Click to jump to signature section
Source: zp.exe | Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE |
Source: | Binary string: mshtml.pdb source: zp.exe, 00000002.00000001.5590107650.0000000000649000.00000020.00000001.01000000.00000006.sdmp |
Source: | Binary string: mshtml.pdbUGP source: zp.exe, 00000002.00000001.5590107650.0000000000649000.00000020.00000001.01000000.00000006.sdmp |
Source: C:\Users\user\Desktop\zp.exe | Code function: 0_2_00405FE2 FindFirstFileA,FindClose, | 0_2_00405FE2 |
Source: C:\Users\user\Desktop\zp.exe | Code function: 0_2_0040559E CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose, | 0_2_0040559E |
Source: C:\Users\user\Desktop\zp.exe | Code function: 0_2_00402645 FindFirstFileA, | 0_2_00402645 |
Source: C:\Windows\System32\certreq.exe | File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache | Jump to behavior |
Source: C:\Windows\System32\certreq.exe | File opened: C:\Users\user\AppData\Local\Adobe | Jump to behavior |
Source: C:\Windows\System32\certreq.exe | File opened: C:\Users\user\AppData\Local\Adobe\Acrobat | Jump to behavior |
Source: C:\Windows\System32\certreq.exe | File opened: C:\Users\user\AppData\Local | Jump to behavior |
Source: C:\Windows\System32\certreq.exe | File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC | Jump to behavior |
Source: C:\Windows\System32\certreq.exe | File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA | Jump to behavior |
Source: Joe Sandbox View | IP Address: 203.175.174.69 203.175.174.69 |
Source: global traffic | HTTP traffic detected: GET /rh/rh.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/112.0Host: bluemaxxlaser.com |
Source: global traffic | TCP traffic: 192.168.11.20:49756 -> 45.66.230.155:2537 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.66.230.155 |
Source: zp.exe, 00000002.00000002.6347310970.00000000036AB000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: http://bluemaxxlaser.com/ |
Source: zp.exe, 00000002.00000003.6283703653.00000000036CA000.00000004.00000020.00020000.00000000.sdmp, zp.exe, 00000002.00000002.6347310970.00000000036AB000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: http://bluemaxxlaser.com/rh/rh.bin |
Source: zp.exe, 00000002.00000002.6347310970.0000000003668000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: http://bluemaxxlaser.com/rh/rh.bin. |
Source: zp.exe, 00000002.00000002.6359786003.0000000032E90000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: http://bluemaxxlaser.com/rh/rh.binApoasNatalramsyadvocates.com/rh/rh.bin |
Source: zp.exe, 00000002.00000002.6347310970.0000000003668000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: http://bluemaxxlaser.com/rh/rh.bine |
Source: zp.exe, 00000002.00000002.6347310970.0000000003668000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: http://bluemaxxlaser.com/rh/rh.bineQ%d |
Source: zp.exe, 00000002.00000002.6347310970.00000000036AB000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: http://bluemaxxlaser.com/rh/rh.binrU |
Source: zp.exe, 00000002.00000001.5590107650.0000000000649000.00000020.00000001.01000000.00000006.sdmp | String found in binary or memory: http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference. |
Source: text-x-generic-template.png.0.dr | String found in binary or memory: http://jimmac.musichall.czif |
