485dd5c6208b040b775dce7909e05c58a4aabe22b0929d4f7f6822
Instruction ID: 74c89064570d784bd3ffb51b95ebf9e27efa287465053b468b7125fe6face982
Opcode Fuzzy Hash: 9442bed387485dd5c6208b040b775dce7909e05c58a4aabe22b0929d4f7f6822
Instruction Fuzzy Hash: A321D2B1146305BFE7215A24CC8EFFF3A2DEF85B10F000119FA45AD091D7B2AA05C676

Uniqueness

Uniqueness Score: -1.00%

Function 00BD2768 Relevance: 12.1, APIs: 8, Instructions: 85networkCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000104), ref: 00BD278C

Part of subcall function 00BD27A7: GetTempFileNameA.KERNEL32(?,00BD27A3,00000000,?), ref: 00BD27A8
Part of subcall function 00BD27A7: CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000,?,00BD27A3,00000000,?), ref: 00BD27C3
Part of subcall function 00BD27A7: InternetReadFile.WININET(?,?,00000104), ref: 00BD27DD
Part of subcall function 00BD27A7: WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000104,?,00000000,?,00BD27A3,00000000,?), ref: 00BD27F3
Part of subcall function 00BD27A7: CloseHandle.KERNEL32(?,00000104,?,00000000,?,00BD27A3,00000000,?), ref: 00BD27FF
Part of subcall function 00BD27A7: CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?,00000000,?,00BD27A3), ref: 00BD2823
Part of subcall function 00BD27A7: InternetCloseHandle.WININET(?), ref: 00BD2833

InternetCloseHandle.WININET(00000000), ref: 00BD283A

Memory Dump Source

Source File: 00000004.00000002.714310186.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_mssecsvc.jbxd

Similarity

API ID: File$CloseHandleInternet$CreateTemp$NamePathProcessReadWrite
String ID:
API String ID: 1995088466-0
Opcode ID: 9442bed387485dd5c6208b040b775dce7909e05c58a4aabe22b0929d4f7f6822
Instruction ID: 8cf4a3a0ce78389536d5d262b22913f1b232d6a77760110a5697e6ace7a98828
Opcode Fuzzy Hash: 9442bed387485dd5c6208b040b775dce7909e05c58a4aabe22b0929d4f7f6822
Instruction Fuzzy Hash: 4E21C0B1146245BFE7315B20CC8EFFF7A6CEF95B10F00011AFA4899191E7B19E458676

Uniqueness

Uniqueness Score: -1.00%

Function 7FEA27A7 Relevance: 12.1, APIs: 8, Instructions: 65filenetworkprocessCOMMON

Download Yara Rule

APIs

GetTempFileNameA.KERNEL32(?,7FEA27A3,00000000,?), ref: 7FEA27A8
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000,?,7FEA27A3,00000000,?), ref: 7FEA27C3
InternetReadFile.WININET(?,?,00000104), ref: 7FEA27DD
WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000104,?,00000000,?,7FEA27A3,00000000,?), ref: 7FEA27F3
CloseHandle.KERNEL32(?,00000104,?,00000000,?,7FEA27A3,00000000,?), ref: 7FEA27FF
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?,00000000,?,7FEA27A3), ref: 7FEA2823
InternetCloseHandle.WININET(?), ref: 7FEA2833
InternetCloseHandle.WININET(00000000), ref: 7FEA283A

Memory Dump Source

Source File: 00000004.00000002.716248732.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd

Similarity

API ID: File$CloseHandleInternet$Create$NameProcessReadTempWrite
String ID:
API String ID: 3452404049-0
Opcode ID: 79ba4446e2a00169ac63f746143a5fe332799a213c8ddaac65906699330d25c2
Instruction ID: 253c23f555185b814b1cdcf545c16be04bb5684639417fd8c89e0d35e34b2959
Opcode Fuzzy Hash: 79ba4446e2a00169ac63f746143a5fe332799a213c8ddaac65906699330d25c2
Instruction Fuzzy Hash: D0116DB1102605FBEB250B24CC49FFB7A2DEF85B14F004519FA06AD090DBF5AA5096A8

Uniqueness

Uniqueness Score: -1.00%

Function 7FEA10CE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(01AAF790), ref: 7FEA113D
GetProcAddress.KERNEL32(00000000,7FEA11D6), ref: 7FEA1148

Strings

.DLL, xrefs: 7FEA1133

Memory Dump Source

Source File: 00000004.00000002.716248732.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: .DLL
API String ID: 1646373207-899428287
Opcode ID: 10ee03f602b6349dc7cedc8c09501795956ad4c0f43e49632d56126e52950066
Instruction ID: 64e96567a4fa29470c832aebb982c78cc4185b42e07649bfd7ba7b32abc738d9
Opcode Fuzzy Hash: 10ee03f602b6349dc7cedc8c09501795956ad4c0f43e49632d56126e52950066
Instruction Fuzzy Hash: 5A01C434116206EAC7538E28C8457FE3BBDEF14275F004115D91A8F159C67AAA50CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00BD10CE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(01AAF790), ref: 00BD113D
GetProcAddress.KERNEL32(00000000,00BD11D6), ref: 00BD1148

Strings

.DLL, xrefs: 00BD1133

Memory Dump Source

Source File: 00000004.00000002.714310186.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_mssecsvc.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: .DLL
API String ID: 1646373207-899428287
Opcode ID: 10ee03f602b6349dc7cedc8c09501795956ad4c0f43e49632d56126e52950066
Instruction ID: aa1848bdfb2ed68b2b20958080f0ead8d74c1d4983a97723c6d686db35b5416b
Opcode Fuzzy Hash: 10ee03f602b6349dc7cedc8c09501795956ad4c0f43e49632d56126e52950066
Instruction Fuzzy Hash: 92012670115006FADB659E6CC84A6EABBFCEF04341F004892EA199B316E770DE80C695

