Edit tour

Windows Analysis Report
BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe

Overview

General Information

Sample name:	BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe
Analysis ID:	1500932
MD5:	7f875e9692c89a590bec32494693d763
SHA1:	8dc17de352faefc31826e4b2de82f2bc25ce3883
SHA256:	430ca931fb30ead2352f1f6cc4c832d5e83d0586818e47febd3d9d2dd83950de
Tags:	exe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses an obfuscated file name to hide its real file extension (double extension)

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe (PID: 6332 cmdline: "C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe" MD5: 7F875E9692C89A590BEC32494693D763)

powershell.exe (PID: 2616 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe (PID: 4952 cmdline: "C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe" MD5: 7F875E9692C89A590BEC32494693D763)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://beirutrest.com", "Username": "belogs@beirutrest.com", "Password": "9yXQ39wz(uL+"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.4496651136.0000000002CDC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.4494909978.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.4494909978.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.4496651136.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.4496651136.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2070418758.00000000034C9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2070418758.00000000034C9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe PID: 6332	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe PID: 6332	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe PID: 6332	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe PID: 4952	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe PID: 4952	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x330d3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33145:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x331cf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33261:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x332cb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3333d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x333d3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33463:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
4.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x304c6:$s2: GetPrivateProfileString 0x2fbc5:$s3: get_OSFullName 0x31203:$s5: remove_Key 0x31392:$s5: remove_Key 0x32273:$s6: FtpWebRequest 0x330b5:$s7: logins 0x33627:$s7: logins 0x3630a:$s7: logins 0x363ea:$s7: logins 0x37ce6:$s7: logins 0x36f84:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.3503f90.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.3503f90.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.3503f90.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x312d3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31345:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x313cf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31461:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x314cb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3153d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x315d3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31663:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.3503f90.1.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2e6c6:$s2: GetPrivateProfileString 0x2ddc5:$s3: get_OSFullName 0x2f403:$s5: remove_Key 0x2f592:$s5: remove_Key 0x30473:$s6: FtpWebRequest 0x312b5:$s7: logins 0x31827:$s7: logins 0x3450a:$s7: logins 0x345ea:$s7: logins 0x35ee6:$s7: logins 0x35184:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.34c9970.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.34c9970.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.34c9970.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x312d3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31345:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x313cf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31461:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x314cb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3153d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x315d3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31663:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.34c9970.2.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2e6c6:$s2: GetPrivateProfileString 0x2ddc5:$s3: get_OSFullName 0x2f403:$s5: remove_Key 0x2f592:$s5: remove_Key 0x30473:$s6: FtpWebRequest 0x312b5:$s7: logins 0x31827:$s7: logins 0x3450a:$s7: logins 0x345ea:$s7: logins 0x35ee6:$s7: logins 0x35184:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.3503f90.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.3503f90.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.3503f90.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.3503f90.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x330d3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6d4f3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33145:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6d565:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x331cf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6d5ef:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33261:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6d681:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x332cb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6d6eb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3333d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6d75d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x333d3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6d7f3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33463:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6d883:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.3503f90.1.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x304c6:$s2: GetPrivateProfileString 0x6a8e6:$s2: GetPrivateProfileString 0x2fbc5:$s3: get_OSFullName 0x69fe5:$s3: get_OSFullName 0x31203:$s5: remove_Key 0x31392:$s5: remove_Key 0x6b623:$s5: remove_Key 0x6b7b2:$s5: remove_Key 0x32273:$s6: FtpWebRequest 0x6c693:$s6: FtpWebRequest 0x330b5:$s7: logins 0x33627:$s7: logins 0x3630a:$s7: logins 0x363ea:$s7: logins 0x37ce6:$s7: logins 0x6d4d5:$s7: logins 0x6da47:$s7: logins 0x7072a:$s7: logins 0x7080a:$s7: logins 0x72106:$s7: logins 0x36f84:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.34c9970.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.34c9970.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.34c9970.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.34c9970.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x330d3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6d6f3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa7b13:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33145:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6d765:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa7b85:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x331cf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6d7ef:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa7c0f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33261:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6d881:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa7ca1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x332cb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6d8eb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa7d0b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3333d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6d95d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa7d7d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x333d3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6d9f3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa7e13:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.34c9970.2.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x304c6:$s2: GetPrivateProfileString 0x6aae6:$s2: GetPrivateProfileString 0xa4f06:$s2: GetPrivateProfileString 0x2fbc5:$s3: get_OSFullName 0x6a1e5:$s3: get_OSFullName 0xa4605:$s3: get_OSFullName 0x31203:$s5: remove_Key 0x31392:$s5: remove_Key 0x6b823:$s5: remove_Key 0x6b9b2:$s5: remove_Key 0xa5c43:$s5: remove_Key 0xa5dd2:$s5: remove_Key 0x32273:$s6: FtpWebRequest 0x6c893:$s6: FtpWebRequest 0xa6cb3:$s6: FtpWebRequest 0x330b5:$s7: logins 0x33627:$s7: logins 0x3630a:$s7: logins 0x363ea:$s7: logins 0x37ce6:$s7: logins 0x6d6d5:$s7: logins
Click to see the 17 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe", ParentImage: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe, ParentProcessId: 6332, ParentProcessName: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe", ProcessId: 2616, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe", ParentImage: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe, ParentProcessId: 6332, ParentProcessName: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe", ProcessId: 2616, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe

Avira: detected

Found malware configuration

Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.34c9970.2.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://beirutrest.com", "Username": "belogs@beirutrest.com", "Password": "9yXQ39wz(uL+"}

Multi AV Scanner detection for submitted file

Source: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	ReversingLabs: Detection: 23%
Source: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Virustotal: Detection: 37%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe

Joe Sandbox ML: detected

Source: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.5:49706 version: TLS 1.2

Source: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe

Code function: 4x nop then jmp 068741B5h

0_2_06873956

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.3503f90.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.34c9970.2.raw.unpack, type: UNPACKEDPE

Source: Joe Sandbox View	IP Address: 50.87.144.157 50.87.144.157
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: beirutrest.com

Source: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe, 00000004.00000002.4496651136.0000000002CDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://beirutrest.com
Source: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe, 00000000.00000002.2069896097.000000000252E000.00000004.00000800.00020000.00000000.sdmp, BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe, 00000004.00000002.4496651136.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe, 00000000.00000002.2070418758.00000000034C9000.00000004.00000800.00020000.00000000.sdmp, BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe, 00000004.00000002.4494909978.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe, 00000000.00000002.2070418758.00000000034C9000.00000004.00000800.00020000.00000000.sdmp, BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe, 00000004.00000002.4494909978.0000000000402000.00000040.00000400.00020000.00000000.sdmp, BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe, 00000004.00000002.4496651136.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe, 00000004.00000002.4496651136.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe, 00000004.00000002.4496651136.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.5:49706 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.34c9970.2.raw.unpack, n00.cs	.Net Code: lGCzgIzdr
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.3503f90.1.raw.unpack, n00.cs	.Net Code: lGCzgIzdr

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.3503f90.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.3503f90.1.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.34c9970.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.34c9970.2.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.3503f90.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.3503f90.1.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.34c9970.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.34c9970.2.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen

Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Code function: 0_2_04A8DFB8	0_2_04A8DFB8
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Code function: 0_2_04A86C80	0_2_04A86C80
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Code function: 0_2_04A86C71	0_2_04A86C71
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Code function: 0_2_04A8DFA8	0_2_04A8DFA8
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Code function: 0_2_04A848C4	0_2_04A848C4
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Code function: 0_2_06870EE8	0_2_06870EE8
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Code function: 0_2_06871889	0_2_06871889
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Code function: 0_2_06871898	0_2_06871898
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Code function: 4_2_00EEE5C8	4_2_00EEE5C8
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Code function: 4_2_00EEA9E0	4_2_00EEA9E0
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Code function: 4_2_00EE4A58	4_2_00EE4A58
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Code function: 4_2_00EEDD38	4_2_00EEDD38
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Code function: 4_2_00EE3E40	4_2_00EE3E40
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Code function: 4_2_00EE4188	4_2_00EE4188
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Code function: 4_2_068CA4D5	4_2_068CA4D5
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Code function: 4_2_068C8970	4_2_068C8970
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Code function: 4_2_068CB5F8	4_2_068CB5F8
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Code function: 4_2_068CD3F0	4_2_068CD3F0
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Code function: 4_2_068D7D80	4_2_068D7D80
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Code function: 4_2_068D55A0	4_2_068D55A0
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Code function: 4_2_068D65F0	4_2_068D65F0
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Code function: 4_2_068DB248	4_2_068DB248
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Code function: 4_2_068D2350	4_2_068D2350
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Code function: 4_2_068DC190	4_2_068DC190
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Code function: 4_2_068D76A0	4_2_068D76A0
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Code function: 4_2_068D5CF8	4_2_068D5CF8
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Code function: 4_2_068DE3A8	4_2_068DE3A8
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Code function: 4_2_068D0040	4_2_068D0040
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Code function: 4_2_068D0006	4_2_068D0006
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Code function: 4_2_068D0160	4_2_068D0160

Source: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe, 00000000.00000002.2069896097.000000000252E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename2ee75d06-d489-4537-90fc-92fe0f559436.exe4 vs BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe
Source: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe, 00000000.00000002.2069896097.00000000024C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameGB-lesson-forms.dll@ vs BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe
Source: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe, 00000000.00000002.2074656852.0000000006B20000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe
Source: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe, 00000000.00000002.2057831425.000000000080E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe
Source: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe, 00000000.00000002.2074931293.0000000008427000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePowerShell.EXEj% vs BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe
Source: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe, 00000000.00000002.2070418758.00000000034C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename2ee75d06-d489-4537-90fc-92fe0f559436.exe4 vs BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe
Source: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe, 00000000.00000002.2070418758.00000000034C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe
Source: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe, 00000000.00000002.2073332166.0000000005040000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameGB-lesson-forms.dll@ vs BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe
Source: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe, 00000004.00000002.4494909978.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilename2ee75d06-d489-4537-90fc-92fe0f559436.exe4 vs BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe
Source: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe, 00000004.00000002.4495058592.0000000000CF9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe
Source: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Binary or memory string: OriginalFilenamemlbo.exeB vs BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe

Source: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 4.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.3503f90.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.3503f90.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.34c9970.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.34c9970.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.3503f90.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.3503f90.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.34c9970.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.34c9970.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload

Source: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.34c9970.2.raw.unpack, NpXw3kw.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.34c9970.2.raw.unpack, NpXw3kw.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.34c9970.2.raw.unpack, gyfrCFT5x9I.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.34c9970.2.raw.unpack, gyfrCFT5x9I.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.34c9970.2.raw.unpack, gyfrCFT5x9I.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.34c9970.2.raw.unpack, gyfrCFT5x9I.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.34c9970.2.raw.unpack, fpnV0Qjz.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.34c9970.2.raw.unpack, fpnV0Qjz.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.6b20000.5.raw.unpack, xU0gFtUZqtk2agxQY9.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.36cde80.3.raw.unpack, BJCehrLTbiRMjcNY6M.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.36cde80.3.raw.unpack, BJCehrLTbiRMjcNY6M.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.36cde80.3.raw.unpack, BJCehrLTbiRMjcNY6M.cs	Security API names: _0020.AddAccessRule
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.36cde80.3.raw.unpack, xU0gFtUZqtk2agxQY9.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.6b20000.5.raw.unpack, BJCehrLTbiRMjcNY6M.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.6b20000.5.raw.unpack, BJCehrLTbiRMjcNY6M.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.6b20000.5.raw.unpack, BJCehrLTbiRMjcNY6M.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/6@2/2

Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:320:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xm4obhw3.kei.ps1

Jump to behavior

Source: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	ReversingLabs: Detection: 23%
Source: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Virustotal: Detection: 37%

Source: unknown	Process created: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe "C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe"
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe"
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process created: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe "C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe"	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process created: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe "C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe"	Jump to behavior

Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.36cde80.3.raw.unpack, BJCehrLTbiRMjcNY6M.cs	.Net Code: zhekQqkZd9 System.Reflection.Assembly.Load(byte[])
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.6b20000.5.raw.unpack, BJCehrLTbiRMjcNY6M.cs	.Net Code: zhekQqkZd9 System.Reflection.Assembly.Load(byte[])
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.5040000.4.raw.unpack, .cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.24f9550.0.raw.unpack, .cs	.Net Code: System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Code function: 0_2_04A88AEE push 8B5004A8h; iretd	0_2_04A88AF3
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Code function: 0_2_06872F20 push eax; retf	0_2_06872F21
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Code function: 0_2_0687735D push FFFFFF8Bh; iretd	0_2_0687735F
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Code function: 4_2_00EE0C55 push edi; retf	4_2_00EE0C7A