Source: zp.exe, Unchurch.exe.2.dr | String found in binary or memory: http://nsis.sf.net/NSIS_Error |
Source: zp.exe, Unchurch.exe.2.dr | String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError |
Source: zp.exe, 00000002.00000001.5590107650.0000000000649000.00000020.00000001.01000000.00000006.sdmp | String found in binary or memory: http://www.gopher.ftp://ftp. |
Source: zp.exe, 00000002.00000001.5590107650.0000000000626000.00000020.00000001.01000000.00000006.sdmp | String found in binary or memory: http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD |
Source: zp.exe, 00000002.00000001.5590107650.00000000005F2000.00000020.00000001.01000000.00000006.sdmp | String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd |
Source: zp.exe, 00000002.00000001.5590107650.00000000005F2000.00000020.00000001.01000000.00000006.sdmp | String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd |
Source: certreq.exe, 00000005.00000003.6633428832.00000215CFE62000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://discord.com |
Source: certreq.exe, 00000005.00000003.6633428832.00000215CFE62000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://discordapp.com |
Source: certreq.exe, 00000005.00000003.6521668733.00000215CFE62000.00000004.00000020.00020000.00000000.sdmp, certreq.exe, 00000005.00000003.6632256371.00000215CFE62000.00000004.00000020.00020000.00000000.sdmp, certreq.exe, 00000005.00000003.6625019609.00000215CFE62000.00000004.00000020.00020000.00000000.sdmp, certreq.exe, 00000005.00000003.6517161518.00000215CFE62000.00000004.00000020.00020000.00000000.sdmp, certreq.exe, 00000005.00000003.6631091124.00000215CFE62000.00000004.00000020.00020000.00000000.sdmp, certreq.exe, 00000005.00000003.6546018409.00000215CFE62000.00000004.00000020.00020000.00000000.sdmp, certreq.exe, 00000005.00000003.6549917437.00000215CFE62000.00000004.00000020.00020000.00000000.sdmp, certreq.exe, 00000005.00000003.6587995571.00000215CFE62000.00000004.00000020.00020000.00000000.sdmp, certreq.exe, 00000005.00000003.6594375401.00000215CFE62000.00000004.00000020.00020000.00000000.sdmp, certreq.exe, 00000005.00000003.6586715711.00000215CFE62000.00000004.00000020.00020000.00000000.sdmp, certreq.exe, 00000005.00000003.6613298341.00000215CFE62000.00000004.00000020.00020000.00000000.sdmp, certreq.exe, 00000005.00000003.6509817279.00000215CFE62000.00000004.00000020.00020000.00000000.sdmp, certreq.exe, 00000005.00000003.6565214935.00000215CFE62000.00000004.00000020.00020000.00000000.sdmp, certreq.exe, 00000005.00000003.6522814593.00000215CFE62000.00000004.00000020.00020000.00000000.sdmp, certreq.exe, 00000005.00000003.6622501624.00000215CFE62000.00000004.00000020.00020000.00000000.sdmp, certreq.exe, 00000005.00000003.6511122104.00000215CFE62000.00000004.00000020.00020000.00000000.sdmp, certreq.exe, 00000005.00000003.6567804977.00000215CFE62000.00000004.00000020.00020000.00000000.sdmp, certreq.exe, 00000005.00000003.6562592625.00000215CFE62000.00000004.00000020.00020000.00000000.sdmp, certreq.exe, 00000005.00000003.6504772908.00000215CFE62000.00000004.00000020.00020000.00000000.sdmp, certreq.exe, 00000005.00000003.6626224955.00000215CFE62000.00000004.00000020.00020000.00000000.sdmp, certreq.exe, 00000005.00000003.6605536412.00000215CFE62000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://http:///etc/puk.keyGET13ConnectionupgradeUpgradewebsocketUser-AgentAccept-Encodinggzip |