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: mssecsvc.exePID: 7092, Parent PID: 588COMMON

Execution Graph

Execution Coverage:	3.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	314
Total number of Limit Nodes:	0

Executed Functions

Function 00B9042D Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 288
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 00B904BE
GetVersion.KERNEL32 ref: 00B90500
VirtualAlloc.KERNEL32(00000000,00007700,08001000,00000040), ref: 00B90528
CloseHandle.KERNEL32(?), ref: 00B905AD

Strings

csrs, xrefs: 00B9082C
\BaseNamedObjects\whptVt, xrefs: 00B90709, 00B9072C, 00B9073A
\BaseNamedObjects\whptVt, xrefs: 00B90708

Memory Dump Source

Source File: 00000009.00000002.522605251.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd

Similarity

API ID: Handle$AllocCloseModuleVersionVirtual
String ID: \BaseNamedObjects\whptVt$\BaseNamedObjects\whptVt$csrs
API String ID: 3017432202-1901567157
Opcode ID: 1c9046a76cd4f9cc91b46eb41cc31d523b20a60f6ceb114047097b2d910fbad8
Instruction ID: 997d835ddaca8b0f0daf656a6a790e568f90e7574d808bd2961cb4376cdae66b
Opcode Fuzzy Hash: 1c9046a76cd4f9cc91b46eb41cc31d523b20a60f6ceb114047097b2d910fbad8
Instruction Fuzzy Hash: 21B1BA31624209FFEF21AF60C84ABAA3BE9EF44311F1101A9F9089E181C7F49F45DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00B905F2 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 193
stringnativeprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32(?), ref: 00B905AD
GetModuleHandleA.KERNEL32(00B905EC), ref: 00B905F2
lstrcpyW.KERNEL32(\BaseNamedObjects\whptVt,\BaseNamedObjects\whptVt), ref: 00B9070A
lstrcpyW.KERNEL32(\BaseNamedObjects\whptVt,?), ref: 00B9072D
lstrcatW.KERNEL32(\BaseNamedObjects\whptVt,\whptVt), ref: 00B9073B
NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,00007700,00000000,?,00000002,00000000,00000040), ref: 00B9076B
NtOpenProcessToken.NTDLL(000000FF,00000020), ref: 00B90786
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00B907C9
Process32First.KERNEL32 ref: 00B907DC
Process32Next.KERNEL32 ref: 00B907ED
OpenProcess.KERNEL32(0000002A,00000000,?,?,?,?,?,?,00000002,00000000,00000040,00000000,00007700), ref: 00B90805
CreateRemoteThread.KERNELBASE(?,00000000,00000000,-00003BD0,00000002,00000000), ref: 00B90842
CloseHandle.KERNEL32(?,?,?,?,?,?,00000002,00000000,00000040,00000000,00007700), ref: 00B9085D
CloseHandle.KERNEL32 ref: 00B9086C

Strings

csrs, xrefs: 00B9082C
\BaseNamedObjects\whptVt, xrefs: 00B90709, 00B9072C, 00B9073A
\BaseNamedObjects\whptVt, xrefs: 00B90708

Memory Dump Source

Source File: 00000009.00000002.522605251.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd

Similarity

API ID: Handle$Close$CreateOpenProcessProcess32lstrcpy$FirstModuleNextRemoteSectionSnapshotThreadTokenToolhelp32Viewlstrcat
String ID: \BaseNamedObjects\whptVt$\BaseNamedObjects\whptVt$csrs
API String ID: 1545766225-1901567157
Opcode ID: 17150f67079a076ac3b54c180adee95029a37e06bb0e30beb99ad34a9de5a8e6
Instruction ID: 40eb5df70f9eaf97870d3b47a831472e82941ded140fc36076b23f68ebe2930f
Opcode Fuzzy Hash: 17150f67079a076ac3b54c180adee95029a37e06bb0e30beb99ad34a9de5a8e6
Instruction Fuzzy Hash: 51719A31620205FFDF21AF50C849BAE3BEDEF44311F1100B9E9099E191C7B5AF45AB59

Uniqueness

Uniqueness Score: -1.00%

Function 00B9116F Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 320
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(00B91162,00B90796,00000000,00007700,00000000,?,00000002,00000000,00000040,00000000,00007700), ref: 00B9116F

Part of subcall function 00B91196: GetProcAddress.KERNEL32(00000000,00B91180), ref: 00B91197

Strings

\whptVt, xrefs: 00B911C6

Memory Dump Source

Source File: 00000009.00000002.522605251.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: \whptVt
API String ID: 2574300362-1160934063
Opcode ID: 479442f7bfc4ff850ddc3259933bc137c33014730e34b28b791d72e1ef723d3d
Instruction ID: f30fdb83ef619fdb2261199e68639078bbba25d100796390a35f4d1fb93954e0
Opcode Fuzzy Hash: 479442f7bfc4ff850ddc3259933bc137c33014730e34b28b791d72e1ef723d3d
Instruction Fuzzy Hash: 65813561C1D2836EDF35BB7C48450A9BFF6EA2275071C5EFDC4B19BA53C2228D03A645

Uniqueness

Uniqueness Score: -1.00%

Function 00B9252F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtOpenSection.NTDLL(?,0000000E), ref: 00B9255E

Strings

\BaseNamedObjects\whptVt, xrefs: 00B9254B

Memory Dump Source

Source File: 00000009.00000002.522605251.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd

Similarity

API ID: OpenSection
String ID: \BaseNamedObjects\whptVt
API String ID: 1950954290-1729277563
Opcode ID: d78bf25e7d60e3ca5bd26387aae6e314818fabfb1d4b2e27edbc6fd945c633ca
Instruction ID: be79e926c7ba3cdd2c7dd474d1815d54d5159c487d34c6ebacd093897ac0aaf8
Opcode Fuzzy Hash: d78bf25e7d60e3ca5bd26387aae6e314818fabfb1d4b2e27edbc6fd945c633ca
Instruction Fuzzy Hash: 75E09AF17402063AFB288A29CC17FA7228DCB80602F0C8604F918DA080E5B4AB108268

Uniqueness

Uniqueness Score: -1.00%

Function 00B92574 Relevance: 3.1, APIs: 2, Instructions: 66
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B9252F: NtOpenSection.NTDLL(?,0000000E), ref: 00B9255E

NtMapViewOfSection.NTDLL(00000000,?,?,00000000,0000B700,00000000,?,00000002,00100000,00000040), ref: 00B925A4
FindCloseChangeNotification.KERNELBASE(00000000,0000B700,00000000,?,00000002,00100000,00000040,00000000,0000B700,00000000,?,00B90815), ref: 00B925AC

Memory Dump Source

Source File: 00000009.00000002.522605251.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd

Similarity

API ID: Section$ChangeCloseFindNotificationOpenView
String ID:
API String ID: 1694706092-0
Opcode ID: 7bef6bf2a50047ffc7f3cd4018dfe575c0559d17770fc5c6e4c634ed419af6cd
Instruction ID: 4953bbd5202766a111081227140ae40ff46effb8d5244a3924d24fe478678d30
Opcode Fuzzy Hash: 7bef6bf2a50047ffc7f3cd4018dfe575c0559d17770fc5c6e4c634ed419af6cd
Instruction Fuzzy Hash: C0215E70B00605BBDF24EF25CC56FAA73A9FF80744F400168F9198E2A4DBB1AE24C714

Uniqueness

Uniqueness Score: -1.00%

Function 00B91422 Relevance: 3.0, APIs: 2, Instructions: 38
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 00B9145A
NtAdjustPrivilegesToken.NTDLL(?,?,00000000,?), ref: 00B9146A

Memory Dump Source

Source File: 00000009.00000002.522605251.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd

Similarity

API ID: AdjustLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 3615134276-0
Opcode ID: cc86f677ff09b61866951c90db79301e57ffd1e2cff1b35255cc9d89dc5b2434
Instruction ID: d6f38f481fcad269b120698a2c1356ff37e0dff7a02be2eff211d383f83c851a
Opcode Fuzzy Hash: cc86f677ff09b61866951c90db79301e57ffd1e2cff1b35255cc9d89dc5b2434
Instruction Fuzzy Hash: F8F0E932542010BBD6201B42CC8EED73E28EF533A0F040455F4484E151C2624BA1D3F4

Uniqueness

Uniqueness Score: -1.00%

Function 00B92477 Relevance: 3.0, APIs: 2, Instructions: 25
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,00000040), ref: 00B9249B
NtWriteVirtualMemory.NTDLL ref: 00B924A4

Memory Dump Source

Source File: 00000009.00000002.522605251.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd

Similarity

API ID: MemoryVirtual$ProtectWrite
String ID:
API String ID: 151266762-0
Opcode ID: 3b89ad314080acfcfa5e752e4380cd5b7e8fc3aa7940f56e0bfe36a9f1ccff9c
Instruction ID: 6bbb67ea70d6ee96dfa5f1d7b4d314b28acc786a60d934acbd3f762ecc45b662
Opcode Fuzzy Hash: 3b89ad314080acfcfa5e752e4380cd5b7e8fc3aa7940f56e0bfe36a9f1ccff9c
Instruction Fuzzy Hash: 2AE012E07502007FF5185F55DC5FF7B391DDB41751F410208FA0A981C4F9A15E18467A

Uniqueness

Uniqueness Score: -1.00%

Function 00B9144A Relevance: 3.0, APIs: 2, Instructions: 22
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 00B9145A
NtAdjustPrivilegesToken.NTDLL(?,?,00000000,?), ref: 00B9146A

Memory Dump Source

Source File: 00000009.00000002.522605251.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd

Similarity

API ID: AdjustLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 3615134276-0
Opcode ID: 516db6a43922e3348a8f3b60dc7b7b81588e67f26302b6e21a5b03875f902ac7
Instruction ID: 47fd2fdfef69c01f2383a78087d1294dd7e4f4bd71475d1ca0affc6c0d2f20e2
Opcode Fuzzy Hash: 516db6a43922e3348a8f3b60dc7b7b81588e67f26302b6e21a5b03875f902ac7
Instruction Fuzzy Hash: 1BD06771643034BBD6312A568C0EEE77D1DEF577A0F015441F9089A1A1C5A28EA1C6F5

Uniqueness

Uniqueness Score: -1.00%

Function 00B907AC Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 62
processthreadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B9144A: LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 00B9145A
Part of subcall function 00B9144A: NtAdjustPrivilegesToken.NTDLL(?,?,00000000,?), ref: 00B9146A

CloseHandle.KERNEL32(?), ref: 00B905AD
FreeLibrary.KERNEL32(76DF0000,?,00B9079B,00000000,00007700,00000000,?,00000002,00000000,00000040,00000000,00007700), ref: 00B907B8
FindCloseChangeNotification.KERNELBASE(?,?,00B9079B,00000000,00007700,00000000,?,00000002,00000000,00000040,00000000,00007700), ref: 00B907BF
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00B907C9
Process32First.KERNEL32 ref: 00B907DC
Process32Next.KERNEL32 ref: 00B907ED
OpenProcess.KERNEL32(0000002A,00000000,?,?,?,?,?,?,00000002,00000000,00000040,00000000,00007700), ref: 00B90805
CreateRemoteThread.KERNELBASE(?,00000000,00000000,-00003BD0,00000002,00000000), ref: 00B90842
CloseHandle.KERNEL32(?,?,?,?,?,?,00000002,00000000,00000040,00000000,00007700), ref: 00B9085D
CloseHandle.KERNEL32 ref: 00B9086C