Source: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe

Static PE information: section name: .text entropy: 7.97638614028424

Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.36cde80.3.raw.unpack, impLQT6mt3Cp1WMbyL.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'pu0NbB7HCs', 'KyjN7kJCyY', 'HKhNzmoBrl', 'LX0h2CIdY2', 'B8ehZbEb5I', 'jgxhNMI8qx', 'cIDhhGlj4U', 'OFkGKmk5TUHup4DhVFg'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.36cde80.3.raw.unpack, xU0gFtUZqtk2agxQY9.cs	High entropy of concatenated method names: 'aZs1i7aWJ2', 'D3D1GhQqjS', 'mEI1SCqawN', 'uc71xAhqU8', 'jX11TtHNSL', 'Qc016ALZMH', 'Nvs15RSGNJ', 'KhS1mF4Ec2', 'Vtx1bqRmA4', 'Xag17N9taI'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.36cde80.3.raw.unpack, v9o8BhaOSalRh3OUFeW.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'qkpAibFvAT', 'YwHAGsNARB', 'saHASDLJYn', 'TXOAxu3cll', 'R2QATF8VWc', 'XPFA6e4MoX', 'YijA5qDO14'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.36cde80.3.raw.unpack, VXStFOh1lvwAhANhj5.cs	High entropy of concatenated method names: 'sAGJqfXXcZ', 'AN8JI7V1E9', 'bgftBKjST3', 'L9ltsGfNEh', 'WAatuEuput', 'fsFtWK8WsH', 'AyttEvUn5X', 'wvdteAT5Bx', 'gLqtXZrMMa', 'rbbtDUKTHt'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.36cde80.3.raw.unpack, aVVUWPa5q61BJGnglmH.cs	High entropy of concatenated method names: 'RPRVwTIjQO', 'uA9VrkuaqW', 'ujeVQGHmbT', 'tr1Vpixnqb', 'GZIVqnugwq', 'VOlVa7ymyi', 'LV6VIRJdUx', 'NkuVLKkdfm', 'Rb7VF1dhFr', 'N0hVO5f2eJ'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.36cde80.3.raw.unpack, JWK6eM19hNPWadxom1.cs	High entropy of concatenated method names: 'TMkdmZcpJb', 'Xgvd7EaREM', 'SIl92PUiyG', 'tS49ZiGA6k', 'H8EdvsyvDa', 'IMld3wnCui', 'jMadlUSgdL', 'hAMdidLpOX', 'btZdGrNxu7', 'GiXdSBogf1'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.36cde80.3.raw.unpack, BJCehrLTbiRMjcNY6M.cs	High entropy of concatenated method names: 'bL6hohKLM1', 'CNHhKampDc', 'BCch1pD9JF', 'gt7htMfOGT', 'UpEhJCWKsm', 'QHChHw6IAh', 'vTrh8sgu4T', 'R3Vhc7x3YW', 'CYXh05q7R7', 'sbDhn3BhwR'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.36cde80.3.raw.unpack, hBCZLdBYFJKvT03nHI.cs	High entropy of concatenated method names: 'blYtphZE9g', 'Y9ntaGHEW5', 'XDmtLfgb3R', 'wp6tFP45xm', 'R98tCifOYp', 'VWxtjNAaqh', 'Y2Ltd1GpZZ', 'HJKt9bQVwd', 'JWstVV1ETB', 'dlUtAk1SMC'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.36cde80.3.raw.unpack, LowsqtCQiLJptw4SpD.cs	High entropy of concatenated method names: 'fkm8KZwUHJ', 'Fnx8tAJsmN', 'Iq78Hv1J0B', 'bhDH7WjBAD', 'PxMHz8YyWy', 'tkO822OtmN', 'Nj68Z2eBam', 'I3H8NHlGs0', 'KIT8h8XD9H', 'hnR8kahhdg'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.36cde80.3.raw.unpack, S9gpkOisHeI05m3iUD.cs	High entropy of concatenated method names: 'OmCdnKLyjw', 'aGydYresSZ', 'ToString', 'tkhdKJc92p', 'ipOd1sOMyU', 'YTwdtC7lKi', 'lZ1dJQTklG', 'rcidHX3TRA', 'XN6d8olBcW', 'kK6dclINM4'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.36cde80.3.raw.unpack, ogJ49Y9FHLTnqwLw9b.cs	High entropy of concatenated method names: 'BlH9KB0IEa', 'Gcg91GHfut', 'gvt9tnaljX', 'vrj9JpYYCO', 'C0i9HAtfto', 'FAg982X1Op', 'LZK9cSDMNa', 'si690WRE7F', 'RuC9nnXQr0', 'X4E9YfXkRn'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.36cde80.3.raw.unpack, o31gZ7DvYrI18XYuFZ.cs	High entropy of concatenated method names: 'eC89gGVwMk', 'h5H9P6nMsw', 'vsX9BLvAc3', 'nmu9s8TN5D', 'i889iyl3BO', 'BiK9ucYhsG', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.36cde80.3.raw.unpack, EmfNhAEIQ8HQg85dNT.cs	High entropy of concatenated method names: 'je1fLiYfw6', 'XnEfFH7Mkn', 'xO6fgPphOH', 's0HfPdNvNF', 'Qelfs0S6Vu', 'jp3fuHTtkH', 'w06fEsfHl7', 'vUhfeCJT5T', 'SEvfDHSBno', 'cgVfvQGU4V'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.36cde80.3.raw.unpack, bioOLd45rPBUc4mvK8.cs	High entropy of concatenated method names: 'Dispose', 'TenZbEQUmt', 'yWENPtlYCL', 'GQYRRQNL62', 'qDcZ7tV0dl', 'zm3ZzUwhnc', 'ProcessDialogKey', 'ysXN2tBKOH', 'KX7NZ5j9oB', 'mCSNNDeCtN'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.36cde80.3.raw.unpack, hq9t2mztHXoXls48dA.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'AIuVfUhdLe', 'qVwVCr4Hna', 'fkXVj3Oglg', 'bgeVdQy07d', 'GuqV98u3um', 'yG1VVcqR8M', 'WMrVA8CwLt'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.36cde80.3.raw.unpack, PnDJmBZ6PXJLAeXjwk.cs	High entropy of concatenated method names: 'XHm8wD7FBa', 'nTh8ryfgPO', 'NIs8QPu3ha', 'mEg8pjV2cI', 'og58qB2phu', 'iIw8aL3ueg', 'Lm78IMlbA6', 'zQ08LbG206', 'VRr8Fi49wI', 'JcE8OixF8J'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.36cde80.3.raw.unpack, QwpJBWraZi6Z0833Pm.cs	High entropy of concatenated method names: 'ySNHoslQJy', 'KHOH1q6YY0', 'ItAHJhqety', 'K2vH8GkQuh', 'E2wHc9hoiS', 'bMpJTcXh62', 'eT7J6UD8UR', 'ov3J5mG8qs', 'W9lJmMsKoc', 'YLwJbMH6ky'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.36cde80.3.raw.unpack, e9BZSWkLIUA9YGXxoY.cs	High entropy of concatenated method names: 'YoiVZITiF0', 'AphVhIo9Yd', 'ybXVkR15ZW', 'jTIVK9y9xH', 'adkV1LWIND', 'jwCVJAL5x2', 'ioNVHWwwL8', 'KGo95p00qX', 'AxH9mcDJ6C', 'daD9bBK1dr'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.36cde80.3.raw.unpack, KFHh3wyaqD2IO0r0Ko.cs	High entropy of concatenated method names: 'oKKZ8OdD8S', 'KQcZc8yX7G', 'VO9ZnMy5gt', 'aoKZYVKoD4', 'iNMZCyjyFN', 'Cw4Zj4N0Bc', 'dqasej1MycqDlnWFcL', 'hC8DLj72y71U0RZCf7', 'daCZZLhC9q', 'yggZhRhf3j'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.36cde80.3.raw.unpack, hneCu6mtxvA9GvWWkd.cs	High entropy of concatenated method names: 'X43Q7WaiR', 'KlXpRNpxm', 'BxeayyGFF', 'vjEIGfhep', 'YxTFVQAt9', 'fPBOAB0lN', 'TwyHBMIJJUtRYhZTug', 'cuuOL8yJUCX5WfCj9C', 'WSQ9WWhj2', 'McNADtfpE'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.6b20000.5.raw.unpack, impLQT6mt3Cp1WMbyL.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'pu0NbB7HCs', 'KyjN7kJCyY', 'HKhNzmoBrl', 'LX0h2CIdY2', 'B8ehZbEb5I', 'jgxhNMI8qx', 'cIDhhGlj4U', 'OFkGKmk5TUHup4DhVFg'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.6b20000.5.raw.unpack, xU0gFtUZqtk2agxQY9.cs	High entropy of concatenated method names: 'aZs1i7aWJ2', 'D3D1GhQqjS', 'mEI1SCqawN', 'uc71xAhqU8', 'jX11TtHNSL', 'Qc016ALZMH', 'Nvs15RSGNJ', 'KhS1mF4Ec2', 'Vtx1bqRmA4', 'Xag17N9taI'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.6b20000.5.raw.unpack, v9o8BhaOSalRh3OUFeW.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'qkpAibFvAT', 'YwHAGsNARB', 'saHASDLJYn', 'TXOAxu3cll', 'R2QATF8VWc', 'XPFA6e4MoX', 'YijA5qDO14'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.6b20000.5.raw.unpack, VXStFOh1lvwAhANhj5.cs	High entropy of concatenated method names: 'sAGJqfXXcZ', 'AN8JI7V1E9', 'bgftBKjST3', 'L9ltsGfNEh', 'WAatuEuput', 'fsFtWK8WsH', 'AyttEvUn5X', 'wvdteAT5Bx', 'gLqtXZrMMa', 'rbbtDUKTHt'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.6b20000.5.raw.unpack, aVVUWPa5q61BJGnglmH.cs	High entropy of concatenated method names: 'RPRVwTIjQO', 'uA9VrkuaqW', 'ujeVQGHmbT', 'tr1Vpixnqb', 'GZIVqnugwq', 'VOlVa7ymyi', 'LV6VIRJdUx', 'NkuVLKkdfm', 'Rb7VF1dhFr', 'N0hVO5f2eJ'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.6b20000.5.raw.unpack, JWK6eM19hNPWadxom1.cs	High entropy of concatenated method names: 'TMkdmZcpJb', 'Xgvd7EaREM', 'SIl92PUiyG', 'tS49ZiGA6k', 'H8EdvsyvDa', 'IMld3wnCui', 'jMadlUSgdL', 'hAMdidLpOX', 'btZdGrNxu7', 'GiXdSBogf1'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.6b20000.5.raw.unpack, BJCehrLTbiRMjcNY6M.cs	High entropy of concatenated method names: 'bL6hohKLM1', 'CNHhKampDc', 'BCch1pD9JF', 'gt7htMfOGT', 'UpEhJCWKsm', 'QHChHw6IAh', 'vTrh8sgu4T', 'R3Vhc7x3YW', 'CYXh05q7R7', 'sbDhn3BhwR'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.6b20000.5.raw.unpack, hBCZLdBYFJKvT03nHI.cs	High entropy of concatenated method names: 'blYtphZE9g', 'Y9ntaGHEW5', 'XDmtLfgb3R', 'wp6tFP45xm', 'R98tCifOYp', 'VWxtjNAaqh', 'Y2Ltd1GpZZ', 'HJKt9bQVwd', 'JWstVV1ETB', 'dlUtAk1SMC'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.6b20000.5.raw.unpack, LowsqtCQiLJptw4SpD.cs	High entropy of concatenated method names: 'fkm8KZwUHJ', 'Fnx8tAJsmN', 'Iq78Hv1J0B', 'bhDH7WjBAD', 'PxMHz8YyWy', 'tkO822OtmN', 'Nj68Z2eBam', 'I3H8NHlGs0', 'KIT8h8XD9H', 'hnR8kahhdg'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.6b20000.5.raw.unpack, S9gpkOisHeI05m3iUD.cs	High entropy of concatenated method names: 'OmCdnKLyjw', 'aGydYresSZ', 'ToString', 'tkhdKJc92p', 'ipOd1sOMyU', 'YTwdtC7lKi', 'lZ1dJQTklG', 'rcidHX3TRA', 'XN6d8olBcW', 'kK6dclINM4'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.6b20000.5.raw.unpack, ogJ49Y9FHLTnqwLw9b.cs	High entropy of concatenated method names: 'BlH9KB0IEa', 'Gcg91GHfut', 'gvt9tnaljX', 'vrj9JpYYCO', 'C0i9HAtfto', 'FAg982X1Op', 'LZK9cSDMNa', 'si690WRE7F', 'RuC9nnXQr0', 'X4E9YfXkRn'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.6b20000.5.raw.unpack, o31gZ7DvYrI18XYuFZ.cs	High entropy of concatenated method names: 'eC89gGVwMk', 'h5H9P6nMsw', 'vsX9BLvAc3', 'nmu9s8TN5D', 'i889iyl3BO', 'BiK9ucYhsG', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.6b20000.5.raw.unpack, EmfNhAEIQ8HQg85dNT.cs	High entropy of concatenated method names: 'je1fLiYfw6', 'XnEfFH7Mkn', 'xO6fgPphOH', 's0HfPdNvNF', 'Qelfs0S6Vu', 'jp3fuHTtkH', 'w06fEsfHl7', 'vUhfeCJT5T', 'SEvfDHSBno', 'cgVfvQGU4V'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.6b20000.5.raw.unpack, bioOLd45rPBUc4mvK8.cs	High entropy of concatenated method names: 'Dispose', 'TenZbEQUmt', 'yWENPtlYCL', 'GQYRRQNL62', 'qDcZ7tV0dl', 'zm3ZzUwhnc', 'ProcessDialogKey', 'ysXN2tBKOH', 'KX7NZ5j9oB', 'mCSNNDeCtN'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.6b20000.5.raw.unpack, hq9t2mztHXoXls48dA.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'AIuVfUhdLe', 'qVwVCr4Hna', 'fkXVj3Oglg', 'bgeVdQy07d', 'GuqV98u3um', 'yG1VVcqR8M', 'WMrVA8CwLt'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.6b20000.5.raw.unpack, PnDJmBZ6PXJLAeXjwk.cs	High entropy of concatenated method names: 'XHm8wD7FBa', 'nTh8ryfgPO', 'NIs8QPu3ha', 'mEg8pjV2cI', 'og58qB2phu', 'iIw8aL3ueg', 'Lm78IMlbA6', 'zQ08LbG206', 'VRr8Fi49wI', 'JcE8OixF8J'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.6b20000.5.raw.unpack, QwpJBWraZi6Z0833Pm.cs	High entropy of concatenated method names: 'ySNHoslQJy', 'KHOH1q6YY0', 'ItAHJhqety', 'K2vH8GkQuh', 'E2wHc9hoiS', 'bMpJTcXh62', 'eT7J6UD8UR', 'ov3J5mG8qs', 'W9lJmMsKoc', 'YLwJbMH6ky'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.6b20000.5.raw.unpack, e9BZSWkLIUA9YGXxoY.cs	High entropy of concatenated method names: 'YoiVZITiF0', 'AphVhIo9Yd', 'ybXVkR15ZW', 'jTIVK9y9xH', 'adkV1LWIND', 'jwCVJAL5x2', 'ioNVHWwwL8', 'KGo95p00qX', 'AxH9mcDJ6C', 'daD9bBK1dr'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.6b20000.5.raw.unpack, KFHh3wyaqD2IO0r0Ko.cs	High entropy of concatenated method names: 'oKKZ8OdD8S', 'KQcZc8yX7G', 'VO9ZnMy5gt', 'aoKZYVKoD4', 'iNMZCyjyFN', 'Cw4Zj4N0Bc', 'dqasej1MycqDlnWFcL', 'hC8DLj72y71U0RZCf7', 'daCZZLhC9q', 'yggZhRhf3j'
Source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.6b20000.5.raw.unpack, hneCu6mtxvA9GvWWkd.cs	High entropy of concatenated method names: 'X43Q7WaiR', 'KlXpRNpxm', 'BxeayyGFF', 'vjEIGfhep', 'YxTFVQAt9', 'fPBOAB0lN', 'TwyHBMIJJUtRYhZTug', 'cuuOL8yJUCX5WfCj9C', 'WSQ9WWhj2', 'McNADtfpE'

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: docx.scr

Static PE information: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe

Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe PID: 6332, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Memory allocated: B50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Memory allocated: 24C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Memory allocated: 44C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Memory allocated: 84D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Memory allocated: 94D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Memory allocated: 96D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Memory allocated: A6D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Memory allocated: EE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Memory allocated: 2C60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Memory allocated: 1200000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 599563	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 599446	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 599179	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 599030	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 598920	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 598797	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 598563	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 598438	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 598328	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 598218	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 598094	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 597250	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 597000	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 596891	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 596766	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 596656	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 596547	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 596407	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 596297	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 596187	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 595969	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 595750	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 595641	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 595516	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 595391	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 595281	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 595172	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 595063	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 594937	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 594828	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 594719	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 594594	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 594483	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 594375	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 594266	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 594156	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6245	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3291	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Window / User API: threadDelayed 7622	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Window / User API: threadDelayed 2213	Jump to behavior

Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 3252	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7320	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7280	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -34126476536362649s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7348	Thread sleep count: 7622 > 30	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7348	Thread sleep count: 2213 > 30	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -599563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -599446s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -599328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -599179s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -599030s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -598920s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -598797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -598672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -598563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -598438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -598328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -598218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -598094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -597985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -597860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -597735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -597610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -597485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -597360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -597250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -597110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -597000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -596891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -596766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -596656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -596547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -596407s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -596297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -596187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -596078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -595969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -595859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -595750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -595641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -595516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -595391s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -595281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -595172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -595063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -594937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -594828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -594719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -594594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -594483s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -594375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -594266s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe TID: 7344	Thread sleep time: -594156s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 599563	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 599446	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 599179	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 599030	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 598920	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 598797	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 598563	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 598438	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 598328	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 598218	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 598094	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 597250	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 597000	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 596891	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 596766	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 596656	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 596547	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 596407	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 596297	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 596187	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 595969	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 595750	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 595641	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 595516	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 595391	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 595281	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 595172	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 595063	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 594937	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 594828	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 594719	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 594594	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 594483	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 594375	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 594266	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Thread delayed: delay time: 594156	Jump to behavior

Source: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe, 00000000.00000002.2057831425.0000000000842000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe, 00000004.00000002.4495755481.00000000010D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe"
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe"			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe

Memory written: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe"			Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Process created: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe "C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe"			Jump to behavior

Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Queries volume information: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Queries volume information: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 4.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.3503f90.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.34c9970.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.3503f90.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.34c9970.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4496651136.0000000002CDC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4494909978.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4496651136.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2070418758.00000000034C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe PID: 6332, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe PID: 4952, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 4.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.3503f90.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.34c9970.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.3503f90.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.34c9970.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4494909978.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4496651136.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2070418758.00000000034C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe PID: 6332, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe PID: 4952, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 4.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.3503f90.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.34c9970.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.3503f90.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.34c9970.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4496651136.0000000002CDC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4494909978.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4496651136.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2070418758.00000000034C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe PID: 6332, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe PID: 4952, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	111 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	13 Obfuscated Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	111 Security Software Discovery	Distributed Component Object Model	1 Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	24%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	37%	Virustotal		Browse
BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	100%	Avira	HEUR/AGEN.1306920
BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://api.ipify.org/	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
https://api.ipify.org/t	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://beirutrest.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
beirutrest.com	50.87.144.157	true	true		unknown
api.ipify.org	172.67.74.152	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org	BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe, 00000000.00000002.2070418758.00000000034C9000.00000004.00000800.00020000.00000000.sdmp, BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe, 00000004.00000002.4494909978.0000000000402000.00000040.00000400.00020000.00000000.sdmp, BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe, 00000004.00000002.4496651136.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.dyn.com/	BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe, 00000000.00000002.2070418758.00000000034C9000.00000004.00000800.00020000.00000000.sdmp, BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe, 00000004.00000002.4494909978.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org/t	BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe, 00000004.00000002.4496651136.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe, 00000000.00000002.2069896097.000000000252E000.00000004.00000800.00020000.00000000.sdmp, BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe, 00000004.00000002.4496651136.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://beirutrest.com	BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe, 00000004.00000002.4496651136.0000000002CDC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
50.87.144.157	beirutrest.com	United States		46606	UNIFIEDLAYER-AS-1US	true
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1500932
Start date and time:	2024-08-29 06:23:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/6@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 100 Number of non-executed functions: 13
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:23:57	API Interceptor	11020363x Sleep call for process: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe modified
00:23:59	API Interceptor	9x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
50.87.144.157	Port Agency Appointment - VELOS ONYX.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse
	UNITY SAKURA - VESSEL'S_PARTICULARS.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse
	BGC-2024-EST-001 & BGC-2024-DST-003.xlsx.scr.exe	Get hash	malicious	AgentTesla	Browse
	V022.20.pdf.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse
	E_QUOT_XLS_45-ELC205049A_P930M.xls.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse
	D121-D122-D123-D127-D128-D130-23-8-2024.xls.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse
	MT.Hunter - Vessel's Details.doc.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	MV Catalina Particulars.pdf.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	AQUAVITA AIM - VSL's PARTICULARS.docx.scr.exe	Get hash	malicious	AgentTesla	Browse
	MV KAI RUI - TC PARTICULARS.docx.scr.exe	Get hash	malicious	AgentTesla	Browse
172.67.74.152	zE7Ken4cFt.dll	Get hash	malicious	Quasar	Browse	api.ipify.org/
	FormPlayer.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	PandaClient.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	golang-modules.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	SecuriteInfo.com.Trojan.Win64.Agent.14415.19839.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	242764.exe	Get hash	malicious	Ficker Stealer, Rusty Stealer	Browse	api.ipify.org/?format=wef
	K8mzlntJVN.msi	Get hash	malicious	Unknown	Browse	api.ipify.org/
	stub.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	stub.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Sonic-Glyder.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
beirutrest.com	Port Agency Appointment - VELOS ONYX.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	50.87.144.157
	UNITY SAKURA - VESSEL'S_PARTICULARS.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	50.87.144.157
	BGC-2024-EST-001 & BGC-2024-DST-003.xlsx.scr.exe	Get hash	malicious	AgentTesla	Browse	50.87.144.157
	V022.20.pdf.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	50.87.144.157
	E_QUOT_XLS_45-ELC205049A_P930M.xls.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	50.87.144.157
	D121-D122-D123-D127-D128-D130-23-8-2024.xls.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	50.87.144.157
	MT.Hunter - Vessel's Details.doc.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.144.157
	MV Catalina Particulars.pdf.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.144.157
	AQUAVITA AIM - VSL's PARTICULARS.docx.scr.exe	Get hash	malicious	AgentTesla	Browse	50.87.144.157
	MV KAI RUI - TC PARTICULARS.docx.scr.exe	Get hash	malicious	AgentTesla	Browse	50.87.144.157
api.ipify.org	SecuriteInfo.com.BackDoor.SpyBotNET.62.13095.12836.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	rARKMONEY.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	z55enyioma.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://request-label-13956753.pages.dev/help/contact/135346556695032	Get hash	malicious	Unknown	Browse	104.26.13.205
	file.exe	Get hash	malicious	Meduza Stealer	Browse	104.26.12.205
	file.exe	Get hash	malicious	Meduza Stealer	Browse	104.26.12.205
	1C24TDH_00017388.pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Revised PI 28 08 2024.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Port Agency Appointment - VELOS ONYX.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	UNITY SAKURA - VESSEL'S_PARTICULARS.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNIFIEDLAYER-AS-1US	Catalina - Particulars.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	50.87.144.157
	rRFQ.bat.exe	Get hash	malicious	FormBook	Browse	162.241.226.190
	http://pxe.wvs.mybluehost.me/wise/number-account-854630/pages/login.php	Get hash	malicious	Unknown	Browse	50.87.253.221
	28082024.html	Get hash	malicious	HTMLPhisher	Browse	69.49.245.172
	https://shorturl.at/1l4Xw	Get hash	malicious	HTMLPhisher	Browse	69.49.230.198
	https://assets-usa.mkt.dynamics.com/c9f731e3-0864-ef11-a66d-6045bd003021/digitalassets/standaloneforms/0424cf3e-7364-ef11-bfe2-6045bd055762	Get hash	malicious	HTMLPhisher	Browse	162.241.61.243
	REQUEST FOR QUOTATION.exe	Get hash	malicious	FormBook, GuLoader	Browse	162.240.81.18
	mbda-us.comAudiowav012.html	Get hash	malicious	HTMLPhisher	Browse	69.49.245.172
	mbda-us.comAudiowav012.html	Get hash	malicious	HTMLPhisher	Browse	69.49.245.172
	factura-630.900.exe	Get hash	malicious	FormBook	Browse	162.241.226.190
CLOUDFLARENETUS	Catalina - Particulars.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	file.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	SecuriteInfo.com.BackDoor.SpyBotNET.62.13095.12836.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	Payment Advice.exe	Get hash	malicious	FormBook	Browse	172.67.210.102
	SecuriteInfo.com.W32.MSIL_Kryptik.KTU.gen.Eldorado.3036.13101.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Spec sheet.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	vYhaKbJF08.exe	Get hash	malicious	LummaC	Browse	104.21.16.74

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Catalina - Particulars.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	SecuriteInfo.com.BackDoor.SpyBotNET.62.13095.12836.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	SecuriteInfo.com.W32.MSIL_Kryptik.KTU.gen.Eldorado.3036.13101.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.74.152
	pop.vbs	Get hash	malicious	Remcos	Browse	172.67.74.152
	rVAKIFBANK-#U00d6demeonaymakbuzu20240826.pdf.exe	Get hash	malicious	Quasar	Browse	172.67.74.152
	rARKMONEY.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	z55enyioma.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	http://identifier-vous456.wixsite.com/my-site/	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://1113a6f.netsolhost.com/	Get hash	malicious	Unknown	Browse	172.67.74.152
	http://pub-0c5198abed8c43b8a5e3815e602f4134.r2.dev/index.html	Get hash	malicious	Unknown	Browse	172.67.74.152

Process:	C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1172
Entropy (8bit):	5.354777075714867
Encrypted:	false
SSDEEP:	24:3gWSKco4KmBs4RPT6BmFoUebIKomjKcmZ9t7J0gt/NKIl9r6dj:QWSU4y4RQmFoUeWmfmZ9tK8NDE
MD5:	92C17FC0DE8449D1E50ED56DBEBAA35D
SHA1:	A617D392757DC7B1BEF28448B72CBD131CF4D0FB
SHA-256:	DA2D2B57AFF1C99E62DD8102CF4DB3F2F0621D687D275BFAF3DB77772131E485
SHA-512:	603922B790E772A480C9BF4CFD621827085B0070131EF29DC283F0E901CF783034384F8815C092D79A6EA5DF382EF78AF5AC3D81EBD118D2D5C1E623CE5553D1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e.................................,..............@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c3geqewl.mfc.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j0yy3yb5.33l.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ti0ec2vn.jab.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xm4obhw3.kei.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.96968456911182
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe
File size:	671'232 bytes
MD5:	7f875e9692c89a590bec32494693d763
SHA1:	8dc17de352faefc31826e4b2de82f2bc25ce3883
SHA256:	430ca931fb30ead2352f1f6cc4c832d5e83d0586818e47febd3d9d2dd83950de
SHA512:	08b8ad9c879456f167222d7508820925ea64985610fa9595db8351b83e8b2efcdd5e260ef9e8e885a71b0efbf0133984484ac4287bb326c9e83232263fd9aa6b
SSDEEP:	12288:2VVepom/97r1zsxaZhFnUX+AzXbZ+8XfTUWOhlFGcW:4y+AZhFQ5zrZ+mUlHh
TLSH:	80E4236442AD8B22DDFA47B968D04B2093FFB233650DEF296CC921DE4AB3B41551371B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f..............0.. ..........Z?... ...@....@.. ....................................@................................

File Icon


Icon Hash:	cd4c022d219a9901

Static PE Info

General

Entrypoint:	0x4a3f5a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66CFE1FC [Thu Aug 29 02:50:36 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add eax, dword ptr [eax]
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax+0000000Eh], al
pushad
add byte ptr [eax], al
adc byte ptr [eax], 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa3f08	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa4000	0x1924	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa1f60	0xa2000	a96e89dbb1a687d2dfc71509bf1c190b	False	0.9733931929976852	data	7.97638614028424	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa4000	0x1924	0x1a00	eac3f468de2c7b14a9555ac790993447	False	0.8197115384615384	data	7.124419069601494	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa6000	0xc	0x200	a0e5df0ed077da44e37c7c2907adc9aa	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xa4100	0x12c4	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9708576186511241
RT_GROUP_ICON	0xa53d4	0x14	data	1.05
RT_VERSION	0xa53f8	0x32c	data	0.4273399014778325
RT_MANIFEST	0xa5734	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 29, 2024 06:24:00.483495951 CEST	49706	443	192.168.2.5	172.67.74.152
Aug 29, 2024 06:24:00.483526945 CEST	443	49706	172.67.74.152	192.168.2.5
Aug 29, 2024 06:24:00.483769894 CEST	49706	443	192.168.2.5	172.67.74.152
Aug 29, 2024 06:24:00.489193916 CEST	49706	443	192.168.2.5	172.67.74.152
Aug 29, 2024 06:24:00.489209890 CEST	443	49706	172.67.74.152	192.168.2.5
Aug 29, 2024 06:24:00.992239952 CEST	443	49706	172.67.74.152	192.168.2.5
Aug 29, 2024 06:24:00.992315054 CEST	49706	443	192.168.2.5	172.67.74.152
Aug 29, 2024 06:24:00.995832920 CEST	49706	443	192.168.2.5	172.67.74.152
Aug 29, 2024 06:24:00.995841980 CEST	443	49706	172.67.74.152	192.168.2.5
Aug 29, 2024 06:24:00.996090889 CEST	443	49706	172.67.74.152	192.168.2.5
Aug 29, 2024 06:24:01.044910908 CEST	49706	443	192.168.2.5	172.67.74.152
Aug 29, 2024 06:24:01.088505983 CEST	443	49706	172.67.74.152	192.168.2.5
Aug 29, 2024 06:24:01.153729916 CEST	443	49706	172.67.74.152	192.168.2.5
Aug 29, 2024 06:24:01.153780937 CEST	443	49706	172.67.74.152	192.168.2.5
Aug 29, 2024 06:24:01.153857946 CEST	49706	443	192.168.2.5	172.67.74.152
Aug 29, 2024 06:24:01.159681082 CEST	49706	443	192.168.2.5	172.67.74.152
Aug 29, 2024 06:24:01.912136078 CEST	49708	21	192.168.2.5	50.87.144.157
Aug 29, 2024 06:24:01.916984081 CEST	21	49708	50.87.144.157	192.168.2.5
Aug 29, 2024 06:24:01.917088032 CEST	49708	21	192.168.2.5	50.87.144.157
Aug 29, 2024 06:24:01.928231955 CEST	49708	21	192.168.2.5	50.87.144.157
Aug 29, 2024 06:24:01.933263063 CEST	21	49708	50.87.144.157	192.168.2.5
Aug 29, 2024 06:24:01.933327913 CEST	49708	21	192.168.2.5	50.87.144.157

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 29, 2024 06:24:00.468781948 CEST	57617	53	192.168.2.5	1.1.1.1
Aug 29, 2024 06:24:00.475406885 CEST	53	57617	1.1.1.1	192.168.2.5
Aug 29, 2024 06:24:01.745371103 CEST	61487	53	192.168.2.5	1.1.1.1
Aug 29, 2024 06:24:01.911338091 CEST	53	61487	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 29, 2024 06:24:00.468781948 CEST	192.168.2.5	1.1.1.1	0xd347	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Aug 29, 2024 06:24:01.745371103 CEST	192.168.2.5	1.1.1.1	0x7d55	Standard query (0)	beirutrest.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Aug 29, 2024 06:24:00.475406885 CEST	1.1.1.1	192.168.2.5	0xd347	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Aug 29, 2024 06:24:00.475406885 CEST	1.1.1.1	192.168.2.5	0xd347	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Aug 29, 2024 06:24:00.475406885 CEST	1.1.1.1	192.168.2.5	0xd347	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Aug 29, 2024 06:24:01.911338091 CEST	1.1.1.1	192.168.2.5	0x7d55	No error (0)	beirutrest.com	50.87.144.157	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	172.67.74.152	443	4952	C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 04:24:01 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-08-29 04:24:01 UTC	211	IN	HTTP/1.1 200 OK Date: Thu, 29 Aug 2024 04:24:01 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8ba9c4ded97742db-EWR
2024-08-29 04:24:01 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Target ID:	0
Start time:	00:23:56
Start date:	29/08/2024
Path:	C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe"
Imagebase:	0x140000
File size:	671'232 bytes
MD5 hash:	7F875E9692C89A590BEC32494693D763
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2070418758.00000000034C9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2070418758.00000000034C9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:23:57
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe"
Imagebase:	0x640000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:23:58
Start date:	29/08/2024
Path:	C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe"
Imagebase:	0x860000
File size:	671'232 bytes
MD5 hash:	7F875E9692C89A590BEC32494693D763
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.4496651136.0000000002CDC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.4494909978.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.4494909978.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.4496651136.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.4496651136.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	00:23:58
Start date:	29/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	317
Total number of Limit Nodes:	13

