Windows Analysis Report
SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

ID:	1521528
Product:	CloudBasic
Start time:	22:24:13
Start date:	28.09.2024
Sample:	SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	b954dc27c4bf7b87dcc365ee9e1c99db
SHA1:	405dd8848ecbc7dce62978bf96571d9c2a8bf8f8
SHA256:	5af43067ad6e35eca23cbfe8de88d89984e9f1996625a8bba845669c5f9fb10b
Filetype:	Win32 Executable (generic) a (10002005/4) 99.96%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_7dd5f59ad4b8c3eff5e6cb56669dac635af4597_e30bf782_3c08e170-e099-426f-ab81-7dafb72511c7\Report.wer	Unicode text, UTF-16, little-endian text, with CRLF line terminators	7FBF214B51065C40645A8741A42B1E56	A0C0ECEA6CCFFA01D196255DA2D3D89A136731C1	13F80E0085CE89684DB11F0AFD79AAAD35D3F9E8C3FD64D7AB371B94113F42E9
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_9f8a51d2e97124c38f6ead774f7a4d26f0c08f_e30bf782_44600bb9-7195-4d8d-b9e1-633f0683a2ec\Report.wer	Unicode text, UTF-16, little-endian text, with CRLF line terminators	21A80604732596906AAD9DCF30ABD15E	7497EE6521C5D4C9D846BBCC9D842338AFF614D3	B4D2A8758B9D96B682D78709050588973F2FFE7358456A4FFCDE788EC0F4B011
C:\ProgramData\Microsoft\Windows\WER\Temp\WER90AF.tmp.dmp	Mini DuMP crash report, 14 streams, Sat Sep 28 20:25:25 2024, 0x1205a4 type	D8A580B67519AA07BD882B7B4AE458C8	361B381D26EE839FC82CA851BD9DBE9A8F372E03	1AF2FC6234384546853E28BB7A2FB0FFF4B0B7BB9117FEA8FF4062F9B74B13B3
C:\ProgramData\Microsoft\Windows\WER\Temp\WER95FF.tmp.WERInternalMetadata.xml	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators	F62DE14DAB6AF0D9833358068D964497	6892CDB5132C69387DDCADC7B1E95D532C169820	F936A8FC18E2601FA0EE0B66C0DF3D1D54A7B6CB6F3C73DA454D0FBBB18CE06F
C:\ProgramData\Microsoft\Windows\WER\Temp\WER961F.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	3DE66D160515C3887BEF17604476A9DF	2D352162A79671B3CA6FB5EB0E4166CFB17A86A4	9282C3C080903F73F2BC5AB449C9CB81C04FA444B9856AEB3E24F1DE725D0CD3
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA149.tmp.dmp	Mini DuMP crash report, 14 streams, Sat Sep 28 20:25:29 2024, 0x1205a4 type	8D06F1DB4CCA6064F56FF67B7E569419	45AB75B3C9D0C0DBE7C138466EE0DED5AB3EF45E	77651D3D9E9E73437E5EBF2AD20BDF83455E752BFBC9C64CF259263307EC3D88
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA3EA.tmp.WERInternalMetadata.xml	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators	E96B35C89B618D6BAC9114AB24F2EA99	3408BB4ECD0DD90358416D3132A66D04EE1F8EB2	AAB39CA72C330C01B42D656061A9D0B8B1D46FCD00904935A84DDC7051BE68E3
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA40A.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	6AB6BC042CA4A0C198EA68980ECDB557	769394818F9010DABB512AE7B5881128CDBBB1B9	15066D03D2E83DFC9CFDD9DC79D7DC7C31482A457D15D6D46ACF84084FC73D78
C:\Windows\appcompat\Programs\Amcache.hve	MS Windows registry file, NT/2000 or above	C988162B2314CE43577FFFF15F2FAEB1	04964741570916A1E3C4EE025AE533C00F514F02	C63C9648258CE9420FBDD672F19812DA671202BA6E32509E78221B619BAF7C43

AV Detection

Source: SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Avira: detected

Source: SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

ReversingLabs: Detection: 68%

Source: Submited Sample

Integrated Neural Analysis Model: Matched 84.3% probability

Source: SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Joe Sandbox ML: detected

Compliance

Source: SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Networking

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: tse1.mm.bing.net

Source: Amcache.hve.7.dr

String found in binary or memory: http://upx.sf.net

System Summary

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe	Code function: 4_2_0007DBB1		4_2_0007DBB1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe	Code function: 4_2_000843C6		4_2_000843C6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe	Code function: 4_2_00076669		4_2_00076669
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe	Code function: 4_2_00083774		4_2_00083774

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Code function: String function: 000804C0 appears 36 times

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 488

Source: SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe, 00000004.00000000.2304213204.000000000011A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameBuild.exeD vs SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe
Source: SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe	Binary or memory string: OriginalFilenameBuild.exeD vs SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Source: SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal64.winEXE@3/9@1/0

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3872

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\196abeed-8e62-4e78-8ffe-0cd99aa368fe

Jump to behavior

Source: SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

ReversingLabs: Detection: 68%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 488
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 508

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Section loaded: apphelp.dll

Jump to behavior

Source: SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe	Static PE information: More than 200 imports for user32.dll
Source: SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe	Static PE information: More than 200 imports for kernel32.dll

Data Obfuscation

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Code function: 4_2_0007B0F2 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

4_2_0007B0F2

Source: SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Static PE information: real checksum: 0xc43c0 should be: 0xc7e5d

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe	Code function: 4_2_00078100 push eax; ret		4_2_00078114
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe	Code function: 4_2_00078100 push eax; ret		4_2_0007813C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe	Code function: 4_2_000804FB push ecx; ret		4_2_0008050B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe	Code function: 4_2_00078EE9 push ss; ret		4_2_00078F47

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Code function: 4_2_00075E71 str word ptr [ecx-275CF5FCh]

4_2_00075E71

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

API coverage: 1.3 %

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Code function: 4_2_00071762 VirtualQuery,GetSystemInfo,VirtualQuery,VirtualAlloc,VirtualProtect,

4_2_00071762

Source: Amcache.hve.7.dr	Binary or memory string: VMware
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.7.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.7.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.7.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: Amcache.hve.7.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.7.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.7.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.7.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.7.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.7.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.7.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.7.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.7.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.7.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.7.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe	API call chain: ExitProcess graph end node

Anti Debugging

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Code function: 4_2_0007B0F2 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

4_2_0007B0F2

Language, Device and Operating System Detection

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Code function: GetLocaleInfoA,

4_2_0007846D

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Code function: 4_2_0007EEE8 __lock,_strcat,_strncpy,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,_strncpy,

4_2_0007EEE8

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Code function: 4_2_00081596 EntryPoint,GetVersionExA,GetModuleHandleA,GetModuleHandleA,_fast_error_exit,_fast_error_exit,GetCommandLineA,GetStartupInfoA,__wincmdln,GetModuleHandleA,

4_2_00081596

Lowering of HIPS / PFW / Operating System Security Settings

Source: Amcache.hve.7.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: MsMpEng.exe