Source: certreq.exe, 00000005.00000003.6495131172.00000215CFD8F000.00000004.00000020.00020000.00000000.sdmp, certreq.exe, 00000005.00000003.6502645292.00000215CFD86000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://http:///etc/puk.keyMachineGuid |
Source: zp.exe, 00000002.00000001.5590107650.0000000000649000.00000020.00000001.01000000.00000006.sdmp | String found in binary or memory: https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214 |
Source: unknown | DNS traffic detected: queries for: bluemaxxlaser.com |
Source: global traffic | HTTP traffic detected: GET /rh/rh.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/112.0Host: bluemaxxlaser.com |
Source: C:\Users\user\Desktop\zp.exe | Code function: 0_2_00405107 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard, | 0_2_00405107 |
Source: zp.exe | Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE |
Source: C:\Users\user\Desktop\zp.exe | Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7940 -s 1468 |
Source: C:\Users\user\Desktop\zp.exe | Code function: 0_2_00403217 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess, | 0_2_00403217 |
Source: C:\Users\user\Desktop\zp.exe | Code function: 0_2_00404946 | 0_2_00404946 |
Source: C:\Users\user\Desktop\zp.exe | Code function: 0_2_004062B8 | 0_2_004062B8 |
Source: C:\Windows\System32\certreq.exe | Code function: 5_3_00000215CE004A10 | 5_3_00000215CE004A10 |
Source: C:\Windows\System32\certreq.exe | Code function: 5_3_00000215CE002792 | 5_3_00000215CE002792 |
Source: C:\Windows\System32\certreq.exe | Code function: 5_3_00000215CE001B9C | 5_3_00000215CE001B9C |
Source: C:\Windows\System32\certreq.exe | Code function: 5_3_00000215CE002C32 | 5_3_00000215CE002C32 |
Source: C:\Windows\System32\certreq.exe | Code function: 5_3_00000215CE005E54 | 5_3_00000215CE005E54 |
Source: C:\Windows\System32\certreq.exe | Code function: 5_3_00000215CE005554 | 5_3_00000215CE005554 |
Source: C:\Windows\System32\certreq.exe | Code function: 5_3_00000215CE0058D4 | 5_3_00000215CE0058D4 |
Source: C:\Windows\System32\certreq.exe | Code function: 5_3_00000215CE0024ED | 5_3_00000215CE0024ED |
Source: C:\Windows\System32\certreq.exe | Code function: 5_3_00000215CE0030A7 RtlRestoreThreadPreferredUILanguages,RtlAllocateHeap,RtlAllocateHeap,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,RtlDeleteBoundaryDescriptor,RtlDeleteBoundaryDescriptor, | 5_3_00000215CE0030A7 |
Source: zp.exe, 00000000.00000000.4817564292.0000000000475000.00000002.00000001.01000000.00000003.sdmp | Binary or memory string: OriginalFilenamemeibomian Oppegaaende.exe4 vs zp.exe |
Source: zp.exe, 00000002.00000000.5588949008.0000000000475000.00000002.00000001.01000000.00000003.sdmp | Binary or memory string: OriginalFilenamemeibomian Oppegaaende.exe4 vs zp.exe |
Source: zp.exe | Binary or memory string: OriginalFilenamemeibomian Oppegaaende.exe4 vs zp.exe |
Source: C:\Users\user\Desktop\zp.exe | Section loaded: edgegdi.dll | Jump to behavior |
Source: C:\Users\user\Desktop\zp.exe | Section loaded: edgegdi.dll | Jump to behavior |
Source: C:\Windows\System32\certreq.exe | Section loaded: edgegdi.dll | Jump to behavior |
Source: zp.exe | Virustotal: Detection: 14% |
Source: zp.exe | Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
Source: C:\Users\user\Desktop\zp.exe | Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers | Jump to behavior |