Executed Functions

Function 04A8DFB8 Relevance: 2.8, Strings: 1, Instructions: 1567
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$eq, xrefs: 04A8EAC3

Memory Dump Source

Source File: 00000000.00000002.2071673058.0000000004A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a80000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID: $eq
API String ID: 0-731066626
Opcode ID: 40ee2ee46e0237d6f16c4c8ccf450c027e8e1ad99c499ac848d5b028cf6e0bbd
Instruction ID: dd7fc0f96fdaca574dc28d91e07bdfa66123e62fe63ce6f4db7197411625dbbb
Opcode Fuzzy Hash: 40ee2ee46e0237d6f16c4c8ccf450c027e8e1ad99c499ac848d5b028cf6e0bbd
Instruction Fuzzy Hash: D7F2CC74A11619CFDB54EF68C894A99B7B1FF89300F1186E9E409AB361DB35AEC1CF40

Function 04A8DFA8 Relevance: 2.6, Strings: 1, Instructions: 1362COMMON

Download Yara Rule

Strings

$eq, xrefs: 04A8EAC3

Memory Dump Source

Source File: 00000000.00000002.2071673058.0000000004A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a80000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID: $eq
API String ID: 0-731066626
Opcode ID: 2c195e45a8ffba3cd819da5098441515e01533c5a7770f574661922f89720791
Instruction ID: 333269a62b85ca2671527e9262bd24f2920f64162f579fbd2ef17581df926ef8
Opcode Fuzzy Hash: 2c195e45a8ffba3cd819da5098441515e01533c5a7770f574661922f89720791
Instruction Fuzzy Hash: C5E2B634A11619CFDB55EF64C898A99B7B1FF89300F5182E9E409AB361DB34AEC5CF40

Function 04A81AF0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 04A81D46

Strings

lO|, xrefs: 04A81CA3
lO|, xrefs: 04A81C7E

Memory Dump Source

Source File: 00000000.00000002.2071673058.0000000004A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a80000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID: HandleModule
String ID: lO|$lO|
API String ID: 4139908857-1402546280
Opcode ID: 4ee1348128aaaebda0cb166eed3db126e98cb5026a038a1f83f266bc5938cb28
Instruction ID: ce7cd7224b09b4029589e6711562d5d9b0d2854de784a3fd677ad139514a1818
Opcode Fuzzy Hash: 4ee1348128aaaebda0cb166eed3db126e98cb5026a038a1f83f266bc5938cb28
Instruction Fuzzy Hash: B17101B0A00B058FD764EF29D14479ABBF5FF88304F04892DD48A97A50E779F946CB90

Function 0687200C Relevance: 1.7, APIs: 1, Instructions: 248
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0687224E

Memory Dump Source

Source File: 00000000.00000002.2074306407.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6870000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 94e3475583279314982794d8cc09b7191ed57dd4b7a1172f13ee11cfc25002fb
Instruction ID: 85f21156a9ae3c70f3c19e982de6043c045eb40c34672fecab2c2b7c66c17eb4
Opcode Fuzzy Hash: 94e3475583279314982794d8cc09b7191ed57dd4b7a1172f13ee11cfc25002fb
Instruction Fuzzy Hash: 52A15971D002198FEB60CF68C851BEDBBF2BF48310F1485A9E909E7250DB759A85CFA1

Function 06872018 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0687224E

Memory Dump Source

Source File: 00000000.00000002.2074306407.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6870000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 7a3c41e311fcbef6d636ce282ca9060e3b20a3482de8c66c3542cf2c746fae01
Instruction ID: 02dc3b2fc9768ebdc13518c3f5c843cf4648fcef9cb5ee50194ca9558018ebdd
Opcode Fuzzy Hash: 7a3c41e311fcbef6d636ce282ca9060e3b20a3482de8c66c3542cf2c746fae01
Instruction Fuzzy Hash: F6915971D002198FEB60CF68C851BEDBBF2BB48310F1485A9E909E7250DB759A85CFA1

Function 04A86848 Relevance: 1.6, APIs: 1, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04A88642

Memory Dump Source

Source File: 00000000.00000002.2071673058.0000000004A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a80000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 8093c7c744bd6709fa562e6baa100aad2d29a4bc61a3a0d36e8a1013f264f611
Instruction ID: 3fbfde3f1efe902f10b55d9d75ec597f3fe9e478315bb170af06b8ec48a086a5
Opcode Fuzzy Hash: 8093c7c744bd6709fa562e6baa100aad2d29a4bc61a3a0d36e8a1013f264f611
Instruction Fuzzy Hash: 2C5133B1C003599FDB15DFA9C890ADEBFB1EF89300F64816EE418AB211DB74A845CF94

Function 04A86890 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04A88642

Memory Dump Source

Source File: 00000000.00000002.2071673058.0000000004A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a80000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 07c1249c4ad494f4ddff841c29fa0a06874943bd4407be968f2785333a387368
Instruction ID: ba80af99ce617e3610a4c6eab8b0d8440a653b16844ac2d6e3a02a813ce0b425
Opcode Fuzzy Hash: 07c1249c4ad494f4ddff841c29fa0a06874943bd4407be968f2785333a387368
Instruction Fuzzy Hash: D151CEB1D003099FDB14DF99C984ADEBBB5FF88310F64852EE819AB210DB75A945CF90

Function 04A88524 Relevance: 1.6, APIs: 1, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04A88642

Memory Dump Source

Source File: 00000000.00000002.2071673058.0000000004A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a80000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: b0696c9f5010e12af890c14e69794caa9cadeea4c23733ad5865d057cde05bab
Instruction ID: 86ea6d081de4bf6c1a3682904e2c36a4ba7302496f04e89992251386c37d9c72
Opcode Fuzzy Hash: b0696c9f5010e12af890c14e69794caa9cadeea4c23733ad5865d057cde05bab
Instruction Fuzzy Hash: 1051BFB1D003099FDB14DF99C984ADEBBB5FF88310F64852EE819AB210DB75A945CF90

Function 00B9590C Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00B959C9

Memory Dump Source

Source File: 00000000.00000002.2068660054.0000000000B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 2c7f15816733597e2be19c830c3ee0dc75d62c4a178d464a87500a091cea55d3
Instruction ID: d4e0b3a6cafde98b7827861e33879ac5cf85dd78a8442321a2a74528e33cfb87
Opcode Fuzzy Hash: 2c7f15816733597e2be19c830c3ee0dc75d62c4a178d464a87500a091cea55d3
Instruction Fuzzy Hash: 7541CCB1C00719CBDB25CFA9C884A9EBBF5FF49304F20816AD409AB255DB75694ACF50

Function 04A869E4 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04A8ABC1

Memory Dump Source

Source File: 00000000.00000002.2071673058.0000000004A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a80000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: cb91f787485725ec11fdabb48cef120427f690d778ca9676bf8682a0174b5c38
Instruction ID: fc93ff73985bd5294b46deba1dcbd43e2aec1d507d29f225ce7ab3d8e89f2aef
Opcode Fuzzy Hash: cb91f787485725ec11fdabb48cef120427f690d778ca9676bf8682a0174b5c38
Instruction Fuzzy Hash: 364108B5A00305DFDB14DF99C888AAAFBF5FB98314F24C45DD519AB321D375A841CBA0

Function 00B9449C Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00B959C9

Memory Dump Source

Source File: 00000000.00000002.2068660054.0000000000B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 53a58b2fbb99b6e0550d515c9d3611b0c09bb2b16597f5ed0379a66384a9c1f3
Instruction ID: 5f69b5171d5d5461e707863e10c6db0dfbcca530cc29e001e5526938cb4c360e
Opcode Fuzzy Hash: 53a58b2fbb99b6e0550d515c9d3611b0c09bb2b16597f5ed0379a66384a9c1f3
Instruction Fuzzy Hash: 6E41DFB1C00719CBDF24CFA9C884A9DBBF5FF48304F20816AD409AB251DB756949CF90

Function 06871D88 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06871E20

Memory Dump Source

Source File: 00000000.00000002.2074306407.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6870000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 88b18deaddf273e45f361bae09fa07bbc10ef584e91addce3ac8e361822e67c7
Instruction ID: 59110f0e6eaf87a82424bdc364fec133ee733f26e8b15b6c2e0f7d6e7d6598ef
Opcode Fuzzy Hash: 88b18deaddf273e45f361bae09fa07bbc10ef584e91addce3ac8e361822e67c7
Instruction Fuzzy Hash: 712135729002198FDB20CFA9C884BDEBBF4FF48310F14842AE959A7240C7789944DB60

Function 06871D90 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06871E20

Memory Dump Source

Source File: 00000000.00000002.2074306407.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6870000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: ff7286d40df6ae8fdfa3a72b722ce4d07e521063582bd3dec52e5c8cc17b736b
Instruction ID: 8d3030afa26ace1f40d97ce0185ea735126aa70bcfede9e8b4f319dfaf85195b
Opcode Fuzzy Hash: ff7286d40df6ae8fdfa3a72b722ce4d07e521063582bd3dec52e5c8cc17b736b
Instruction Fuzzy Hash: 97212772D003199FCB10CFA9C885BDEBBF5FF48310F14842AE959A7240C7789944DBA4

Function 06871E7B Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06871F00

Memory Dump Source

Source File: 00000000.00000002.2074306407.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6870000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 69837b0e6934f35822677d17a13bedd2e9b29cc392020f9b818067ce81d6a049
Instruction ID: f178fb7c2a3a78f711b61a6819a46b98d72f43a8898aef298e1a191f86514bb6
Opcode Fuzzy Hash: 69837b0e6934f35822677d17a13bedd2e9b29cc392020f9b818067ce81d6a049
Instruction Fuzzy Hash: 4D2107718002599FCB10DFA9C885AEEBBF5FF48320F54842AE959A7241C7759944DBA0

Function 04A83FB8 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,04A83F86,?,?,?,?,?), ref: 04A84047

Memory Dump Source

Source File: 00000000.00000002.2071673058.0000000004A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a80000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 87a75c0e794e6b16a3bf334e41619f50276345e7844f6a959fb4e8753ca70ab0
Instruction ID: 82ef55514e4364c93a62ce66aef9e52da58f3c124e3e2241d63ec15939e00b15
Opcode Fuzzy Hash: 87a75c0e794e6b16a3bf334e41619f50276345e7844f6a959fb4e8753ca70ab0
Instruction Fuzzy Hash: 6621E4B69002099FDB10CFAAD984ADEFFF4FB48314F14841AE918A3350D379A945DFA1

Function 068717B9 Relevance: 1.6, APIs: 1, Instructions: 65threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0687183E

Memory Dump Source

Source File: 00000000.00000002.2074306407.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6870000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 69389d0fcadfbbc8f790d55dd7be10af6c778932a7dfef772978621cba9b0922
Instruction ID: d63ffd909c121d2aa404a634c1200a8cdde4b71df76de147103e7cf5791d32b2
Opcode Fuzzy Hash: 69389d0fcadfbbc8f790d55dd7be10af6c778932a7dfef772978621cba9b0922
Instruction Fuzzy Hash: 1C212872D002198FDB10DFAAC4857AEBBF4EF88324F14842AD959A7241DB789945CFA4

Function 04A83680 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,04A83F86,?,?,?,?,?), ref: 04A84047

Memory Dump Source

Source File: 00000000.00000002.2071673058.0000000004A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a80000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4c8a89bce4b9963020053c2951338ce047d3ad654389aeaee7a0275242efbf7c
Instruction ID: acbbeeae5b8d7f7b550007b768f88fb08f30e526abbd5313a7a00287ff5073ac
Opcode Fuzzy Hash: 4c8a89bce4b9963020053c2951338ce047d3ad654389aeaee7a0275242efbf7c
Instruction Fuzzy Hash: D42105B59002099FDB10CF9AD984ADEBBF4EB48314F14801AE914A3351D379A944CFA5

Function 06871E80 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06871F00

Memory Dump Source

Source File: 00000000.00000002.2074306407.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6870000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: e590bdbff06225cebba6cabfad3990c3a5cdf1301f5c1ab8bb65765edd28f2a8
Instruction ID: 1b5a4cab9692acb74c5ae2b4a0025a4895ffdb347d834c626e844f44f9336bce
Opcode Fuzzy Hash: e590bdbff06225cebba6cabfad3990c3a5cdf1301f5c1ab8bb65765edd28f2a8
Instruction Fuzzy Hash: 222139B1C003599FCB10DFAAC885AEEFBF5FF48320F54842AE959A7240C7759944DBA0

Function 068717C0 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0687183E

Memory Dump Source

Source File: 00000000.00000002.2074306407.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6870000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 383c287a4d2a7f944c2f97afe24f402a15663ff727621de503addfbbbce6e41a
Instruction ID: ca4e1bb35eac4153b8374aa286825b6405b6ba753ec6cb687d2cca86e19fc893
Opcode Fuzzy Hash: 383c287a4d2a7f944c2f97afe24f402a15663ff727621de503addfbbbce6e41a
Instruction Fuzzy Hash: 46211871D003098FDB50DFAAC8857EEBBF4EF88324F14842AD559A7241DB789945CFA4

Function 06871CC8 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06871D3E

Memory Dump Source

Source File: 00000000.00000002.2074306407.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6870000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0739917838a67fbd16ed0019298e3097dc93e19fdc7f7b7b0724227b9c161b6a
Instruction ID: 30dfe933e6d327d8c9675fa32f32c0ffc1511a94089fa005b3d8749b999ca1d3
Opcode Fuzzy Hash: 0739917838a67fbd16ed0019298e3097dc93e19fdc7f7b7b0724227b9c161b6a
Instruction Fuzzy Hash: A6116A729002499FDB20DFA9C848BDFBFF5EF88324F248419E915A7250CB769944DFA4

Function 04A81550 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,04A81DC1,00000800,00000000,00000000), ref: 04A81FD2

Memory Dump Source

Source File: 00000000.00000002.2071673058.0000000004A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a80000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 14f07631e0d4a69dc3e25df712335b32ffcc198067f5c63ccd3152883f0e3846
Instruction ID: 1de283130628d8e355cd8bfda6dff7bb95aeb0be7a533b06bfac078a73239106
Opcode Fuzzy Hash: 14f07631e0d4a69dc3e25df712335b32ffcc198067f5c63ccd3152883f0e3846
Instruction Fuzzy Hash: 121126B69043099FDB10DF9AC444ADEFBF4EB88310F10842EE919A7341C375A945CFA5

