Windows Analysis Report
al7hCrfLj7.exe

Overview

General Information

Sample name:	al7hCrfLj7.exe renamed because original name is a hash value
Original sample name:	240e09debc48c35fe091a9f67781cf90276fa2a6df9054793013124cd4b32bf7.exe
Analysis ID:	1501762
MD5:	2473c1903c8cc4af31caba70b049ae53
SHA1:	5aeab819faebfb7175cdb5e7508a24a3c028d910
SHA256:	240e09debc48c35fe091a9f67781cf90276fa2a6df9054793013124cd4b32bf7
Tags:	120-46-149-112exe
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Machine Learning detection for sample

Uses known network protocols on non-standard ports

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE / OLE file has an invalid certificate

Sigma detected: Communication To Uncommon Destination Ports

Classification

Signatures

AV Detection

Multi AV Scanner detection for submitted file

Source: al7hCrfLj7.exe

Virustotal: Detection: 13%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: al7hCrfLj7.exe

Joe Sandbox ML: detected

Source: al7hCrfLj7.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: E:\Project\remote_cs\x64\Release\remote_cs.pdb source: al7hCrfLj7.exe
Source:	Binary string: o E:\Project\remote_cs\x64\Release\remote_cs.pdb source: al7hCrfLj7.exe

Networking

Uses known network protocols on non-standard ports

Source: unknown

Network traffic detected: HTTP traffic on port 49707 -> 8888

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.5:49707 -> 120.46.149.112:8888

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 120.46.149.112 120.46.149.112

Source: unknown	TCP traffic detected without corresponding DNS query: 120.46.149.112
Source: unknown	TCP traffic detected without corresponding DNS query: 120.46.149.112
Source: unknown	TCP traffic detected without corresponding DNS query: 120.46.149.112
Source: unknown	TCP traffic detected without corresponding DNS query: 120.46.149.112
Source: unknown	TCP traffic detected without corresponding DNS query: 120.46.149.112

Source: C:\Users\user\Desktop\al7hCrfLj7.exe

Code function: 0_2_00007FF6776B1000 malloc,InternetOpenW,InternetOpenUrlA,InternetReadFile,HeapCreate,SleepEx,RtlAllocateHeap,memcpy,

0_2_00007FF6776B1000

Source: global traffic

HTTP traffic detected: GET /safekey HTTP/1.1User-Agent: myappHost: 120.46.149.112:8888Cache-Control: no-cache

Source: al7hCrfLj7.exe, 00000000.00000002.2191580977.000002194F543000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://120.46.149.112/
Source: al7hCrfLj7.exe, 00000000.00000002.2191580977.000002194F55E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://120.46.149.112/a81-46d0-b6b6-535557bcc5faP
Source: al7hCrfLj7.exe, 00000000.00000002.2191580977.000002194F55E000.00000004.00000020.00020000.00000000.sdmp, al7hCrfLj7.exe, 00000000.00000002.2191580977.000002194F51C000.00000004.00000020.00020000.00000000.sdmp, al7hCrfLj7.exe, 00000000.00000002.2191275880.0000004D16F4A000.00000004.00000010.00020000.00000000.sdmp, al7hCrfLj7.exe, 00000000.00000002.2191580977.000002194F543000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://120.46.149.112:8888/safekey
Source: al7hCrfLj7.exe, 00000000.00000002.2191580977.000002194F55E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://120.46.149.112:8888/safekey#
Source: al7hCrfLj7.exe, 00000000.00000002.2191580977.000002194F55E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://120.46.149.112:8888/safekeyb
Source: al7hCrfLj7.exe, 00000000.00000002.2191275880.0000004D16F4A000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://120.46.149.112:8888/safekeyj
Source: al7hCrfLj7.exe, 00000000.00000002.2191580977.000002194F55E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://120.46.149.112:8888/safekeyl
Source: al7hCrfLj7.exe	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: al7hCrfLj7.exe	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: al7hCrfLj7.exe	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: al7hCrfLj7.exe	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: al7hCrfLj7.exe	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: al7hCrfLj7.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: al7hCrfLj7.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: Amcache.hve.4.dr	String found in binary or memory: http://upx.sf.net
Source: al7hCrfLj7.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: al7hCrfLj7.exe	String found in binary or memory: https://sectigo.com/CPS0D

Detected potential crypto function

Source: C:\Users\user\Desktop\al7hCrfLj7.exe

Code function: 0_2_00007FF6776B1000

0_2_00007FF6776B1000

One or more processes crash

Source: C:\Users\user\Desktop\al7hCrfLj7.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6136 -s 1104

PE / OLE file has an invalid certificate

Source: al7hCrfLj7.exe

Static PE information: invalid certificate

Source: classification engine

Classification label: mal60.troj.winEXE@2/5@0/1

Source: C:\Windows\System32\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6136

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\7e0668d1-b6b0-4be5-ba42-fd9919a437bf

Jump to behavior

Source: al7hCrfLj7.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\al7hCrfLj7.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: al7hCrfLj7.exe

Virustotal: Detection: 13%

Source: unknown	Process created: C:\Users\user\Desktop\al7hCrfLj7.exe "C:\Users\user\Desktop\al7hCrfLj7.exe"
Source: C:\Users\user\Desktop\al7hCrfLj7.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6136 -s 1104