Source: unknown | Process created: C:\Users\user\Desktop\zp.exe C:\Users\user\Desktop\zp.exe | |
Source: C:\Users\user\Desktop\zp.exe | Process created: C:\Users\user\Desktop\zp.exe C:\Users\user\Desktop\zp.exe | |
Source: C:\Users\user\Desktop\zp.exe | Process created: C:\Windows\System32\certreq.exe C:\Windows\system32\certreq.exe | |
Source: C:\Windows\System32\certreq.exe | Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 | |
Source: C:\Users\user\Desktop\zp.exe | Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7940 -s 1468 | |
Source: C:\Users\user\Desktop\zp.exe | Process created: C:\Windows\System32\certreq.exe C:\Windows\system32\certreq.exe | Jump to behavior |
Source: C:\Users\user\Desktop\zp.exe | Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 | Jump to behavior |
Source: C:\Users\user\Desktop\zp.exe | File created: C:\Users\user\AppData\Local\Temp\nsf4051.tmp | Jump to behavior |
Source: classification engine | Classification label: mal100.troj.spyw.evad.winEXE@6/7@1/2 |
Source: C:\Users\user\Desktop\zp.exe | Code function: 0_2_00402036 CoCreateInstance,MultiByteToWideChar, | 0_2_00402036 |
Source: C:\Users\user\Desktop\zp.exe | Code function: 0_2_0040440A GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA, | 0_2_0040440A |
Source: C:\Windows\System32\conhost.exe | Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7268:120:WilError_03 |
Source: C:\Users\user\Desktop\zp.exe | Mutant created: \Sessions\1\BaseNamedObjects\MSCTF.Asm.{00000009-4fb3f26-9d18-66b568-627b8a85e4b6} |
Source: C:\Windows\System32\conhost.exe | Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7268:304:WilStaging_02 |
Source: C:\Windows\System32\certreq.exe | Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\7.0\Outlook\Profiles\Outlook | Jump to behavior |
Source: | Binary string: mshtml.pdb source: zp.exe, 00000002.00000001.5590107650.0000000000649000.00000020.00000001.01000000.00000006.sdmp |
Source: | Binary string: mshtml.pdbUGP source: zp.exe, 00000002.00000001.5590107650.0000000000649000.00000020.00000001.01000000.00000006.sdmp |
Source: Yara match | File source: 00000000.00000002.5790793651.0000000006DAD000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: C:\Users\user\Desktop\zp.exe | Code function: 0_2_10002D40 push eax; ret | 0_2_10002D6E |
Source: C:\Users\user\Desktop\zp.exe | Code function: 2_3_0007582C push ebp; iretd | 2_3_0007582D |
Source: C:\Users\user\Desktop\zp.exe | Code function: 2_3_00073854 push eax; ret | 2_3_00073955 |
Source: C:\Users\user\Desktop\zp.exe | Code function: 2_3_00074ABD push dword ptr [edx+ebp+3Bh]; retf | 2_3_00074ACA |
Source: C:\Users\user\Desktop\zp.exe | Code function: 2_3_000738BC push eax; ret | 2_3_00073955 |
Source: C:\Users\user\Desktop\zp.exe | Code function: 2_3_00075323 push es; retf | 2_3_00075324 |
Source: C:\Users\user\Desktop\zp.exe | Code function: 2_3_00075366 push esp; retf | 2_3_00075376 |
Source: C:\Users\user\Desktop\zp.exe | Code function: 2_3_00072F9A push esi; retf | 2_3_00072F9B |
Source: C:\Users\user\Desktop\zp.exe | Code function: 2_3_00072FA6 push es; retf | 2_3_00072FAF |
Source: C:\Users\user\Desktop\zp.exe | Code function: 2_3_000753EE pushad ; ret | 2_3_000753F1 |
Source: C:\Users\user\Desktop\zp.exe | Code function: 0_2_00406009 GetModuleHandleA,LoadLibraryA,GetProcAddress, | 0_2_00406009 |