Strings

csrs, xrefs: 00B9082C

Memory Dump Source

Source File: 00000009.00000002.522605251.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd

Similarity

API ID: Close$Handle$CreateProcess32$AdjustChangeFindFirstFreeLibraryLookupNextNotificationOpenPrivilegePrivilegesProcessRemoteSnapshotThreadTokenToolhelp32Value
String ID: csrs
API String ID: 2727238916-2321902090
Opcode ID: f5f5cebb265d1853f7019ca829e2ca1ff70c3e720cc08ba597563a20905a2943
Instruction ID: 5fd36af5a82ae8346d19f1f26e50ec3f9bf64017079b92429ea088d70ce7420c
Opcode Fuzzy Hash: f5f5cebb265d1853f7019ca829e2ca1ff70c3e720cc08ba597563a20905a2943
Instruction Fuzzy Hash: F9111C30616205FFEF256E21CC8DBBF3AADEF54711F0000ADF94A99091D6B49E019A6A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00B93BD5 Relevance: 30.2, APIs: 15, Strings: 2, Instructions: 472
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(00B969E2,00000104), ref: 00B93C39
GetProcAddress.KERNEL32(00000000,00000002), ref: 00B93C6C
GetProcAddress.KERNEL32(00000000,00B93CD9), ref: 00B93CE4
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00B93CF7
GetTickCount.KERNEL32 ref: 00B93D2B
GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00B96E36,00000000,00000000,00000000,00000000), ref: 00B93DFD

Strings

ADVAPI32.DLL, xrefs: 00B93CF6
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00B93EA4

Memory Dump Source

Source File: 00000009.00000002.522605251.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd

Similarity

API ID: AddressProc$CountDirectoryInformationLibraryLoadTickVolumeWindows
String ID: ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
API String ID: 3969011833-2287716718
Opcode ID: 6fec74ca2565ad77cf16187e820aa09f4f743d7765ef450cb713a8fe50d10e2c
Instruction ID: 72acf008c64b8fab0f0e03d9cfeb0f2b0448e13bb874f1f44f1a6599b565dbbe
Opcode Fuzzy Hash: 6fec74ca2565ad77cf16187e820aa09f4f743d7765ef450cb713a8fe50d10e2c
Instruction Fuzzy Hash: D3F12671519258BFDF21AF24CC5ABEA3BECEF42700F0405A9E8459F082D7F45F4686A6

Uniqueness

Uniqueness Score: -1.00%

Function 00B93C5A Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 417
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00B93C52), ref: 00B93C5A
GetProcAddress.KERNEL32(00000000,00000002), ref: 00B93C6C
GetProcAddress.KERNEL32(00000000,00B93CD9), ref: 00B93CE4
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00B93CF7
GetTickCount.KERNEL32 ref: 00B93D2B

Strings

ADVAPI32.DLL, xrefs: 00B93CF6
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00B93EA4

Memory Dump Source

Source File: 00000009.00000002.522605251.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd

Similarity

API ID: AddressProc$CountHandleLibraryLoadModuleTick
String ID: ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
API String ID: 2837544101-2287716718
Opcode ID: 027acb289342bb118d02a87de8172ec9d27ea8879ecf6df1c79d6d68dda35319
Instruction ID: 41a9bd0b1ba9f35c7b0852df9117ac36292f32ed1162bd3b3a31f36655a9e1b4
Opcode Fuzzy Hash: 027acb289342bb118d02a87de8172ec9d27ea8879ecf6df1c79d6d68dda35319
Instruction Fuzzy Hash: B6E12671519258BFDF25AF34CC5ABEA3BECEF42700F0005A9E8459E082D7F45F4686A6

Uniqueness

Uniqueness Score: -1.00%

Function 00B93C88 Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 394
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00B93C7D), ref: 00B93C88
GetSystemDirectoryA.KERNEL32(00B969E2,00000104), ref: 00B93C9F

Part of subcall function 00B93CB7: lstrcat.KERNEL32(00B969E2,00B93CAA), ref: 00B93CB8
Part of subcall function 00B93CB7: GetProcAddress.KERNEL32(00000000,00B93CD9), ref: 00B93CE4
Part of subcall function 00B93CB7: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00B93CF7
Part of subcall function 00B93CB7: GetTickCount.KERNEL32 ref: 00B93D2B
Part of subcall function 00B93CB7: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00B96E36,00000000,00000000,00000000,00000000), ref: 00B93DFD

Strings

ADVAPI32.DLL, xrefs: 00B93CF6
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00B93EA4

Memory Dump Source

Source File: 00000009.00000002.522605251.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd

Similarity

API ID: AddressCountDirectoryHandleInformationLibraryLoadModuleProcSystemTickVolumelstrcat
String ID: ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
API String ID: 215653160-2287716718
Opcode ID: 655e1f48a5b14d5ebf2e49081fd326607dd54f27207fd34772f1e266f9ded85e
Instruction ID: 5fb30711a3cd8829a3de750a46f7f9e3c225f42510b0120acc48d72e89f5c265
Opcode Fuzzy Hash: 655e1f48a5b14d5ebf2e49081fd326607dd54f27207fd34772f1e266f9ded85e
Instruction Fuzzy Hash: D9D12571515258BFDF25AF34CC5ABEA3BECEF42700F0005A9E8499E082D7F45F4686A5