Function 06871CD0 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06871D3E

Memory Dump Source

Source File: 00000000.00000002.2074306407.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6870000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e564aa1ceedbc5652b47e3b4b3a7b0f04b4d106fb8edc89f257efccf3f995ff9
Instruction ID: 82e22ad8759f80c13437fceb3549d7e4d0e8e04653e9b66ee81c1dcb4c830be4
Opcode Fuzzy Hash: e564aa1ceedbc5652b47e3b4b3a7b0f04b4d106fb8edc89f257efccf3f995ff9
Instruction Fuzzy Hash: 311149729002499FDB10DFAAC844ADFBFF5EF88320F248419EA19A7250CB759944DFA4

Function 04A81F62 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,04A81DC1,00000800,00000000,00000000), ref: 04A81FD2

Memory Dump Source

Source File: 00000000.00000002.2071673058.0000000004A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a80000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: beab067cf1a8e9b6122131f21d7e87edc05132023da8bd4cdd50e5dfe0e51a20
Instruction ID: a719e4fbf21685b03495e39698dfe00b7de78ac125bcf1c6731710a4c6272ff1
Opcode Fuzzy Hash: beab067cf1a8e9b6122131f21d7e87edc05132023da8bd4cdd50e5dfe0e51a20
Instruction Fuzzy Hash: BA1123B6900209CFDB10DF9AC584ADEFBF4EB88310F14842EE519A7740C375A946CFA1

Function 06871709 Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06871772

Memory Dump Source

Source File: 00000000.00000002.2074306407.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6870000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: e4bab433d5d41fa66ad12c0b29463d518fd61187d504c3e4db268b685b569ac9
Instruction ID: a73d150e4de635e412cdd80972e42f5632229ce9f93de7d484c36cbe55891acb
Opcode Fuzzy Hash: e4bab433d5d41fa66ad12c0b29463d518fd61187d504c3e4db268b685b569ac9
Instruction Fuzzy Hash: A8112B71D003598FDB20DFAAC8457DEFBF4EF89324F24841AD55AA7240CA759944CFA4

Function 06871710 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06871772

Memory Dump Source

Source File: 00000000.00000002.2074306407.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6870000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 32cae2e8199c100f38d97b6c16844e3d9410916b58d943848d3c49914546503c
Instruction ID: 901e80255d4cc10846c153fec026d39f2f1e48ab3642a4dbe042b70fa178fcda
Opcode Fuzzy Hash: 32cae2e8199c100f38d97b6c16844e3d9410916b58d943848d3c49914546503c
Instruction Fuzzy Hash: DC112871D002498BDB20DFAAC88579EFBF4EB88324F248419D519A7240CA75A944CFA4

Function 068747B8 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0687481D

Memory Dump Source

Source File: 00000000.00000002.2074306407.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6870000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: ab5b58ef464adc887aa8b8829995087636f7301cdb313a4bbedce77084f52b0f
Instruction ID: 6d54d4259ee7232fb8c3ce9ab9c4ee6c9d3e03881552b3849234204bbe6be6f2
Opcode Fuzzy Hash: ab5b58ef464adc887aa8b8829995087636f7301cdb313a4bbedce77084f52b0f
Instruction Fuzzy Hash: E51106B58003499FDB20DF99D844BDEFFF8EB59320F20841AE659A7241C375A984CFA1

Function 06870668 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0687481D

Memory Dump Source

Source File: 00000000.00000002.2074306407.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6870000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 6056d2dce610311c1128961ef7e89ff811692b2f1abd574d03f5caf0f9c37e11
Instruction ID: 9a92aa532efa494140e7495402a42d6adb829f4e0cbcc3cc8c42c058c2935592
Opcode Fuzzy Hash: 6056d2dce610311c1128961ef7e89ff811692b2f1abd574d03f5caf0f9c37e11
Instruction Fuzzy Hash: F111F5B5800349DFDB50DF99D845BDEBBF8EB48314F108419E619A7200C375A944CFA1

Function 04A81CE0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 04A81D46

Memory Dump Source

Source File: 00000000.00000002.2071673058.0000000004A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a80000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ef6224bffd6804ebbd9c8bfac7c669d3bf918c8ed3aa6b5385ade77f179fe8f3
Instruction ID: d6d89511f15975fcfbd6eb105c84925036d50b6728ff48add1358f0216ada6cf
Opcode Fuzzy Hash: ef6224bffd6804ebbd9c8bfac7c669d3bf918c8ed3aa6b5385ade77f179fe8f3
Instruction Fuzzy Hash: CF11D2B6C002498FDB10DF9AD444BDEFBF4EF89314F14841AD529A7210C379A545CFA1

Function 007BD53C Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057189384.00000000007BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7bd000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de40b42e95b4a8c92701004abf515b31807447bb4d66f9917ecd3514f085826f
Instruction ID: b53cd3e0e76b5a87d8d6a6387ad7835b37a9881731c90485dda010615bb8191d
Opcode Fuzzy Hash: de40b42e95b4a8c92701004abf515b31807447bb4d66f9917ecd3514f085826f
Instruction Fuzzy Hash: 2D2122B2504204EFCB25DF14D9C0B66BF65FF98328F248569E8094B246D33ADC66CAA1

Function 007BD450 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057189384.00000000007BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7bd000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73916d9db0b7bc18726cab5d5fc09320e779fd219db4ae7e43f2837ba29f2c48
Instruction ID: b25e3ef7c26b3ddca902491b707f0b354eb77681037fee745d997263a09138e5
Opcode Fuzzy Hash: 73916d9db0b7bc18726cab5d5fc09320e779fd219db4ae7e43f2837ba29f2c48
Instruction Fuzzy Hash: EE2133B1504240DFCB25DF14D9C0B67BF65FB98324F20C569EC094B246D33AEC16CAA1

Function 007CD0EC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057681329.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7cd000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76a58229a7d3a42e49ea353190c6e016fa5bde9b15917189205b1eb765ad4a64
Instruction ID: 13a4b8ee96695d60ea7eb19fe3ae845d48c23cc2b002a9c9e148f026f93f01a2
Opcode Fuzzy Hash: 76a58229a7d3a42e49ea353190c6e016fa5bde9b15917189205b1eb765ad4a64
Instruction Fuzzy Hash: BC2104B5504208EFDB25DF14D9C0F26BBA5FB84324F28C97DD8094B296C33ADC06CAA1

Function 007CD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057681329.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7cd000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f5a33cc1328daa7aaadfce758babccd06950d7be5056366b1c0fcd6086c18b5
Instruction ID: 06eef282adca5382f1994cf5d1828c29073e680d4051ecd5b4ff542eada5ef93
Opcode Fuzzy Hash: 9f5a33cc1328daa7aaadfce758babccd06950d7be5056366b1c0fcd6086c18b5
Instruction Fuzzy Hash: B121F2B1504204EFDB25DF54D9C0F26BBA5FB88324F24C97DE8094B296C33ADC06CA61

Function 007BD537 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057189384.00000000007BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7bd000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a42a10f79047cfc5a8dfbea04f5877e4b045e58f4eb555799dbe40d0299e0d1
Instruction ID: dfcbff1a4108e06dd25a1aa89c4c0d7abcc10ca17d1b5b1538e6be089bf9c5a6
Opcode Fuzzy Hash: 2a42a10f79047cfc5a8dfbea04f5877e4b045e58f4eb555799dbe40d0299e0d1
Instruction Fuzzy Hash: D111E676504244CFCB26CF10D5C4B56BF72FF98324F24C5A9D8094B656C33AD86ACBA1

Function 007BD44B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057189384.00000000007BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7bd000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a42a10f79047cfc5a8dfbea04f5877e4b045e58f4eb555799dbe40d0299e0d1
Instruction ID: 9657e2c7078e35510091a9a0c5b3d1ae73e9b4ce2dd1c61c694952a5b6822beb
Opcode Fuzzy Hash: 2a42a10f79047cfc5a8dfbea04f5877e4b045e58f4eb555799dbe40d0299e0d1
Instruction Fuzzy Hash: C011B176504280CFDB26CF14D5C4B56BF71FF94324F24C5A9D8094B256D33AD86ACBA1

Function 007CD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057681329.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7cd000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c74efafe6a787794d2e52374dfad20fc7a218ab120a23d42f416259975cce95d
Instruction ID: 79f9cf950de3bcf2471bbd6da44b9777dcfed271f7d0c7118136b0a9436c25f4
Opcode Fuzzy Hash: c74efafe6a787794d2e52374dfad20fc7a218ab120a23d42f416259975cce95d
Instruction Fuzzy Hash: DF119D76504280DFDB16CF14D9C4B15FBB1FB84324F24C6AED8494B696C33AD84ACB61

Function 007CD0E7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057681329.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7cd000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c74efafe6a787794d2e52374dfad20fc7a218ab120a23d42f416259975cce95d
Instruction ID: def55ae0b41b6d6cca340f867fa9dddf14e8380e88e2d54fcd5307bf936a2aab
Opcode Fuzzy Hash: c74efafe6a787794d2e52374dfad20fc7a218ab120a23d42f416259975cce95d
Instruction Fuzzy Hash: 0E119D75504284DFDB16CF14D9C4B15BFB2FB84314F28C6ADD8494B656C33AD84ACBA2

Non-executed Functions

Function 04A86C80 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2071673058.0000000004A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a80000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13be654af8388c7e57a6536800567612a7fad9ed05f4a4dc1d91b1274a34549c
Instruction ID: 5dd7e8a30dacab2cfb8b32c4e1e78cbfdbfda8e9b50f0b943549a11e75db39f7
Opcode Fuzzy Hash: 13be654af8388c7e57a6536800567612a7fad9ed05f4a4dc1d91b1274a34549c
Instruction Fuzzy Hash: 2B1295B1E09745AAD310CF65E94C1893FB1FF41338B524229D2612E6E9DBBC196ACFC4

Function 06870EE8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2074306407.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6870000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5acba7b506b364dff0bbe79578e3875247910574a4ecff987dfcb126b9d526ab
Instruction ID: df1659e25b4c94941b5a60547a01ae0f3b443a752af01e69cf60f6d453baa0f9
Opcode Fuzzy Hash: 5acba7b506b364dff0bbe79578e3875247910574a4ecff987dfcb126b9d526ab
Instruction Fuzzy Hash: 47E10774E141198FCB54DFA8C584AAEFBF2FF89304F288169D454AB35AD734A941CFA0

Function 06871898 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2074306407.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6870000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2584c3bcd726dbf02bee31a444afd590eebcefdaa9edf3422202c93843d4989a
Instruction ID: 7863c6d418fd4cdf51bae0c54580640baad17441430d902b90b055a5bb621552
Opcode Fuzzy Hash: 2584c3bcd726dbf02bee31a444afd590eebcefdaa9edf3422202c93843d4989a
Instruction Fuzzy Hash: E5E11874E141198FCB54DFA9C584AAEFBF2FF89304F288269D454AB356D730A941CFA0

Function 04A848C4 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2071673058.0000000004A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a80000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15ab5537d3fd3b73b7c16834db7611258b7c798d7c24ae46c9aa7d7f1aec383d
Instruction ID: d919f97f41ff37a2d9aca6d3e185db7bb4b94fd5889abb5fddb02accd7074ad0
Opcode Fuzzy Hash: 15ab5537d3fd3b73b7c16834db7611258b7c798d7c24ae46c9aa7d7f1aec383d
Instruction Fuzzy Hash: EFA18132E002169FDF15EFB4C9405EEB7B2FF89304B15816EE905AB265EB35E915CB80

Function 04A86C71 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2071673058.0000000004A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a80000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35f2666899d5fe7a33e053e37a33784e86e2b9fa1b5f0eae160538bc93e8fcef
Instruction ID: fe15fd993616195d49e815636ee58256974b1ba3402d2f0ab06c7627a96919b5
Opcode Fuzzy Hash: 35f2666899d5fe7a33e053e37a33784e86e2b9fa1b5f0eae160538bc93e8fcef
Instruction Fuzzy Hash: 1EC128B0E09705AAD710DF65E9481893FB1FF81334F524229D2616B2E9DBB8196ACF84

Function 06871889 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2074306407.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6870000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94b0c17f9340208aa8960da77d6ba75befb65d7d9b3de4e1a935ff1c16f537c7
Instruction ID: fb6aac50a4b08625fabec8b39d856721a9732e986089babb8f1005cad2baf907
Opcode Fuzzy Hash: 94b0c17f9340208aa8960da77d6ba75befb65d7d9b3de4e1a935ff1c16f537c7
Instruction Fuzzy Hash: AB511A70E142198FDB54CFA9C584AAEFBF2AF89304F24C16AD458AB315D7309941CFA1

Function 06873956 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2074306407.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6870000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32235949c8d857a4d9608ad8d04922e14a6bec79d76dbe9bd0b720789c64f0f4
Instruction ID: 4bc2428ae3d402ba6943c1bedba4dc934281604738d8de84cb27ecee2beffe98
Opcode Fuzzy Hash: 32235949c8d857a4d9608ad8d04922e14a6bec79d76dbe9bd0b720789c64f0f4
Instruction Fuzzy Hash: 4EE04F34908108DFD740DF40E4450FCB7BDE74A319F003061D50DE3211D7309994CB54

Analysis Process: BULK HARVEST - VESSEL PARTICULARS.docx.scr.exePID: 4952, Parent PID: 6332COMMON

Execution Graph

Execution Coverage:	11.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	162
Total number of Limit Nodes:	22

Executed Functions

Function 068D2350 Relevance: 9.0, Strings: 6, Instructions: 1497COMMON

Download Yara Rule

Strings

$eq, xrefs: 068D37AC
$eq, xrefs: 068D3794
$eq, xrefs: 068D376B
$eq, xrefs: 068D3788
$eq, xrefs: 068D375F
$eq, xrefs: 068D37B8

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID: $eq$$eq$$eq$$eq$$eq$$eq
API String ID: 0-220072568
Opcode ID: 81d16bf97c6212389b1e5dd0e70b8590595974bd0c2390b3bf231d2ef89ee53d
Instruction ID: b680e547484933b2e0d11574850172dbaa67853de1283490ad549004f6a4035b
Opcode Fuzzy Hash: 81d16bf97c6212389b1e5dd0e70b8590595974bd0c2390b3bf231d2ef89ee53d
Instruction Fuzzy Hash: 26D25734E00609CFCB64DB68C594A9DB7B2FF89310F54C5A9D509EB265EB34ED82CB90

Function 068DB248 Relevance: 8.3, Strings: 6, Instructions: 762COMMON

Download Yara Rule

Strings

$eq, xrefs: 068DBC1D
$eq, xrefs: 068DBBB5
$eq, xrefs: 068DBBA9
$eq, xrefs: 068DBBE9
$eq, xrefs: 068DBBDD
$eq, xrefs: 068DBC11