Source: C:\Users\user\Desktop\zp.exe | File created: C:\Users\user\AppData\Local\Temp\nsq8C22.tmp\System.dll | Jump to dropped file |
Source: C:\Users\user\Desktop\zp.exe | File created: C:\Users\user\AppData\Local\Temp\subfolder1\Unchurch.exe | Jump to dropped file |
Source: C:\Users\user\Desktop\zp.exe | File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Langust | Jump to behavior |
Source: C:\Users\user\Desktop\zp.exe | File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Langust\Grade | Jump to behavior |
Source: C:\Users\user\Desktop\zp.exe | Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Startup key | Jump to behavior |
Source: C:\Users\user\Desktop\zp.exe | Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Startup key | Jump to behavior |
Source: C:\Users\user\Desktop\zp.exe | Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Startup key | Jump to behavior |
Source: C:\Users\user\Desktop\zp.exe | Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Startup key | Jump to behavior |
Source: C:\Users\user\Desktop\zp.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\zp.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\zp.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\zp.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\zp.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\zp.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\zp.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\zp.exe | Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\zp.exe | Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\certreq.exe | Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\certreq.exe | Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\conhost.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | Jump to behavior |
Source: Yara match | File source: 00000002.00000003.6285988556.00000000000D2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: zp.exe PID: 7940, type: MEMORYSTR |
Source: C:\Users\user\Desktop\zp.exe | File opened: C:\Program Files\Qemu-ga\qemu-ga.exe | Jump to behavior |
Source: C:\Users\user\Desktop\zp.exe | File opened: C:\Program Files\qga\qga.exe | Jump to behavior |
Source: zp.exe, 00000002.00000003.5749632530.000000003397E000.00000004.00000020.00020000.00000000.sdmp, zp.exe, 00000002.00000003.6282989504.000000003397E000.00000004.00000020.00020000.00000000.sdmp, zp.exe, 00000002.00000003.5790556301.000000003397E000.00000004.00000020.00020000.00000000.sdmp, zp.exe, 00000002.00000003.6283407634.000000003397E000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: PROCMON.EXE |
Source: zp.exe, 00000002.00000003.5749632530.000000003397E000.00000004.00000020.00020000.00000000.sdmp, zp.exe, 00000002.00000003.6282989504.000000003397E000.00000004.00000020.00020000.00000000.sdmp, zp.exe, 00000002.00000003.5790556301.000000003397E000.00000004.00000020.00020000.00000000.sdmp, zp.exe, 00000002.00000003.6283407634.000000003396D000.00000004.00000020.00020000.00000000.sdmp, zp.exe, 00000002.00000003.6283407634.000000003397E000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: HOOKEXPLORER.EXE |