Uniqueness

Uniqueness Score: -1.00%

Function 00B93CB7 Relevance: 26.6, APIs: 13, Strings: 2, Instructions: 374
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00B969E2,00B93CAA), ref: 00B93CB8

Part of subcall function 00B93CCE: LoadLibraryA.KERNEL32(00B93CC3), ref: 00B93CCE
Part of subcall function 00B93CCE: GetProcAddress.KERNEL32(00000000,00B93CD9), ref: 00B93CE4
Part of subcall function 00B93CCE: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00B93CF7
Part of subcall function 00B93CCE: GetTickCount.KERNEL32 ref: 00B93D2B
Part of subcall function 00B93CCE: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00B96E36,00000000,00000000,00000000,00000000), ref: 00B93DFD

Strings

ADVAPI32.DLL, xrefs: 00B93CF6
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00B93EA4

Memory Dump Source

Source File: 00000009.00000002.522605251.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd

Similarity

API ID: LibraryLoad$AddressCountInformationProcTickVolumelstrcat
String ID: ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
API String ID: 2038497427-2287716718
Opcode ID: 6015bc910092ae8f3cfbb4603391d7f6777f93900d010c705f53bc10b9c9ab02
Instruction ID: 306973a16181de277704e99c38c6501fe0fef32c7c3702d67adc05bf52c8b0fc
Opcode Fuzzy Hash: 6015bc910092ae8f3cfbb4603391d7f6777f93900d010c705f53bc10b9c9ab02
Instruction Fuzzy Hash: AED12371515258BFDF25AF34CC5ABEA3BECEF42700F0005A9E8499E082D7F45F4686A6

Uniqueness

Uniqueness Score: -1.00%

Function 00B93CCE Relevance: 26.6, APIs: 13, Strings: 2, Instructions: 364
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(00B93CC3), ref: 00B93CCE

Part of subcall function 00B93CE3: GetProcAddress.KERNEL32(00000000,00B93CD9), ref: 00B93CE4
Part of subcall function 00B93CE3: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00B93CF7
Part of subcall function 00B93CE3: GetTickCount.KERNEL32 ref: 00B93D2B
Part of subcall function 00B93CE3: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00B96E36,00000000,00000000,00000000,00000000), ref: 00B93DFD

Strings

ADVAPI32.DLL, xrefs: 00B93CF6
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00B93EA4

Memory Dump Source

Source File: 00000009.00000002.522605251.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd

Similarity

API ID: LibraryLoad$AddressCountInformationProcTickVolume
String ID: ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
API String ID: 3734769084-2287716718
Opcode ID: 2493f2ca0a9d17d60b0ae92595658eb790e1a8e0bd0394b2349fd16cbfe48cab
Instruction ID: 47f88a064ac9f54ec28fd067b2385f0f083036390a86e7f291b5b6cae8e7948b
Opcode Fuzzy Hash: 2493f2ca0a9d17d60b0ae92595658eb790e1a8e0bd0394b2349fd16cbfe48cab
Instruction Fuzzy Hash: A7D12371515258BEEF25AF34CC5ABEA3BECEF42700F0005A9E8499E082D7F45F4586A5

Uniqueness

Uniqueness Score: -1.00%

Function 00B93CE3 Relevance: 24.9, APIs: 12, Strings: 2, Instructions: 371
librarythreadsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000,00B93CD9), ref: 00B93CE4
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00B93CF7
GetTickCount.KERNEL32 ref: 00B93D2B
GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00B96E36,00000000,00000000,00000000,00000000), ref: 00B93DFD
CreateThread.KERNEL32(00000000,00000000,00B93629,00000000,00000000), ref: 00B93ED8
CloseHandle.KERNEL32(?,54521404), ref: 00B93EE1
CreateThread.KERNEL32(00000000,00000000,Function_00003820,00000000,00000000), ref: 00B93F81
CloseHandle.KERNEL32(?,00000000), ref: 00B93F8A
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00B93F97
GetVersionExA.KERNEL32(?,?,00000000), ref: 00B9408C
SetEvent.KERNEL32(?,?,00000000), ref: 00B94225
Sleep.KERNEL32(00007530,?,00000000), ref: 00B94236
ResetEvent.KERNEL32(?,?,00000000), ref: 00B94249

Strings

ADVAPI32.DLL, xrefs: 00B93CF6
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00B93EA4

Memory Dump Source

Source File: 00000009.00000002.522605251.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd

Similarity

API ID: CreateEvent$CloseHandleThread$AddressCountInformationLibraryLoadProcResetSleepTickVersionVolume
String ID: ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
API String ID: 2334578396-2287716718
Opcode ID: 947b9679796d591e9ada89db576f74309ff53d0a5c4f8047994469cffe21920d
Instruction ID: 21cebc7aab3096735b77ecfa4cc2e550bd7145f067ab73509cc4df337b4ce6f7
Opcode Fuzzy Hash: 947b9679796d591e9ada89db576f74309ff53d0a5c4f8047994469cffe21920d
Instruction Fuzzy Hash: CDD10371515258BEEF25AF34CC5ABEA3BECEF42700F0006A9E8499F082D7F45F4586A5

Uniqueness

Uniqueness Score: -1.00%

Function 00B93378 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 220filenativeCOMMON

Download Yara Rule

APIs

NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 00B933E2
NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 00B93401
MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 00B9342B
CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 00B93438
UnmapViewOfFile.KERNEL32(?), ref: 00B93450

Strings

\Device\PhysicalMemory, xrefs: 00B93378

Memory Dump Source

Source File: 00000009.00000002.522605251.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd

Similarity

API ID: FileView$CloseHandleInformationOpenQuerySectionSystemUnmap
String ID: \Device\PhysicalMemory
API String ID: 2985292042-2007344781
Opcode ID: 561ceb251a9ee27251f20cf668687e795924f4ca3d2f92a1e9259e8415ac6dd8
Instruction ID: 237baccaf2de8cab8354dc16bd9c9d419d4a29311ba5d125489f489da6152fc1
Opcode Fuzzy Hash: 561ceb251a9ee27251f20cf668687e795924f4ca3d2f92a1e9259e8415ac6dd8
Instruction Fuzzy Hash: 0D819D71500208FFEF249F14CC89ABA37ACEF48B11F114568ED199B291D7F0AF55CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 00B9339D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61filenativeCOMMON

Download Yara Rule

APIs

NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 00B933E2
NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 00B93401
MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 00B9342B
CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 00B93438
UnmapViewOfFile.KERNEL32(?), ref: 00B93450

Strings

ysic, xrefs: 00B933E8, 00B933FE

Memory Dump Source

Source File: 00000009.00000002.522605251.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd

Similarity

API ID: FileView$CloseHandleInformationOpenQuerySectionSystemUnmap
String ID: ysic
API String ID: 2985292042-20973071
Opcode ID: 83cfc29f16e685118e4cac80380ae0b62c24e54c169c44b406135decc174f522
Instruction ID: c407c6b32d0cea5e3b99d20dd3ea92ef52d201df83196300d593a91073923c7c
Opcode Fuzzy Hash: 83cfc29f16e685118e4cac80380ae0b62c24e54c169c44b406135decc174f522
Instruction Fuzzy Hash: DA118271540609FBEB349F14CC56FAB36BCEF88B10F104528EA199B2D0D7F46F148668

Uniqueness

Uniqueness Score: -1.00%

Function 00B924AE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46stringnativeCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(?,\BaseNamedObjects\whptVt), ref: 00B924BA
lstrlenW.KERNEL32(?), ref: 00B924C1
NtCreateSection.NTDLL(?,0000000E,?,?,00000040,08000000,00000000), ref: 00B92516

Strings

\BaseNamedObjects\whptVt, xrefs: 00B924B8

Memory Dump Source

Source File: 00000009.00000002.522605251.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd

Similarity

API ID: CreateSectionlstrcpylstrlen
String ID: \BaseNamedObjects\whptVt
API String ID: 2597515329-1729277563
Opcode ID: 6df0d3fc1f16acd4470fa2c95d69911b6900c7005e3f5048832692c16ca5b6c3
Instruction ID: 1d9a2fe98837634da8107fabe165021395c62558a86072c1177b1417ea6ebf35
Opcode Fuzzy Hash: 6df0d3fc1f16acd4470fa2c95d69911b6900c7005e3f5048832692c16ca5b6c3
Instruction Fuzzy Hash: DD01F4B0781304BBF7305B29CC4BF5F3969CF81B50F448054F708AE1C4DAB89A0483A9

Uniqueness

Uniqueness Score: -1.00%

Function 00B93F27 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 205threadlibrarystringCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00B93F1B), ref: 00B93F27
CreateThread.KERNEL32(00000000,00000000,Function_00003820,00000000,00000000), ref: 00B93F81
CloseHandle.KERNEL32(?,00000000), ref: 00B93F8A
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00B93F97
lstrlen.KERNEL32(src.gide.at,?,00000000), ref: 00B93FE8
GetVersionExA.KERNEL32(?,?,00000000), ref: 00B9408C
CreateThread.KERNEL32(?,?,Function_000037B1,63727305), ref: 00B94138
CloseHandle.KERNEL32(?,?,Function_000037B1,63727305,?,?,00000023,00B96E36,00000000,63727305,63727305,00B93AEA,00000014,00000000), ref: 00B94141
RtlExitUserThread.NTDLL(00000000), ref: 00B94261

Strings

src.gide.at, xrefs: 00B93FE7, 00B93FF6

Memory Dump Source

Source File: 00000009.00000002.522605251.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd

Similarity

API ID: CreateThread$CloseHandle$EventExitLibraryLoadUserVersionlstrlen
String ID: src.gide.at
API String ID: 3753104081-1863607250
Opcode ID: cd3075aa6ac5a1b2a324a193c1ece853ea8a8685f00cea4c4ff8086d10106105
Instruction ID: 964933fe1f4c8852f5a9cd5a6f6f2fc2f8adcfc89c6605ae39ddf6b95f37a01b
Opcode Fuzzy Hash: cd3075aa6ac5a1b2a324a193c1ece853ea8a8685f00cea4c4ff8086d10106105
Instruction Fuzzy Hash: 1381BF71519249BFDF219F24C85AFEA7BECEF42700F0405A8E8599E081C7F49F468B69

Uniqueness

Uniqueness Score: -1.00%

Function 00B93E64 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 246threadlibraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,00B93E58), ref: 00B93E65
GetModuleFileNameA.KERNEL32(00000000,00B969E2,000000C8), ref: 00B93E7A
CreateThread.KERNEL32(00000000,00000000,00B93629,00000000,00000000), ref: 00B93ED8
CloseHandle.KERNEL32(?,54521404), ref: 00B93EE1
CreateThread.KERNEL32(00000000,00000000,Function_00003820,00000000,00000000), ref: 00B93F81
CloseHandle.KERNEL32(?,00000000), ref: 00B93F8A
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00B93F97

Part of subcall function 00B9339D: NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 00B933E2
Part of subcall function 00B9339D: NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 00B93401
Part of subcall function 00B9339D: MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 00B9342B
Part of subcall function 00B9339D: CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 00B93438
Part of subcall function 00B9339D: UnmapViewOfFile.KERNEL32(?), ref: 00B93450

Strings

SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00B93EA4

Memory Dump Source

Source File: 00000009.00000002.522605251.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd

Similarity

API ID: CloseCreateFileHandle$ThreadView$AddressEventInformationModuleNameOpenProcQuerySectionSystemUnmap
String ID: SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
API String ID: 3400179232-621207024
Opcode ID: 3b4c00c77de353b703b27fe9e0b05dac0049b0b034d594c042b1972db7874499
Instruction ID: d83c064f44f57010f608f3009dab9fbd143f85635a05407bbac6e323ea98af61
Opcode Fuzzy Hash: 3b4c00c77de353b703b27fe9e0b05dac0049b0b034d594c042b1972db7874499
Instruction Fuzzy Hash: 3391D071519258BFDF21AF24CC4AFEA7BACEF42300F0006A9F8595E081D7F05F4686A6

Uniqueness

Uniqueness Score: -1.00%

Function 00B93E4D Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 262librarythreadCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00B93E41), ref: 00B93E4D

Part of subcall function 00B93E64: GetProcAddress.KERNEL32(00000000,00B93E58), ref: 00B93E65
Part of subcall function 00B93E64: GetModuleFileNameA.KERNEL32(00000000,00B969E2,000000C8), ref: 00B93E7A
Part of subcall function 00B93E64: CreateThread.KERNEL32(00000000,00000000,00B93629,00000000,00000000), ref: 00B93ED8
Part of subcall function 00B93E64: CloseHandle.KERNEL32(?,54521404), ref: 00B93EE1

CreateThread.KERNEL32(00000000,00000000,Function_00003820,00000000,00000000), ref: 00B93F81
CloseHandle.KERNEL32(?,00000000), ref: 00B93F8A
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00B93F97
GetVersionExA.KERNEL32(?,?,00000000), ref: 00B9408C

Strings

SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00B93EA4

Memory Dump Source

Source File: 00000009.00000002.522605251.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd

Similarity

API ID: Create$CloseHandleThread$AddressEventFileLibraryLoadModuleNameProcVersion
String ID: SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
API String ID: 4113580538-621207024
Opcode ID: 87f197dd41939147b2960925833c34f02f8e43997e3fe373c143eff21418308d
Instruction ID: cb26a6ee2c2aa37dadd6873211ac1e25325a1b788898ad7ff6dfc83ddd17e925
Opcode Fuzzy Hash: 87f197dd41939147b2960925833c34f02f8e43997e3fe373c143eff21418308d
Instruction Fuzzy Hash: 8B910471519244BEDF21AF24CC5ABEA7BECEF42300F0405A9F8599E082C6F45F0686A6

Uniqueness

Uniqueness Score: -1.00%

Function 00B94109 Relevance: 12.2, APIs: 8, Instructions: 178sleepthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(?,?,Function_000037B1,63727305), ref: 00B94138
CloseHandle.KERNEL32(?,?,Function_000037B1,63727305,?,?,00000023,00B96E36,00000000,63727305,63727305,00B93AEA,00000014,00000000), ref: 00B94141
Sleep.KERNEL32(00000064,?,?,?,Function_000037B1,63727305,?,?,00000023,00B96E36,00000000,63727305,63727305,00B93AEA,00000014,00000000), ref: 00B941DA
GetTickCount.KERNEL32 ref: 00B941E3
SetEvent.KERNEL32(?,?,00000000), ref: 00B94225
Sleep.KERNEL32(00007530,?,00000000), ref: 00B94236
ResetEvent.KERNEL32(?,?,00000000), ref: 00B94249

Memory Dump Source

Source File: 00000009.00000002.522605251.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd

Similarity

API ID: EventSleep$CloseCountCreateHandleResetThreadTick
String ID:
API String ID: 1870499893-0
Opcode ID: fc55b44dffeed9f0fa34af6d0f9333e7e97c5298c09aa9a8cf59fe694ab0a9b6
Instruction ID: f494a5dc3412224112fac7638019df45ce83c6e83da13d5d1a9e2fd4fdb50c2c
Opcode Fuzzy Hash: fc55b44dffeed9f0fa34af6d0f9333e7e97c5298c09aa9a8cf59fe694ab0a9b6
Instruction Fuzzy Hash: B1611471518259BADF219F24C81AFDE7FECEF42700F1405A8E8596E081C3F49F428769

Uniqueness

Uniqueness Score: -1.00%

Function 00B93EF8 Relevance: 10.7, APIs: 7, Instructions: 192libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00B93EEC), ref: 00B93EF8

Part of subcall function 00B93F27: LoadLibraryA.KERNEL32(00B93F1B), ref: 00B93F27
Part of subcall function 00B93F27: CreateThread.KERNEL32(00000000,00000000,Function_00003820,00000000,00000000), ref: 00B93F81
Part of subcall function 00B93F27: CloseHandle.KERNEL32(?,00000000), ref: 00B93F8A
Part of subcall function 00B93F27: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00B93F97
Part of subcall function 00B93F27: GetVersionExA.KERNEL32(?,?,00000000), ref: 00B9408C

Memory Dump Source

Source File: 00000009.00000002.522605251.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd

Similarity

API ID: CreateLibraryLoad$CloseEventHandleThreadVersion
String ID:
API String ID: 4090826934-0
Opcode ID: 25854abc98b3accc8cf8ec0414aa342a2e8bceb29aad210d583b08b6067569f1
Instruction ID: e6021ba5a7e6944ceeca23986e34b42041923e82b4ee327422a38f8f2431591e
Opcode Fuzzy Hash: 25854abc98b3accc8cf8ec0414aa342a2e8bceb29aad210d583b08b6067569f1
Instruction Fuzzy Hash: CB61C371519259BEDF21AF24CC5ABEA7BECEF42300F0406A9F8595E081C3F45F4687A6