Source: C:\Users\user\Desktop\al7hCrfLj7.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\al7hCrfLj7.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\al7hCrfLj7.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\al7hCrfLj7.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\al7hCrfLj7.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\al7hCrfLj7.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\al7hCrfLj7.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\al7hCrfLj7.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\al7hCrfLj7.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\al7hCrfLj7.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\al7hCrfLj7.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\al7hCrfLj7.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\al7hCrfLj7.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\al7hCrfLj7.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\al7hCrfLj7.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\al7hCrfLj7.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\al7hCrfLj7.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\al7hCrfLj7.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: al7hCrfLj7.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: al7hCrfLj7.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: al7hCrfLj7.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: al7hCrfLj7.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: al7hCrfLj7.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: al7hCrfLj7.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: al7hCrfLj7.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: al7hCrfLj7.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: al7hCrfLj7.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: E:\Project\remote_cs\x64\Release\remote_cs.pdb source: al7hCrfLj7.exe
Source:	Binary string: o E:\Project\remote_cs\x64\Release\remote_cs.pdb source: al7hCrfLj7.exe

Source: al7hCrfLj7.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: al7hCrfLj7.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: al7hCrfLj7.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: al7hCrfLj7.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: al7hCrfLj7.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown

Network traffic detected: HTTP traffic on port 49707 -> 8888

Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\al7hCrfLj7.exe TID: 2892

Thread sleep time: -60000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\al7hCrfLj7.exe

Thread delayed: delay time: 60000

Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: al7hCrfLj7.exe, 00000000.00000002.2191580977.000002194F583000.00000004.00000020.00020000.00000000.sdmp, al7hCrfLj7.exe, 00000000.00000002.2191580977.000002194F543000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\al7hCrfLj7.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\al7hCrfLj7.exe	Process queried: DebugPort			Jump to behavior

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\al7hCrfLj7.exe

Code function: 0_2_00007FF6776B1918 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF6776B1918

Source: C:\Users\user\Desktop\al7hCrfLj7.exe	Code function: 0_2_00007FF6776B1424 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF6776B1424
Source: C:\Users\user\Desktop\al7hCrfLj7.exe	Code function: 0_2_00007FF6776B1918 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6776B1918
Source: C:\Users\user\Desktop\al7hCrfLj7.exe	Code function: 0_2_00007FF6776B1AC0 SetUnhandledExceptionFilter,	0_2_00007FF6776B1AC0

Source: C:\Users\user\Desktop\al7hCrfLj7.exe

Code function: 0_2_00007FF6776B17F0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF6776B17F0

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
120.46.149.112	unknown	China		4847	CNIX-APChinaNetworksInter-ExchangeCN	false

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://120.46.149.112:8888/safekey	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown

ID:	1501762
Product:	CloudBasic
Start time:	12:46:04
Start date:	30.08.2024
Sample:	al7hCrfLj7.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	2473c1903c8cc4af31caba70b049ae53
SHA1:	5aeab819faebfb7175cdb5e7508a24a3c028d910
SHA256:	240e09debc48c35fe091a9f67781cf90276fa2a6df9054793013124cd4b32bf7
Filetype:	Win64 Executable GUI (202006/5) 92.65%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_al7hCrfLj7.exe_d0d2628d6ca0711f88c7c65e16127ddd243e2854_03896217_a306d3d2-6964-4f19-b7a7-3e52e0acbb40\Report.wer	Unicode text, UTF-16, little-endian text, with CRLF line terminators	28798D69AB762790CEA4B2D66EE00C89	F4F43F6B9480D6EA5FF751188A23FD4CAE0CE9CE	3FB69BE80EFC4523F6EF8912363E063282FA17A1E9CEB5AABE5AFBB24451EFD4
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA961.tmp.dmp	Mini DuMP crash report, 14 streams, Fri Aug 30 10:46:54 2024, 0x1205a4 type	CFAFFAAAD1F3D0219F5D79E18087DDAF	64A6561B878BA83478E4F883FC16BA646112AF60	9BFBC0569FB01F8DE2C806E8260968B79CE528949977F4426EE6A74C12C46A78
C:\ProgramData\Microsoft\Windows\WER\Temp\WERAA1E.tmp.WERInternalMetadata.xml	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators	771B47E66AD7E9832A6A5924C8FC375E	8A75A37F02A95A99B80FAD5AEC0D55C4B7C3D026	5E3988D4AD44077B96CE6D1243BDEB6FB1DE8261FC2C78EC7E6C4AF9B942C121
C:\ProgramData\Microsoft\Windows\WER\Temp\WERAA3E.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	D701EE4E95E769749D1F377593DCF35C	925FF6E61D614757448BA86A7A6DBDA349C11F39	CE7750B666EE28EF471ADCB74975690F0888F230AFCE943B831DB225AB4CAAC4
C:\Windows\appcompat\Programs\Amcache.hve	MS Windows registry file, NT/2000 or above	8FEEE0A1910735547078D20994032CFF	E3F29ED278B2B71465725C7BCE518CDF9D3DE5CC	89AA8C2F4E5B86AF3C55F9A59143AE80380C5DBAE368BD8E9B5E240FB7023A4D

Windows Analysis Report
al7hCrfLj7.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted URLs

Windows Analysis Report al7hCrfLj7.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted URLs

Windows Analysis Report
al7hCrfLj7.exe