Source: zp.exe, 00000002.00000003.5749632530.000000003397E000.00000004.00000020.00020000.00000000.sdmp, zp.exe, 00000002.00000003.6282989504.000000003397E000.00000004.00000020.00020000.00000000.sdmp, zp.exe, 00000002.00000003.5790556301.000000003397E000.00000004.00000020.00020000.00000000.sdmp, zp.exe, 00000002.00000003.6283407634.000000003396D000.00000004.00000020.00020000.00000000.sdmp, zp.exe, 00000002.00000003.6283407634.000000003397E000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: AUTORUNSC.EXE |
Source: zp.exe, 00000002.00000003.5749632530.000000003397E000.00000004.00000020.00020000.00000000.sdmp, zp.exe, 00000002.00000003.6282989504.000000003397E000.00000004.00000020.00020000.00000000.sdmp, zp.exe, 00000002.00000003.5790556301.000000003397E000.00000004.00000020.00020000.00000000.sdmp, zp.exe, 00000002.00000003.6283407634.000000003396D000.00000004.00000020.00020000.00000000.sdmp, zp.exe, 00000002.00000003.6283407634.000000003397E000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: OLLYDBG.EXE |
Source: zp.exe, 00000002.00000003.6285988556.00000000000D2000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: WQLRANDOMRANDOM NAME%THISISANINVALIDFILENAME?[]<>@\;*!-{}#:/~%%THISISANINVALIDENVIRONMENTVARIABLENAME?[]<>@\;*!-{}#:/~%CMDVRT32.DLLCMDVRT64.DLLWPESPY.DLLVMCHECK.DLLPSTOREC.DLLDIR_WATCH.DLLAPI_LOG.DLLDBGHELP.DLLSBIEDLL.DLLSNXHK.DLLAVGHOOKA.DLLAVGHOOKX.DLLTESTAPP.EXEMYAPP.EXEKLAVME.EXETEST.EXEMALWARE.EXESANDBOX.EXEBOT.EXESAMPLE.EXEJOHN DOEVIRUSTEST USERMALTESTMALWARESAND BOXUSERTIMMYPETER WILSONMILOZSMILLERJOHNSONIT-ADMINHONG LEEHAPUBWSEMILYSANDBOXCURRENTUSERTEQUILABOOMBOOMFORTINETWIN7-TRAPSMUELLER-PCJOHN-PCHANSPETER-PCHAL9TH7SILVIAXPAMAST-SCSANDBOXWILBERT-SCCWSXXXXX-OXNMSDBOXCUCKOOCOMPUTERNAMEANDYANONYMOUSUSERC:\A\FOOBAR.GIFC:\A\FOOBAR.DOCC:\A\FOOBAR.BMPC:\123\EMAIL.DOCXC:\123\EMAIL.DOCC:\EMAIL.HTMC:\EMAIL.DOCC:\LOADDLL.EXEC:\TAKE_SCREENSHOT.PS1JOHNKLONE_X64-PCSYSTEMITADMINSWSCWILBERNUMBEROFCORESSELECT * FROM WIN32_PROCESSORROOT\CIMV2VIRTUALQEMUVMWAREVBOXVBOXVBOXVBOXPARALLELS HVPRL HYPERV XENVMMXENVMMVMWAREVMWAREMICROSOFT HVKVMKVMKVMA M IVIRTUALXEN0PARALLELSVMWARESERIALNUMBERSELECT * FROM WIN32_BIOSHVM DOMUVIRTUALBOXMODELSELECT * FROM WIN32_COMPUTERSYSTEMQEMUINNOTEK GMBHMANUFACTURERPROCESSORIDVMWXENVIRTIOSYSTEM\CURRENTCONTROLSET\ENUM\SCSISYSTEM\CURRENTCONTROLSET\ENUM\IDESELECT * FROM CIM_PHYSICALCONNECTOR06/23/99SYSTEMBIOSDATEVIRTUALBOXVIDEOBIOSVERSIONSYSTEMBIOSVERSIONIDENTIFIERHARDWARE\DEVICEMAP\SCSI\SCSI PORT 0\SCSI BUS 0\TARGET ID 0\LOGICAL UNIT ID 0HARDWARE\DESCRIPTION\SYSTEMVBOXSYSTEM\CONTROLSET001\SERVICES\VBOXVIDEOSYSTEM\CONTROLSET001\SERVICES\VBOXSFSYSTEM\CONTROLSET001\SERVICES\VBOXSERVICESYSTEM\CONTROLSET001\SERVICES\VBOXMOUSESYSTEM\CONTROLSET001\SERVICES\VBOXGUESTSOFTWARE\ORACLE\VIRTUALBOX GUEST ADDITIONSHARDWARE\ACPI\RSDT\VBOX__HARDWARE\ACPI\FADT\VBOX__HARDWARE\ACPI\DSDT\VBOX__SYSTEM32\VBOXCONTROL.EXESYSTEM32\VBOXTRAY.EXESYSTEM32\VBOXSERVICE.EXESYSTEM32\VBOXOGLPASSTHROUGHSPU.DLLSYSTEM32\VBOXOGLPACKSPU.DLLSYSTEM32\VBOXOGLFEEDBACKSPU.DLLSYSTEM32\VBOXOGLERRORSPU.DLLSYSTEM32\VBOXOGLCRUTIL.DLLSYSTEM32\VBOXOGLARRAYSPU.DLLSYSTEM32\VBOXOGL.DLLSYSTEM32\VBOXMRXNP.DLLSYSTEM32\VBOXHOOK.DLLSYSTEM32\VBOXDISP.DLLSYSTEM32\DRIVERS\VBOXVIDEO.SYSSYSTEM32\DRIVERS\VBOXSF.SYSSYSTEM32\DRIVERS\VBOXGUEST.SYSSYSTEM32\DRIVERS\VBOXMOUSE.SYS%PROGRAMW6432%\\.\PIPE\VBOXTRAYIPC\\.\VBOXTRAYIPC\\.\PIPE\VBOXMINIRDDN\\.\VBOXGUEST\\.\VBOXMINIRDRDNVBOXTRAYTOOLWNDVBOXTRAYTOOLWNDCLASSVIRTUALBOX SHARED FOLDERSVBOXTRAY.EXEVBOXSERVICE.EXEPCI\VEN_80EE&DEV_CAFEDEVICEIDSELECT * FROM WIN32_PNPENTITYOPENHCD82371SB82441FX82801FBNAMEVEN_VBOXPNPDEVICEIDCAPTIONSELECT |