Uniqueness

Uniqueness Score: -1.00%

Function 00B92768 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000104), ref: 00B9278C

Part of subcall function 00B927A7: GetTempFileNameA.KERNEL32(?,00B927A3,00000000,?), ref: 00B927A8
Part of subcall function 00B927A7: CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000,?,00B927A3,00000000,?), ref: 00B927C3
Part of subcall function 00B927A7: WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000104,?,00000000,?,00B927A3,00000000,?), ref: 00B927F3
Part of subcall function 00B927A7: CloseHandle.KERNEL32(?,00000104,?,00000000,?,00B927A3,00000000,?), ref: 00B927FF
Part of subcall function 00B927A7: CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?,00000000,?,00B927A3), ref: 00B92823

Memory Dump Source

Source File: 00000009.00000002.522605251.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd

Similarity

API ID: File$CreateTemp$CloseHandleNamePathProcessWrite
String ID:
API String ID: 3982275768-0
Opcode ID: 9442bed387485dd5c6208b040b775dce7909e05c58a4aabe22b0929d4f7f6822
Instruction ID: 78ae9dc6ef911018332577c6170a18bf8862225060bc200ef901366bd4b18b7c
Opcode Fuzzy Hash: 9442bed387485dd5c6208b040b775dce7909e05c58a4aabe22b0929d4f7f6822
Instruction Fuzzy Hash: 9921C0B1145205BFEB215B20DC8EFFF3A6CEF95B10F000129FA4499091D7B59E058676

Uniqueness

Uniqueness Score: -1.00%

Function 00B927A7 Relevance: 7.6, APIs: 5, Instructions: 65fileprocessCOMMON

Download Yara Rule

APIs

GetTempFileNameA.KERNEL32(?,00B927A3,00000000,?), ref: 00B927A8
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000,?,00B927A3,00000000,?), ref: 00B927C3
WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000104,?,00000000,?,00B927A3,00000000,?), ref: 00B927F3
CloseHandle.KERNEL32(?,00000104,?,00000000,?,00B927A3,00000000,?), ref: 00B927FF
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?,00000000,?,00B927A3), ref: 00B92823

Memory Dump Source

Source File: 00000009.00000002.522605251.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd

Similarity

API ID: File$Create$CloseHandleNameProcessTempWrite
String ID:
API String ID: 463619559-0
Opcode ID: 79ba4446e2a00169ac63f746143a5fe332799a213c8ddaac65906699330d25c2
Instruction ID: 23e62b59c0cf0b9dc5bb4bcabfe735fd93577630fa4e74804dee52a4e29cfed7
Opcode Fuzzy Hash: 79ba4446e2a00169ac63f746143a5fe332799a213c8ddaac65906699330d25c2
Instruction Fuzzy Hash: 50116DB1101605FBEB254B20DC4AFFB7A6DEF88B10F004529FA0599090DBF49E5096A8

Uniqueness

Uniqueness Score: -1.00%

Function 00B910CE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(0019FF1C), ref: 00B9113D
GetProcAddress.KERNEL32(00000000,00B911D6), ref: 00B91148

Strings

.DLL, xrefs: 00B91133

Memory Dump Source

Source File: 00000009.00000002.522605251.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: .DLL
API String ID: 1646373207-899428287
Opcode ID: 10ee03f602b6349dc7cedc8c09501795956ad4c0f43e49632d56126e52950066
Instruction ID: 5f4d99885677d4cb9b890cf5298660691b26be162054dd98857753839a41481e
Opcode Fuzzy Hash: 10ee03f602b6349dc7cedc8c09501795956ad4c0f43e49632d56126e52950066
Instruction Fuzzy Hash: 7601D630215117FACF659E2CC8496EA3BECEF05341F0049B4EA1A9B156C770DE80E695

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report UBpReASuEC

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\1736c80d-6930-4acb-ae77-1088e65a6703.c81d4019-1330-4010-8ca2-301e518d770c.down_meta

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\1736c80d-6930-4acb-ae77-1088e65a6703.up_meta

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\328613bb-d9fd-464d-8e18-36a56bfcd660.8072ed17-626f-4b05-8d4e-e1f8c9d17eb3.down_meta

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\328613bb-d9fd-464d-8e18-36a56bfcd660.down_data

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\359095cb-bf2b-41bf-8103-13a2a8012235.a3ca69e3-e705-4f64-a747-3b1b77a563b2.down_meta

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\359095cb-bf2b-41bf-8103-13a2a8012235.down_data

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\6071454c-93cc-4d3c-88ff-dcf9b8a683e4.bf42fc66-610f-446d-84dd-ccdd2b6f9b34.down_meta

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\6071454c-93cc-4d3c-88ff-dcf9b8a683e4.down_data

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\60f12053-d245-44a6-bc56-ad6e6ab7a7c9.f2d7e325-8812-419f-93c5-393f1d8412fe.down_meta

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\60f12053-d245-44a6-bc56-ad6e6ab7a7c9.up_meta

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\6faba965-83b0-4727-9cf6-f717a8d19482.593aeaca-14dd-4f73-a505-b9177043fbb4.down_meta

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\6faba965-83b0-4727-9cf6-f717a8d19482.up_meta

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\7d74c1c9-e7b4-43ae-af85-d91ef9a0b3dd.593aeaca-14dd-4f73-a505-b9177043fbb4.down_meta

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\7d74c1c9-e7b4-43ae-af85-d91ef9a0b3dd.down_data

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\883a00d1-26f9-46de-b0d6-299b64c5e1d5.8072ed17-626f-4b05-8d4e-e1f8c9d17eb3.down_meta

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\883a00d1-26f9-46de-b0d6-299b64c5e1d5.up_meta

Windows Analysis Report
UBpReASuEC