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID: $eq$$eq$$eq$$eq$$eq$$eq
API String ID: 0-220072568
Opcode ID: d28f6a5c4ac89bbd88d0267c918336c6e0de7d4043f17d03c4b5cb70f89bfe1a
Instruction ID: 8a8149faaa1612396d7bceb7d87bfd8b7dc2a33fa6cfd889f3c59198423abdd7
Opcode Fuzzy Hash: d28f6a5c4ac89bbd88d0267c918336c6e0de7d4043f17d03c4b5cb70f89bfe1a
Instruction Fuzzy Hash: B65280B0E101099FDFA4DB68D5807ADB7B2FB49310F61852AE509EB395DB34DC81CBA1

Function 068D7D80 Relevance: 3.0, Strings: 2, Instructions: 471
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$eq, xrefs: 068D831B
$eq, xrefs: 068D8327

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID: $eq$$eq
API String ID: 0-2246304398
Opcode ID: 3c44867c1e7e9571a58a21ddf0e23f586d6939cb2367c067f6d0a8033698f2cf
Instruction ID: 5e24baaf063267a6c420414b473643efec0197e7a97dda3e54f609b19a52256a
Opcode Fuzzy Hash: 3c44867c1e7e9571a58a21ddf0e23f586d6939cb2367c067f6d0a8033698f2cf
Instruction Fuzzy Hash: 7402AE70B102098FDB54DB69D540BAEB7E2FF84304F248529E90ADB395DB35EC86CB90

Function 068D55A0 Relevance: 1.8, Strings: 1, Instructions: 591COMMON

Download Yara Rule

Strings

$, xrefs: 068D597B

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 8f7b953dc8d739c6be9246360d31efcd07429c0221656a787e5c61d7e7d3fbd6
Instruction ID: 25d6999984e2d8f26e868e299c2a8159f3c472c175f45250fe7029529dd01672
Opcode Fuzzy Hash: 8f7b953dc8d739c6be9246360d31efcd07429c0221656a787e5c61d7e7d3fbd6
Instruction Fuzzy Hash: E322E475F102059FDF60DBA4D5806AEB7F2EF84320F24846AE905EB354DA31ED41CBA2

Function 068D65F0 Relevance: .8, Instructions: 816COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fbd9924eef9bbcc08399924bd504191632e2a1a5b3fe40a782c1fb4348ce8d8
Instruction ID: 321921af56fc0c2668ec3c0cebf7ff8ab04dcc526e2a0929c117971bd2b5924e
Opcode Fuzzy Hash: 0fbd9924eef9bbcc08399924bd504191632e2a1a5b3fe40a782c1fb4348ce8d8
Instruction Fuzzy Hash: D0628134E102089FDB54DB68D594BADB7F2EF84310F148469E906DB395EB35ED82CBA0

Function 068DC190 Relevance: .6, Instructions: 632COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2e1869b5a514a97e40feb9615bd03bbb6e9a3946f3a3ee537244bc467fac9a8
Instruction ID: 4e09d8dd7c57ba4e1cd966763fdd9104e00f51fbcfd7afab0db844a8ca847ccd
Opcode Fuzzy Hash: f2e1869b5a514a97e40feb9615bd03bbb6e9a3946f3a3ee537244bc467fac9a8
Instruction Fuzzy Hash: 19327E34B102099FDF55EB68D990BADB7B6FB88314F108529E509EB355DB34EC42CBA0

Function 068DACE0 Relevance: 12.9, Strings: 10, Instructions: 397
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$eq, xrefs: 068DAE0D
XM, xrefs: 068DB15A
$eq, xrefs: 068DAE54
$eq, xrefs: 068DAE83
$eq, xrefs: 068DAE01
XM, xrefs: 068DB079
$eq, xrefs: 068DAE60
$eq, xrefs: 068DAE8F
$eq, xrefs: 068DAEB8
$eq, xrefs: 068DAEAC

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID: XM$XM$$eq$$eq$$eq$$eq$$eq$$eq$$eq$$eq
API String ID: 0-898559689
Opcode ID: 93dc247449a3ea874ce6005c11d795984d8ed9823e4d57c16f987d22df49936f
Instruction ID: 90a9116359db279658e484588fcde2832724b274685de524e8104c559f08619a
Opcode Fuzzy Hash: 93dc247449a3ea874ce6005c11d795984d8ed9823e4d57c16f987d22df49936f
Instruction Fuzzy Hash: 39E19170E102098FDF59DBA5D4906AEB7B2FF85300F208529E909EB355DB71EC46CBA1

Function 068C2873 Relevance: 6.1, APIs: 4, Instructions: 130
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 068C28F6
GetCurrentThread.KERNEL32 ref: 068C2933
GetCurrentProcess.KERNEL32 ref: 068C2970
GetCurrentThreadId.KERNEL32 ref: 068C29C9

Memory Dump Source

Source File: 00000004.00000002.4500333211.00000000068C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68c0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 6b948a203f5df9fdc9433299b88b05b9c399e611014a77c6bc0eb202f3b5050a
Instruction ID: 99ceea55ea8b308058a177b93cca7018b1dac2042ad894602bc8478a5d8db608
Opcode Fuzzy Hash: 6b948a203f5df9fdc9433299b88b05b9c399e611014a77c6bc0eb202f3b5050a
Instruction Fuzzy Hash: 555145B09002098FDB54CFAAD948BEEBBF1EF48310F248459E609A73A0D7359948CF65

Function 068C2878 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 068C28F6
GetCurrentThread.KERNEL32 ref: 068C2933
GetCurrentProcess.KERNEL32 ref: 068C2970
GetCurrentThreadId.KERNEL32 ref: 068C29C9

Memory Dump Source

Source File: 00000004.00000002.4500333211.00000000068C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68c0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: b6398ee2dcabe5e0117d01b66cae121732ca37c0b35c4e700eea5c812590112e
Instruction ID: 9bf0609a32c55c2ab3b1eaa561e8d29bb5adabc1bce91149a1c99d496bd8b193
Opcode Fuzzy Hash: b6398ee2dcabe5e0117d01b66cae121732ca37c0b35c4e700eea5c812590112e
Instruction Fuzzy Hash: 5E5155B09002098FDB54CFAAD948BDEBBF1EF48310F24841DE609A73A0D735A948CF65

Function 068CAF10 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 068CB176

Strings

tb, xrefs: 068CB0AE
tb, xrefs: 068CB0D3

Memory Dump Source

Source File: 00000004.00000002.4500333211.00000000068C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68c0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID: HandleModule
String ID: tb$tb
API String ID: 4139908857-786838781
Opcode ID: 10d1efd739e65cf537caf50738ffafdf484ef5a4cccdb5caa3ef1c9d12fd3d97
Instruction ID: 2933f493063d1f5b54e951a0a146dd886408a4d51c5fc2d036ee7fd90d6ded87
Opcode Fuzzy Hash: 10d1efd739e65cf537caf50738ffafdf484ef5a4cccdb5caa3ef1c9d12fd3d97
Instruction Fuzzy Hash: 7A819AB0A00B098FD7A4DF2AD44176ABBF1FF88310F00892ED59AD7A50D775E945CB91

Function 068D9158 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$eq, xrefs: 068D920F
$eq, xrefs: 068D9203
$eq, xrefs: 068D91C8
$eq, xrefs: 068D91D4

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID: $eq$$eq$$eq$$eq
API String ID: 0-812946093
Opcode ID: 77652dc18b8cb902118b293ccce2eed57a4a1d1b55c908e9f71cee418b359f66
Instruction ID: ee1de495a0aed55273771191dc003045b518e6178dc658eeafff917dee9f9d41
Opcode Fuzzy Hash: 77652dc18b8cb902118b293ccce2eed57a4a1d1b55c908e9f71cee418b359f66
Instruction Fuzzy Hash: 90913130F1060A8FDF54EF65D9507AEB7F6AF85200F10C569D90AEB359EE309D428B91

Function 068DCF48 Relevance: 4.5, Strings: 3, Instructions: 797
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$eq, xrefs: 068DD33F
$eq, xrefs: 068DD353
$eq, xrefs: 068DD347

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID: $eq$$eq$$eq
API String ID: 0-177832560
Opcode ID: a2d7ebc1ae17a8b5d04343b3606812f0a382e43d0435b4881c655721ba3eacd0
Instruction ID: 3b6618bbda94d79a2cdc4ee44d41ff0d1ce22e6bf315ce54bece60c10742f7ad
Opcode Fuzzy Hash: a2d7ebc1ae17a8b5d04343b3606812f0a382e43d0435b4881c655721ba3eacd0
Instruction Fuzzy Hash: E6624E30A006068FCB55EB69D590A5EB7F2FF85300F608A69D409DF369DB71ED86CB90

Function 068D4B70 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Ojq, xrefs: 068D4D27
fjq, xrefs: 068D527D
XPjq, xrefs: 068D4C9D

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID: fjq$XPjq$\Ojq
API String ID: 0-216941231
Opcode ID: d7566576da5a5f671208e4f24a9e31dd12163fe8d86cb39480a76ac5415b910f
Instruction ID: 057b7fad79542c038bba520ed21b868f8f1af679dced6de021fad7195295ab3f
Opcode Fuzzy Hash: d7566576da5a5f671208e4f24a9e31dd12163fe8d86cb39480a76ac5415b910f
Instruction Fuzzy Hash: 47619170F002089FEB549FB5C8557AEBBF6EF88300F20842AE509EB395DE759D458B91

Function 068D9149 Relevance: 2.7, Strings: 2, Instructions: 166COMMON

Download Yara Rule

Strings

$eq, xrefs: 068D9203
$eq, xrefs: 068D91C8

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID: $eq$$eq
API String ID: 0-2246304398
Opcode ID: 0095f1ec842ef53f2522570da2cfa9132844d49c3e7eebfb89ab0e8022a456ed
Instruction ID: 89bb5b21847ed66ac25d0af42bbf83b575df6c5031933e024a57582fd45b5b79
Opcode Fuzzy Hash: 0095f1ec842ef53f2522570da2cfa9132844d49c3e7eebfb89ab0e8022a456ed
Instruction Fuzzy Hash: D0512030B105068FDF54EB74E9507BEB7F6EB89210F50C469D50AEB399EA31DC428BA0

Function 00EEEA60 Relevance: 1.6, APIs: 1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4495488721.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ee0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f888d4bb10403a3fcd71877b14f051104da24d6a53af39b5b54c358817a1eae1
Instruction ID: 68382a7c8cbdfadea7f7655b30f4b90ecb9062d3d5f8a00e9c2c0c8172db445a
Opcode Fuzzy Hash: f888d4bb10403a3fcd71877b14f051104da24d6a53af39b5b54c358817a1eae1
Instruction Fuzzy Hash: A741E472D047998FCB14DF69D4446AEBBF1EF89310F15866AD808E7380EB349885CBD1

Function 068CD0E4 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 068CD202

Memory Dump Source

Source File: 00000004.00000002.4500333211.00000000068C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68c0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: ed9df40f748abe400a9ec48fc5fbf1e34913434f621d43389655a51e25614043
Instruction ID: efdd604a83a6eef06dd876b9f36298fda252bb847989e2fd2d41a155a31f6769
Opcode Fuzzy Hash: ed9df40f748abe400a9ec48fc5fbf1e34913434f621d43389655a51e25614043
Instruction Fuzzy Hash: 2451C1B5D003499FDB14CF99C984ADEBBB6FF88310F64812EE819AB210D775A945CF90

Function 068CD0F0 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 068CD202

Memory Dump Source

Source File: 00000004.00000002.4500333211.00000000068C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68c0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 7527b2310691c7686257def387d9baa22ba019bee0d2b6b111a81aedb66c2acc
Instruction ID: 0fc74f5acb37b6e73f4e60a221ff8407f576abf9e269cdb190bca36cc8dd36c1
Opcode Fuzzy Hash: 7527b2310691c7686257def387d9baa22ba019bee0d2b6b111a81aedb66c2acc
Instruction Fuzzy Hash: D741CFB1D003099FDB14CF9AC994ADEBBB5FF88310F64812AE818AB210D771A945CF90

Function 068CA5EC Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 068CF8F1

Memory Dump Source

Source File: 00000004.00000002.4500333211.00000000068C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68c0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: ddb29f9479fcccd6ceecd4292d631517e6c0234262d0bf78f9766e920d4e2dc7
Instruction ID: 0b683757ed9205ea2b287e5d87de4fcbf97ac3db0369707423ea9914bd3ef9c4
Opcode Fuzzy Hash: ddb29f9479fcccd6ceecd4292d631517e6c0234262d0bf78f9766e920d4e2dc7
Instruction Fuzzy Hash: DE4107B5900209DFDB54CF99C888AAEBBF5FF88324F24845DD619A7321D774E845CBA0

Function 068C2AB8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 068C2B47

Memory Dump Source

Source File: 00000004.00000002.4500333211.00000000068C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68c0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 58280d81868b4885ef8501ba7774ef90a686c7ce037e751ce7579a2a88b171b8
Instruction ID: 6f2fda092d8c005ca3f45d13990dd8c1e614b69edd9ba37ff7a029ddf8b10daa
Opcode Fuzzy Hash: 58280d81868b4885ef8501ba7774ef90a686c7ce037e751ce7579a2a88b171b8
Instruction Fuzzy Hash: 0421E4B5D00249DFDB10CFAAD984AEEBBF4FB48320F14801AE914A7350C379A954DF64

Function 068C2AC0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 068C2B47

Memory Dump Source

Source File: 00000004.00000002.4500333211.00000000068C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68c0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: cc0bee64b0ef447e820fb28824bd8d61f2039c6c347c4e7eea642836dbca8f71
Instruction ID: 2604ebae0f5a62e6c3b9c4a85b13f822c9c8064dfc181baf10899273454ebbdb
Opcode Fuzzy Hash: cc0bee64b0ef447e820fb28824bd8d61f2039c6c347c4e7eea642836dbca8f71
Instruction Fuzzy Hash: 2821E4B5900209DFDB10CF9AD984ADEFBF8EB48320F14801AE914A3350C375A944DF64

Function 068CB372 Relevance: 1.6, APIs: 1, Instructions: 57libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,068CB1F1,00000800,00000000,00000000), ref: 068CB3E2

Memory Dump Source

Source File: 00000004.00000002.4500333211.00000000068C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68c0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 14e85cfeb91dc5bd644b63a803e92cb5357f8019e0b9abb2c44cb7e89ced3fba
Instruction ID: d406255793a01ab05025752664d6465623ea475fe76a93c925f92fd2a1614f57
Opcode Fuzzy Hash: 14e85cfeb91dc5bd644b63a803e92cb5357f8019e0b9abb2c44cb7e89ced3fba
Instruction Fuzzy Hash: 531126B6C003499FCB10CFAAD884ADEFBF8EB48320F14841EE919A7200C775A545CFA5

Function 00EEE1C8 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,00EEEAB2), ref: 00EEEB9F

Memory Dump Source

Source File: 00000004.00000002.4495488721.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ee0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 6f0d7c6fcb3aca0dc0ddc75340513b5dee7b69c97adbfa7e4a39fcad16e4ba98
Instruction ID: 876f1672a8870b7c3152f1d9a2427cf2b4cc956d5feb7209e997cb7e1f05ce4c
Opcode Fuzzy Hash: 6f0d7c6fcb3aca0dc0ddc75340513b5dee7b69c97adbfa7e4a39fcad16e4ba98
Instruction Fuzzy Hash: 5A1103B1C006599BCB20CF9AC845AAEFBF4EB48320F14816AD918B7241D779A944CFA5

Function 068CA328 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,068CB1F1,00000800,00000000,00000000), ref: 068CB3E2

Memory Dump Source

Source File: 00000004.00000002.4500333211.00000000068C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68c0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c483755854344fbc2066987c1ada1f35916458d9d897ca42ca9d9595f7dbf288
Instruction ID: 603414bf9491bf57989265fa874fde70b6e09c8af76aa83714db3604057b7305
Opcode Fuzzy Hash: c483755854344fbc2066987c1ada1f35916458d9d897ca42ca9d9595f7dbf288
Instruction Fuzzy Hash: FB1117B6C00349CFDB10CFAAD844A9EFBF4EB48320F10842ED915A7200C375A545CFA5

Function 00EEEB30 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,00EEEAB2), ref: 00EEEB9F

Memory Dump Source

Source File: 00000004.00000002.4495488721.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ee0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 7ec54f15fa08825be6a4f9c1bd725b878d4ae25e150a98d9a71b33cef7383369
Instruction ID: e71988a41a6ede849a2d82325a0f8dae29f61dd22799b880b657fe19f3cdba7d
Opcode Fuzzy Hash: 7ec54f15fa08825be6a4f9c1bd725b878d4ae25e150a98d9a71b33cef7383369
Instruction Fuzzy Hash: 8E1103B2C046599FCB20CF9AC444AEEFBF5AF48320F14816AD818B7251D778A944CFA5

Function 068CB110 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 068CB176

Memory Dump Source

Source File: 00000004.00000002.4500333211.00000000068C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68c0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d09e37851fb78aedd9e034c094c188a1b5854d5232d9dfdc5bfa2e02bb5fc816
Instruction ID: dad5f7706a48d0a8774eee41fa22cf4e55f8b3a6e38b2e64715f477cd70a2644
Opcode Fuzzy Hash: d09e37851fb78aedd9e034c094c188a1b5854d5232d9dfdc5bfa2e02bb5fc816
Instruction Fuzzy Hash: 8611E0B6C006498FCB10CF9AD844ADEFBF4EF89320F14842AD929B7610C375A545CFA5

Function 068D4B60 Relevance: 1.4, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

XPjq, xrefs: 068D4C9D

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID: XPjq
API String ID: 0-4216394854
Opcode ID: 4d76e00f20006f011205aa10222250cd7ab2520d214afbc4cfae3cc711e058d7
Instruction ID: 635077e77419433eb9cc71464ecc7377bc41e8d633fee935ec15e7fe4f176d36
Opcode Fuzzy Hash: 4d76e00f20006f011205aa10222250cd7ab2520d214afbc4cfae3cc711e058d7
Instruction Fuzzy Hash: 57416074F002089FDB45DFA5C855BAEBBF6EF88300F20852AE505EB395DE749D058B91

Function 068DDAD0 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

PHeq, xrefs: 068DDC19

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID: PHeq
API String ID: 0-2873676430
Opcode ID: db96b52e0f80dac6c6f713204eb955ccfe75e31f9eff5dfefa8cd1bb4614e72e
Instruction ID: 219cada61da25a0dbc44fb23bb51766ee6536e61b737ee9404db7084b4353ea0
Opcode Fuzzy Hash: db96b52e0f80dac6c6f713204eb955ccfe75e31f9eff5dfefa8cd1bb4614e72e
Instruction Fuzzy Hash: 29416C70E006099FDB55DF65C59479EBBB2EF85304F204929E506EB280EB70A946CBA0

Function 068DDABD Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

PHeq, xrefs: 068DDC19

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID: PHeq
API String ID: 0-2873676430
Opcode ID: fe7f5369ff5b383a683d590b412e8972e71c0c466b48362aaea77e24fb805099
Instruction ID: 8bf914232a2e4c023e0a1c42ecc140c8bc2d1ed65331395dbd8dd8d89f10a265
Opcode Fuzzy Hash: fe7f5369ff5b383a683d590b412e8972e71c0c466b48362aaea77e24fb805099
Instruction Fuzzy Hash: 0D418E70E006099FDB55DF75D59069EBBB2FF85304F104929E906E7380EB70E846CBA0

Function 068D21B5 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

PHeq, xrefs: 068D2303

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID: PHeq
API String ID: 0-2873676430
Opcode ID: e40be36444790ee66c8830bfc9fee816a30488c370c199e2b3437c5bbaf8188f
Instruction ID: c7dc92117f08cc9671e855b1c5c318a535c0967c1f7082f871cc6af962840f13
Opcode Fuzzy Hash: e40be36444790ee66c8830bfc9fee816a30488c370c199e2b3437c5bbaf8188f
Instruction Fuzzy Hash: DA312430B002018FDB459B74D5647AE7BA3EF89214F208968D506EB3A5EF35DD46C7A0

Function 068D21C8 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PHeq, xrefs: 068D2303

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID: PHeq
API String ID: 0-2873676430
Opcode ID: ef0d82630205bfafd440fb61b5fcf47638f8f8cb043f165d590e9ed3856de6e0
Instruction ID: 2cbe4534a78c7afc30c2270ae05992aedf9409e94e8574e07a57898b46bb019d
Opcode Fuzzy Hash: ef0d82630205bfafd440fb61b5fcf47638f8f8cb043f165d590e9ed3856de6e0
Instruction Fuzzy Hash: 23310430B102058FDB49AB74D96476E7BA3AF89304F208828D506DB3A5EF35DD41C7A0

Function 068D82D0 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

$eq, xrefs: 068D831B

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID: $eq
API String ID: 0-731066626
Opcode ID: c2f300416051a268ccab5215e41c2c56bcbdc48c03eeb21072840c3920a9668d
Instruction ID: 6312ee7636b1836f2866d5374b879ab0984ef0f85fda9c7a6153bfee7c1f39d1
Opcode Fuzzy Hash: c2f300416051a268ccab5215e41c2c56bcbdc48c03eeb21072840c3920a9668d
Instruction Fuzzy Hash: F7F0C2B1B10205CFDFACDA59E9816BC77A5EB44318F14847ADA0DD7245C731EE06C7A1

Function 068DB238 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f02a3ba13e0479d132c11b50520121e36fa6024f5da2a66633c8e8420e88554a
Instruction ID: eea58bc6448561a0d730a6b62d5437fbf00ab09eabf03cea54a5d1fad5f5e5f3
Opcode Fuzzy Hash: f02a3ba13e0479d132c11b50520121e36fa6024f5da2a66633c8e8420e88554a
Instruction Fuzzy Hash: 23A1B9B4F101088BEF64DBADD4907AEB7F7EB89310F618425E609E7395CA34DC819761

Function 068D61F0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 473a264c6cb5ce06289f2dae5d6600f0eeb9b77bb56406f35045225593498dd0
Instruction ID: 6de643795f94229678826d44ff262d3fcc4c42a20c35261172c3efe398376bae
Opcode Fuzzy Hash: 473a264c6cb5ce06289f2dae5d6600f0eeb9b77bb56406f35045225593498dd0
Instruction Fuzzy Hash: C461B371F004114FCB519A6EDC8066FBAD7AFC8220F254439D90EDB365EE69ED4287D1

Function 068D42A1 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62300845e55eddd5bcac395384efd5b20cce3aafbb694ce4a949421c7b623048
Instruction ID: 44f795334ac190d856e009512f01ae7bb9a4837d91700b80ce87a13be072eb49
Opcode Fuzzy Hash: 62300845e55eddd5bcac395384efd5b20cce3aafbb694ce4a949421c7b623048
Instruction Fuzzy Hash: BB812B30B106098FDB54DFA8D5947AEB7F6AF89300F148529D50AEB399EF34EC428B51

Function 068D42B0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 859ad586cb78a2b4af756c85701833d7b1ee7fcf022e9403aa872fedf1f315c4
Instruction ID: 87ab22d11d6d3a9e48d397eca5e3db5680b2bfd127be113fcdf1f4c59c30f332
Opcode Fuzzy Hash: 859ad586cb78a2b4af756c85701833d7b1ee7fcf022e9403aa872fedf1f315c4
Instruction Fuzzy Hash: 9A813C30B106098BDB54DFA8D59479EB7F6AF89300F108529D50AEB399EE34EC428B51

Function 068D45C4 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c32c28133cdd2c0c0a3554ce6bb243371feb6fd5655fd9081084469e30036286
Instruction ID: 424302e1e8fc4f48924498efecfb27d4503185b7acbc747fb73af1b1a70db6d1
Opcode Fuzzy Hash: c32c28133cdd2c0c0a3554ce6bb243371feb6fd5655fd9081084469e30036286
Instruction Fuzzy Hash: 1F914D74E006198BDF60DF68C880B9DB7B1FF89300F208699D549FB295DB70AA85CF91

Function 068D45D8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d6d83a7b0f89be4f6005de36e0609a7f5d0921bb4308c47a9e8c415cd600924
Instruction ID: c2a8b02d414df8eb3ef7ce15c04931ac19153770452978c51ff87bd5da64a2e7
Opcode Fuzzy Hash: 7d6d83a7b0f89be4f6005de36e0609a7f5d0921bb4308c47a9e8c415cd600924
Instruction Fuzzy Hash: 5F912B74E106198BDF60DF68C880B9DB7B1FF89300F208599D549FB295EB71AA85CF90

Function 068DEB28 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84f808f165a58852c4f018f5f1d44515fe82911e82efb214deccfef72419ff3f
Instruction ID: cf9bfbf801212e1a96d3f01577b9bc1f48769fae516073c84e48b3d1fc8d29ae
Opcode Fuzzy Hash: 84f808f165a58852c4f018f5f1d44515fe82911e82efb214deccfef72419ff3f
Instruction Fuzzy Hash: 63711F70A006099FDB94DFA9D984A9DBBF6EF84310F24C429E409EB355DB30ED45CB61

Function 068DEB1B Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acca48601b97fbcbe2a3231a371b32af6505d00364246f29dc6ae078b96bfdff
Instruction ID: 48f6d4d6b28561e1242d597d620a8710d221722031f55f0f72d815c86fb90c74
Opcode Fuzzy Hash: acca48601b97fbcbe2a3231a371b32af6505d00364246f29dc6ae078b96bfdff
Instruction Fuzzy Hash: D8712E70A006099FDB94DFA9D984AADBBF6EF84310F24C429E409EB355DB30ED46CB50

Function 068DF968 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 367c50bac33ac3630d12f31287ff7d8950f24a70f3c60f3e1bce92020a1d39e5
Instruction ID: 86e2386da5620d5bcfe49f6bedbdb816fd68780a07b546750382185cbb3a4601
Opcode Fuzzy Hash: 367c50bac33ac3630d12f31287ff7d8950f24a70f3c60f3e1bce92020a1d39e5
Instruction Fuzzy Hash: 9051EA74B202049BEFA16A7DD85572F379AD789350F20442AE70BD73DACA78CC4197B2

Function 068DFBC8 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ca79c00197c918aba372c87cabdb37b6ccca2ed12daba130de2cee3847e76fb
Instruction ID: f5005edef8df401da8ecf3547030a6d6c6515d874446b2eae1ff972e9a6054e7
Opcode Fuzzy Hash: 4ca79c00197c918aba372c87cabdb37b6ccca2ed12daba130de2cee3847e76fb
Instruction Fuzzy Hash: D651EF31E00119DFCF54AFB8E8846ADBBB2EF89311F108869E707E7250DB359955DBA0

Function 068DF978 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4318e29b52cbf68f8368f8191eb4441f1c6c339988d10ba698f51f95a5d7dcd
Instruction ID: 15a34da06b68101c2abc28da910e391fcd28422c653e63f6ed958deeacf14517
Opcode Fuzzy Hash: a4318e29b52cbf68f8368f8191eb4441f1c6c339988d10ba698f51f95a5d7dcd
Instruction Fuzzy Hash: 1051E674B202049BEFA16ABDD85572F379AD789310F20442AE70BD73D9CA78CC4197B2

Function 068DFBB8 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ed15b66c54eaede2dbba7ff004e60d3e580412d290f9905bcaea83b58c8ed82
Instruction ID: efb63be866b2cb1f0f27dd7de425031b022fb5f12ca764a197099fc789b2df07
Opcode Fuzzy Hash: 0ed15b66c54eaede2dbba7ff004e60d3e580412d290f9905bcaea83b58c8ed82
Instruction Fuzzy Hash: B2410231F101059FCB58AF78E8442AEBBB2EF84311F50887AE60AD7256DF35986587A0

Function 068D5428 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0fb34141d5fbecd9b1025361852d3071a9a91219f3842fe6534d9cb73070ad8
Instruction ID: 6e10474bfa16d28813c6e581360bfca673d6282e222ba017db392a1f6c0f792b
Opcode Fuzzy Hash: f0fb34141d5fbecd9b1025361852d3071a9a91219f3842fe6534d9cb73070ad8
Instruction Fuzzy Hash: D7414271E006098FDF70CE99D881AAFF7F6FB84311F10492AE215D7650D731E9558BA2

Function 068DD970 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73a50c91c07007b9ef7589dd17b993be45600688e7541fc59bab57f4a143aeb7
Instruction ID: 9ebb3b4ad6fd75269f47d44963a0d396c8cf24c0e6fcf2957a623255c24881be
Opcode Fuzzy Hash: 73a50c91c07007b9ef7589dd17b993be45600688e7541fc59bab57f4a143aeb7
Instruction Fuzzy Hash: 3C31E330E1420A8FCF55DF69D98069EBBB5EF85300F108929E405EB305EB70A946CB90

Function 068D2079 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01c8489170669c27159b83003d754c43fb13b1f528a1dd113565439e0b110269
Instruction ID: d442f86242f8b639194e9f6aaad138d96bdd52c57277b2a065dd4fd4e57d051a
Opcode Fuzzy Hash: 01c8489170669c27159b83003d754c43fb13b1f528a1dd113565439e0b110269
Instruction Fuzzy Hash: 12319E34E102059FCF19DF64D8A4A9EBBB2EF89300F14C529EA06E7350DB71AD46CB50

Function 068D2088 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b31e1d77257b26c6878c718565bd97c46ae555656526df2a0ce28ef782774bdc
Instruction ID: c324581c28b2fd82d392eb04f6e885f689c68650954d4388d753a7b1b9deb512
Opcode Fuzzy Hash: b31e1d77257b26c6878c718565bd97c46ae555656526df2a0ce28ef782774bdc
Instruction Fuzzy Hash: C3318C34E102099BCF19DF65D8A4A9EB7B2FF89300F10C529EA06E7350DB71AD46CB90

Function 068D3AA1 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3963f2884837c61b779be28d6db598af405cf63da33906243077053d817ba850
Instruction ID: 057de7c81c43c6cfdbba1377ab0c5721b2f03ce5f3e240bf259f3d9eda7cc4db
Opcode Fuzzy Hash: 3963f2884837c61b779be28d6db598af405cf63da33906243077053d817ba850
Instruction Fuzzy Hash: E1218B75F106199FDB00DFA9E981BEEB7F5AB88710F088025E905E7395E734DD018B91

Function 068D3AB0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e3e2a0810b47c314d8eedf76ffd28a66ef028ba64ae7f8b0aa1ec9288691cb0
Instruction ID: 88b5af1f17531b9cf6ff8caf23877a72cd96c78294061fa290a5df24e15b2cf0
Opcode Fuzzy Hash: 4e3e2a0810b47c314d8eedf76ffd28a66ef028ba64ae7f8b0aa1ec9288691cb0
Instruction Fuzzy Hash: 31217A75F106198FDB40DF69E980AAEB7F1AB88710F188029EA05E7295E730D9018BA1

Function 00E9D005 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4495317600.0000000000E9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e9d000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc88f078dc39349d4393918ffaab2005210372e405ba261bae5a57f8c420b0ad
Instruction ID: 293358857ee168fb084ee9a117a93107fb3d37ece760eeef6a09d64453a6014d
Opcode Fuzzy Hash: cc88f078dc39349d4393918ffaab2005210372e405ba261bae5a57f8c420b0ad
Instruction Fuzzy Hash: 68316B7550D3C49FCB03CB24C994711BF71AB46314F29C5DBD9898B2A3C23A980ACB62

Function 00E9D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4495317600.0000000000E9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e9d000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d46595213e36a070a8018fe554fa84663f2552026138191ff4ce655ceacf6d51
Instruction ID: 994430241f8d1d90d5082d94905624211f6f3edaf5bca0bf4c8d71585d9d83b0
Opcode Fuzzy Hash: d46595213e36a070a8018fe554fa84663f2552026138191ff4ce655ceacf6d51
Instruction Fuzzy Hash: 8121F2B5508304DFDF15DF14DDC0B26BBA6FB88318F24C56DD8095B296C33AD846CA62

Function 068D3060 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b309249e16a753e4f09aedf81fa213cba99d6c461ee0ffc4388d91a4c97dca7f
Instruction ID: 21afb3d91b1f608867c9648146406be003e3dea4012d38ef0473606c3c5523f6
Opcode Fuzzy Hash: b309249e16a753e4f09aedf81fa213cba99d6c461ee0ffc4388d91a4c97dca7f
Instruction Fuzzy Hash: 0C116071E002189BCF54DB79D8815EEF7B5EF8A310F108579E506E7205DA319E45CBE2

Function 068D3BC0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c88887fd9b6d0411092578603d7fc1851ed47e8f92e4ace6abed116b7453c2d
Instruction ID: b87e9ad9b7a2385d110840b15dde22aa7c0c908d980610057ff20d390bf98ce6
Opcode Fuzzy Hash: 3c88887fd9b6d0411092578603d7fc1851ed47e8f92e4ace6abed116b7453c2d
Instruction Fuzzy Hash: 9A11C431F145298FCF549678E9546AE73EAEBC9710F048139D90AE7358EE34DC028BE1

Function 068D4200 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d07e5fef55694395105c80f4dce50949cb35188abd7d57f1c4d26511b7846b55
Instruction ID: 4ce79d7ccdf43d05be5b7c442ef398711cc2c3c53f707bfaab4b66a935e0ce17
Opcode Fuzzy Hash: d07e5fef55694395105c80f4dce50949cb35188abd7d57f1c4d26511b7846b55
Instruction Fuzzy Hash: E201DF31B005100BDB51D6BCD805B6FB7EADBC9714F28883AE10EDB346E924DC4243A1

Function 068D3880 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 475ee294e8f1bbf2f8617a2e36cf11da14f33d74d9197ef97018308a1c476364
Instruction ID: c0ffb5996b8ee8ff14ba6835c3ab03c9c33a96b45efccb93c2fd7ec5674c314a
Opcode Fuzzy Hash: 475ee294e8f1bbf2f8617a2e36cf11da14f33d74d9197ef97018308a1c476364
Instruction Fuzzy Hash: BB11D0B5D00259AFCB10CF9AD884ADEFFB8FB49310F50812AE918A7240C775A954CFA5

Function 068D4210 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64795794768a1fa34a59b3430e5e9436d3410ef971ff8d70a62b6f73b26d47e3
Instruction ID: 46f6eb33dd46b261d79532ff07f3c18460130284953e2b653d085b8c841adaab
Opcode Fuzzy Hash: 64795794768a1fa34a59b3430e5e9436d3410ef971ff8d70a62b6f73b26d47e3
Instruction Fuzzy Hash: F9018C31B100100BDB6496BDD455B2FB7DADBCDB24F24883AE60EC7345ED61EC4243A5

Function 068D3878 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 472d018d813481185d940ad5292a6bfdc0c12cb991c471348be477fb83759ee1
Instruction ID: 724ce306403a459c097a3b5f81b0fa9650d57edb4c3802142351d02dce9271c9
Opcode Fuzzy Hash: 472d018d813481185d940ad5292a6bfdc0c12cb991c471348be477fb83759ee1
Instruction Fuzzy Hash: EB21FFB5D00219AFCB10CF9AD984ADEFBB4FB09310F10812AE918B7240C375A954CFA5

Function 068D3BAF Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eed6ce349d1ad83e094d7e861af352e47efe129a9478b9798c40f4017c1867fc
Instruction ID: c5c964cbedec22fd4b4f0e1106d07927010385b39f61a36afcd7bf5b30779a07
Opcode Fuzzy Hash: eed6ce349d1ad83e094d7e861af352e47efe129a9478b9798c40f4017c1867fc
Instruction Fuzzy Hash: 5E018432F144144FDF549668A8542FF37AAABC9710F08413AD90AE7294EE24DC0287A2

Function 068DA311 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fab982af1e0316a664e05de856635b9bdeeedfb16e120603025ee336b36d402
Instruction ID: cd30344372d3b49bbe4390985f67e60d3d369c939307a99bb64785aee8e41616
Opcode Fuzzy Hash: 9fab982af1e0316a664e05de856635b9bdeeedfb16e120603025ee336b36d402
Instruction Fuzzy Hash: 8B01D630B141111FCB59E67CE85575E77E6EB86750F248839F50AC7355DA21EC028791

Function 068DED99 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6506fdb97882c6ec7a2011c548a8175fa10916cac278d993de2bd3737ac94544
Instruction ID: d6328f7a2912a7b6475404a0b33799d3c9d098bda3c0350ffe44e1b4ca40b3ad
Opcode Fuzzy Hash: 6506fdb97882c6ec7a2011c548a8175fa10916cac278d993de2bd3737ac94544
Instruction Fuzzy Hash: C301A231B104118FCB66DA7CE458B2EB3EADBC9610F14893DE24ACB345DE61EC024791

Function 068DEDA8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 572c7ce0e7f5762a646cf98f414017a17c76868f26cad5e3054ab00f95825559
Instruction ID: 960293c357216f58197a4de839d0445a9805db649a2953ccddefee35cc72bad1
Opcode Fuzzy Hash: 572c7ce0e7f5762a646cf98f414017a17c76868f26cad5e3054ab00f95825559
Instruction Fuzzy Hash: 12018C31B100108BCB65D97DA458B2E77EADBC9620F108839E60ACB341EE61EC0247A1

Function 068DA320 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0239d99113ce3d5a0feaf2c12f943d5caab0f046f6453b4929f26cf0538ade
Instruction ID: caeeb7c67b248eb54a657b360f92bf1edc6b5502fe7f3e26b4dceb9b292a6c71
Opcode Fuzzy Hash: 4e0239d99113ce3d5a0feaf2c12f943d5caab0f046f6453b4929f26cf0538ade
Instruction Fuzzy Hash: DF01AF30B101104BCB68E6BCE854B2E77DAEB8A750F208839E60EC7355DE21ED028791

Function 068D6470 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2157787157ef75d297d223ee2456195f1863ffc1c872546a00bf752f2846850
Instruction ID: 9697163b69b0b73d6bffc7d77868e2f671ab67773809060b7e543764bd7bf314
Opcode Fuzzy Hash: e2157787157ef75d297d223ee2456195f1863ffc1c872546a00bf752f2846850
Instruction Fuzzy Hash: 77E0D871E5520C6BDF60CEB4CD5579E7BADD702214F1088A6D904D7181F536DD4543A2

Function 068D6480 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa976699a50b98a0a6b50c08d3026a88d70fc42e5459dfcadbf44bb0d2ea6d04
Instruction ID: 18a89033260992ff7a292ab310ddb26edb77cf22dd3d29c632d34461655aa863
Opcode Fuzzy Hash: aa976699a50b98a0a6b50c08d3026a88d70fc42e5459dfcadbf44bb0d2ea6d04
Instruction Fuzzy Hash: 77E0C270E1010CABDF60CEB4CA4575E73AED701218F2088A5D508D7241F632DE4143A1

Non-executed Functions

Function 068D76A0 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$eq, xrefs: 068D7811
$eq, xrefs: 068D7805
$eq, xrefs: 068D77E0
$eq, xrefs: 068D7C3C
$eq, xrefs: 068D7B9D
$eq, xrefs: 068D7C52
$eq, xrefs: 068D7B91
$eq, xrefs: 068D7C46
$eq, xrefs: 068D7C30
$eq, xrefs: 068D77D4

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID: $eq$$eq$$eq$$eq$$eq$$eq$$eq$$eq$$eq$$eq
API String ID: 0-2049195972
Opcode ID: 8e9c83cf00fbcfef1c24330c84344413a4468b89bd8bfbee5c05ea6e9345c2d3
Instruction ID: 536f1218557ce1cc1ecc8aa8a7f359246c2a73b112a3084bfaa2fde937322ac0
Opcode Fuzzy Hash: 8e9c83cf00fbcfef1c24330c84344413a4468b89bd8bfbee5c05ea6e9345c2d3
Instruction Fuzzy Hash: 3B121C30E01219CFDB64DF65C994AAEB7B2BF88304F208569D50AEB365DB309D85CF91

Function 068DA948 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$eq, xrefs: 068DAB06
$eq, xrefs: 068DAAD0
$eq, xrefs: 068DAAFA
$eq, xrefs: 068DAA4A
$eq, xrefs: 068DAAA5
$eq, xrefs: 068DAAC4
$eq, xrefs: 068DAA3E
$eq, xrefs: 068DAA99

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID: $eq$$eq$$eq$$eq$$eq$$eq$$eq$$eq
API String ID: 0-1110479544
Opcode ID: 72eb9010c86edce4a69d86ddcd4996a81acee65642c4daf869282ba5ba81cd4b
Instruction ID: 37aa50e7d90908427638242cb938bfb1f672a5accc3237ed27aee7ead68dc75c
Opcode Fuzzy Hash: 72eb9010c86edce4a69d86ddcd4996a81acee65642c4daf869282ba5ba81cd4b
Instruction Fuzzy Hash: 5E918030A10209DFDB68EF65D585B6E7BF2EF84310F208529E405EB395DB759D81CBA0

Function 068D70A0 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$eq, xrefs: 068D73DC
.5}q, xrefs: 068D70FB
$eq, xrefs: 068D75B4
$eq, xrefs: 068D7382
$eq, xrefs: 068D73E8
$eq, xrefs: 068D75A8
$eq, xrefs: 068D753C

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID: .5}q$$eq$$eq$$eq$$eq$$eq$$eq
API String ID: 0-1622854337
Opcode ID: 3fd1de414611dc29085bae11322c21323a40ef5e9dd8cdf07dcd0122e9c47ea4
Instruction ID: c29718aa138ad1da72527d267a8ce474e26788aacc33f27644bcf5948bdaedbd
Opcode Fuzzy Hash: 3fd1de414611dc29085bae11322c21323a40ef5e9dd8cdf07dcd0122e9c47ea4
Instruction Fuzzy Hash: F6F13C30A10208CFDB55EFA5D494A6EB7B2FF84300F648568D506DB3A9DB71AC82CB91

Function 068D83D8 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$eq, xrefs: 068D8697
$eq, xrefs: 068D8632
$eq, xrefs: 068D863E
$eq, xrefs: 068D86A3

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID: $eq$$eq$$eq$$eq
API String ID: 0-812946093
Opcode ID: 7ef35b18ad84714e9ea4c608942587e710512cfc35414cf22a5056f6756e832d
Instruction ID: d7ced4df4407aa1df52a470442ed2aea475d8ca014fae9f47eaff25aa69f7e23
Opcode Fuzzy Hash: 7ef35b18ad84714e9ea4c608942587e710512cfc35414cf22a5056f6756e832d
Instruction Fuzzy Hash: E8B14C70B10208CFDB64EB69D555AAEB7B2EF84310F24C529D50AEB395DB74DC82CB90

Function 068DACD0 Relevance: 5.2, Strings: 4, Instructions: 172COMMON

Download Yara Rule

Strings

$eq, xrefs: 068DAE54
$eq, xrefs: 068DAE83
$eq, xrefs: 068DAE01
$eq, xrefs: 068DAEAC

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID: $eq$$eq$$eq$$eq
API String ID: 0-812946093
Opcode ID: d23bc445550741fe0941e1ad0fdfdb6988e9cf18731dfd1e2831c8e687ea3ba4
Instruction ID: 672dfb8ae2125bd9038b991e8c26a714979fc1de928e650f72557503e3b0506d
Opcode Fuzzy Hash: d23bc445550741fe0941e1ad0fdfdb6988e9cf18731dfd1e2831c8e687ea3ba4
Instruction Fuzzy Hash: 77517330E10204CFDFA9EB65D5806ADB7B2EF89311F248969E505E7356DB31EC42CBA1

Function 068D87F0 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LReq, xrefs: 068D88E3
LReq, xrefs: 068D8932
$eq, xrefs: 068D886F
$eq, xrefs: 068D887B

Memory Dump Source

Source File: 00000004.00000002.4500380011.00000000068D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d0000_BULK HARVEST - VESSEL PARTICULARS.jbxd

Similarity

API ID:
String ID: LReq$LReq$$eq$$eq
API String ID: 0-731573373
Opcode ID: f4dc862141616020f6194e413bd09a4514e30da2b0b2d3a9a17cb4daf3c4b0a5
Instruction ID: 9b14de0974eb6f3a7e54bab5db1f95834df2eb4b779f1124a2754ca0aa67cbf6
Opcode Fuzzy Hash: f4dc862141616020f6194e413bd09a4514e30da2b0b2d3a9a17cb4daf3c4b0a5
Instruction Fuzzy Hash: 91518E70B102059FDB58EB39D981A6E77E6FF88304F14C568E506DB3A9DA31EC41CBA1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c3geqewl.mfc.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j0yy3yb5.33l.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ti0ec2vn.jab.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xm4obhw3.kei.ps1

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe

Function 04A8DFB8 Relevance: 2.8, Strings: 1, Instructions: 1567
COMMON

Function 04A81AF0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 198
COMMON

Function 0687200C Relevance: 1.7, APIs: 1, Instructions: 248
processCOMMON

Function 06872018 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 04A86848 Relevance: 1.6, APIs: 1, Instructions: 142
COMMON

Function 04A86890 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Function 04A88524 Relevance: 1.6, APIs: 1, Instructions: 115
COMMON

Function 00B9590C Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Function 04A869E4 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre