Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe
Analysis ID:	1521528
MD5:	b954dc27c4bf7b87dcc365ee9e1c99db
SHA1:	405dd8848ecbc7dce62978bf96571d9c2a8bf8f8
SHA256:	5af43067ad6e35eca23cbfe8de88d89984e9f1996625a8bba845669c5f9fb10b
Tags:	exe
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Machine Learning detection for sample

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to detect virtual machines (STR)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Detected potential crypto function

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

One or more processes crash

PE file contains an invalid checksum

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe (PID: 3872 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe" MD5: B954DC27C4BF7B87DCC365EE9E1C99DB)

WerFault.exe (PID: 5880 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 488 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 2996 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 508 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

ReversingLabs: Detection: 68%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 84.3% probability

Machine Learning detection for sample

Source: SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Joe Sandbox ML: detected

Source: SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: tse1.mm.bing.net

Source: Amcache.hve.7.dr

String found in binary or memory: http://upx.sf.net

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe	Code function: 4_2_0007DBB1	4_2_0007DBB1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe	Code function: 4_2_000843C6	4_2_000843C6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe	Code function: 4_2_00076669	4_2_00076669
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe	Code function: 4_2_00083774	4_2_00083774

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Code function: String function: 000804C0 appears 36 times

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 488

Source: SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe, 00000004.00000000.2304213204.000000000011A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameBuild.exeD vs SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe
Source: SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe	Binary or memory string: OriginalFilenameBuild.exeD vs SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Source: SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal64.winEXE@3/9@1/0

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3872

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\196abeed-8e62-4e78-8ffe-0cd99aa368fe

Jump to behavior

Source: SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

ReversingLabs: Detection: 68%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 488
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 508

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Section loaded: apphelp.dll

Jump to behavior

Source: SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe	Static PE information: More than 200 imports for user32.dll
Source: SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe	Static PE information: More than 200 imports for kernel32.dll

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Code function: 4_2_0007B0F2 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

4_2_0007B0F2

Source: SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Static PE information: real checksum: 0xc43c0 should be: 0xc7e5d

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe	Code function: 4_2_00078100 push eax; ret	4_2_00078114
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe	Code function: 4_2_00078100 push eax; ret	4_2_0007813C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe	Code function: 4_2_000804FB push ecx; ret	4_2_0008050B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe	Code function: 4_2_00078EE9 push ss; ret	4_2_00078F47

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Code function: 4_2_00075E71 str word ptr [ecx-275CF5FCh]

4_2_00075E71

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_4-12524

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

API coverage: 1.3 %

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Code function: 4_2_00071762 VirtualQuery,GetSystemInfo,VirtualQuery,VirtualAlloc,VirtualProtect,

4_2_00071762

Source: Amcache.hve.7.dr	Binary or memory string: VMware
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.7.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.7.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.7.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: Amcache.hve.7.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.7.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.7.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.7.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.7.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.7.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.7.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.7.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.7.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.7.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.7.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe	API call chain: ExitProcess graph end node			graph_4-12529
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe	API call chain: ExitProcess graph end node			graph_4-12543

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Code function: 4_2_0007B0F2 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

4_2_0007B0F2

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Code function: GetLocaleInfoA,

4_2_0007846D

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Code function: 4_2_0007EEE8 __lock,_strcat,_strncpy,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,_strncpy,

4_2_0007EEE8

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Code function: 4_2_00081596 EntryPoint,GetVersionExA,GetModuleHandleA,GetModuleHandleA,_fast_error_exit,_fast_error_exit,GetCommandLineA,GetStartupInfoA,__wincmdln,GetModuleHandleA,

4_2_00081596

Source: Amcache.hve.7.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 Process Injection	2 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	13 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe	68%	ReversingLabs	Win32.Trojan.Swizzor
SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe	100%	Avira	TR/Dldr.Swizzor.Gen
SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ax-0001.ax-msedge.net	150.171.28.10	true	false		unknown
tse1.mm.bing.net	unknown	unknown	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.7.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1521528
Start date and time:	2024-09-28 22:24:13 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe
Detection:	MAL
Classification:	mal64.winEXE@3/9@1/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 2 Number of non-executed functions: 31
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.65.92, 20.42.73.29
Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, g.bing.com, arc.msn.com, fe3cr.delivery.mp.microsoft.com, onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, 6.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.0.3.0.1.3.0.6.2.ip6.arpa, login.live.com, mm-mm.bing.net.trafficmanager.net, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, umwatson.events.data.microsoft.com
VT rate limit hit for: SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Simulations

Behavior and APIs

Time	Type	Description
16:25:29	API Interceptor	2x Sleep call for process: WerFault.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ax-0001.ax-msedge.net	http://yusdydsfjuuxx.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	150.171.28.10
	http://shaw-102219.weeblysite.com/	Get hash	malicious	Unknown	Browse	150.171.27.10
	http://bt-103431.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	150.171.28.10
	https://att-service-102729-104589.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	150.171.28.10
	https://att-109355.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	150.171.28.10
	https://netzero-102551.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10
	https://telstra-101775.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10
	https://mail-109392.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10
	https://att-104226.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10
	https://att-103325.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_7dd5f59ad4b8c3eff5e6cb56669dac635af4597_e30bf782_3c08e170-e099-426f-ab81-7dafb72511c7\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8313649670480145
Encrypted:	false
SSDEEP:	96:kYtF03RzfSszlcRfZncQXIDcQjc6qcElcw3D+HbHg/LAeugih88WpENEg92MbC4P:R2RzS909uP8jXIqzuiFMZ24IO8l
MD5:	7FBF214B51065C40645A8741A42B1E56
SHA1:	A0C0ECEA6CCFFA01D196255DA2D3D89A136731C1
SHA-256:	13F80E0085CE89684DB11F0AFD79AAAD35D3F9E8C3FD64D7AB371B94113F42E9
SHA-512:	48EEBCC3439C1AC4CF2D47BC9F1E59DB05F2EB22626371D3F0E169F3B5959FD0D374E9F41B1DF14DF32DBF21EB495D76E0590A4440FE5B7837415FEED614DE39
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.0.2.8.7.2.5.4.7.2.0.1.9.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.0.2.8.7.2.7.0.1.8.8.8.3.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.c.0.8.e.1.7.0.-.e.0.9.9.-.4.2.6.f.-.a.b.8.1.-.7.d.a.f.b.7.2.5.1.1.c.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.a.b.0.d.2.3.4.-.c.5.c.e.-.4.2.8.b.-.8.1.9.3.-.5.c.e.d.1.4.a.5.6.6.5.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...T.r.o.j.a.n...S.w.i.z.z.o.r...b.a.s.e.d...8.4.8.5...2.7.2.7.7...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.B.u.i.l.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.f.2.0.-.0.0.0.1.-.0.0.1.5.-.8.9.a.d.-.b.7.8.c.e.4.1.1.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.f.e.9.b.e.f.1.6.6.6.a.d.9.7.1.e.d.1.0.9.2.d.b.7.6.b.0.c.b.1.c.0.0.0.0.0.9.0.4.!.0.0.0.0.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_9f8a51d2e97124c38f6ead774f7a4d26f0c08f_e30bf782_44600bb9-7195-4d8d-b9e1-633f0683a2ec\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8265425130407492
Encrypted:	false
SSDEEP:	96:gAFNWITzfAszlc1yDfmQXIDcQjc6qcElcw3D+HbHg/LAeugih88WpENEg92MbC4P:9XWITzA809uP8jXIqzuiFMZ24IO8l
MD5:	21A80604732596906AAD9DCF30ABD15E
SHA1:	7497EE6521C5D4C9D846BBCC9D842338AFF614D3
SHA-256:	B4D2A8758B9D96B682D78709050588973F2FFE7358456A4FFCDE788EC0F4B011
SHA-512:	EF40CF3119824EB40397E23FE6F424A64ED7719311795428466AA7C4B1FF0E36E38BCDE30F4997B0B2AD36F9AF60E6303D94EA73B9F07754CEBC274003E8201C
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.0.2.8.7.2.9.7.0.3.4.0.8.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.0.2.8.7.3.0.5.4.7.1.5.1.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.4.6.0.0.b.b.9.-.7.1.9.5.-.4.d.8.d.-.b.9.e.1.-.6.3.3.f.0.6.8.3.a.2.e.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.f.a.e.a.0.2.3.-.2.0.7.e.-.4.3.0.6.-.a.f.b.c.-.4.1.c.4.a.5.b.7.d.4.e.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...T.r.o.j.a.n...S.w.i.z.z.o.r...b.a.s.e.d...8.4.8.5...2.7.2.7.7...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.B.u.i.l.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.f.2.0.-.0.0.0.1.-.0.0.1.5.-.8.9.a.d.-.b.7.8.c.e.4.1.1.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.f.e.9.b.e.f.1.6.6.6.a.d.9.7.1.e.d.1.0.9.2.d.b.7.6.b.0.c.b.1.c.0.0.0.0.0.9.0.4.!.0.0.0.0.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER90AF.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Sep 28 20:25:25 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	590468
Entropy (8bit):	0.9240539913405436
Encrypted:	false
SSDEEP:	3072:5blKVJodpfavdwQQeZ9h6rpq+IvUWcJxCbyCrwyznpEB/RumDwHDvej90nkqR2Qm:lrH
MD5:	D8A580B67519AA07BD882B7B4AE458C8
SHA1:	361B381D26EE839FC82CA851BD9DBE9A8F372E03
SHA-256:	1AF2FC6234384546853E28BB7A2FB0FFF4B0B7BB9117FEA8FF4062F9B74B13B3
SHA-512:	DE2A19F5F11D7894E8D4478F8F69AC555E17CCBA47DC0DCD2AA24061E2BBC104C91E69CEE38BCFE2C425F23D977F3E614640670DFBDC23C52DE658A4AF558AC1
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......5f.f........................................."..........T.......8...........T...........................,...........................................................................................eJ..............GenuineIntel............T....... ...4f.f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER95FF.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8524
Entropy (8bit):	3.699619899734924
Encrypted:	false
SSDEEP:	192:R6l7wVeJxg6NF6Y2DZSUuEEgmfnan6pr/89b8IsfLUm:R6lXJ26P6YkSUhEgmfnK87fd
MD5:	F62DE14DAB6AF0D9833358068D964497
SHA1:	6892CDB5132C69387DDCADC7B1E95D532C169820
SHA-256:	F936A8FC18E2601FA0EE0B66C0DF3D1D54A7B6CB6F3C73DA454D0FBBB18CE06F
SHA-512:	31410B636ADEE71F42CE12201B63E15DB849288C2385B5D7FDCE72098E5D8877629E994DD45E204DD432DA34D779CA01A43BC777333A14442A7DE2D691621D67
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.8.7.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER961F.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4909
Entropy (8bit):	4.578232891977028
Encrypted:	false
SSDEEP:	96:uIjf2I7uG7VoJ6PJQ1bqXYBl+VPvumuhRd:uIqYuG7y6PJQ1mXYBl+1vumuhv
MD5:	3DE66D160515C3887BEF17604476A9DF
SHA1:	2D352162A79671B3CA6FB5EB0E4166CFB17A86A4
SHA-256:	9282C3C080903F73F2BC5AB449C9CB81C04FA444B9856AEB3E24F1DE725D0CD3
SHA-512:	0246C27FBBC479A441065356A2D5CDA29D262C0D198A79E7A41C98BC3E1670FC738A89FB28C27CE71374D7D893AA5777740CFA0FAB94DEDAAB70E04367B60511
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="520528" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA149.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Sep 28 20:25:29 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	586736
Entropy (8bit):	0.9189702916923299
Encrypted:	false
SSDEEP:	3072:3GKVJodpfavdwQQeZ9h6rpq+IvUWcJxCbyCrwyznpEB/RumDwHDvej90nkqR2QWR:erH3
MD5:	8D06F1DB4CCA6064F56FF67B7E569419
SHA1:	45AB75B3C9D0C0DBE7C138466EE0DED5AB3EF45E
SHA-256:	77651D3D9E9E73437E5EBF2AD20BDF83455E752BFBC9C64CF259263307EC3D88
SHA-512:	B8333AFEE8102B18008A3BA4BE40CC79592A3FD57751891CC0DBFA3EA96E3B52552C2BCDEBF2F0496A3F50310DED39608A56F04F383CC30E2B169872B1CA8725
Malicious:	false
Preview:	MDMP..a..... .......9f.f........................................."..........T.......8...........T...........p...............,...........................................................................................eJ..............GenuineIntel............T....... ...4f.f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA3EA.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8454
Entropy (8bit):	3.6988572533357877
Encrypted:	false
SSDEEP:	192:R6l7wVeJxE6qF6Y2DWSUE4TgmfIJ1an6pDB89b7IsfmWIkpm:R6lXJS6A6YrSUTTgmfIJ1M77fhI3
MD5:	E96B35C89B618D6BAC9114AB24F2EA99
SHA1:	3408BB4ECD0DD90358416D3132A66D04EE1F8EB2
SHA-256:	AAB39CA72C330C01B42D656061A9D0B8B1D46FCD00904935A84DDC7051BE68E3
SHA-512:	368DBAD43635CE3CD0CDE816FA90E9005BC28DECD713084C59C6D0CDC8DF8C956B400EE7A5FB63777794AC67D2E95D0A305D39C9B70BC47A8E23E14B731FA9DB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.8.7.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA40A.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4839
Entropy (8bit):	4.544877028261893
Encrypted:	false
SSDEEP:	48:cvIwWl8zswtJg77aI903WpW8VYBYm8M4J6PJa2Fk+q8pXHp+VJdvunmuhRd:uIjf2I7uG7VFJ6PJeqXJ+VPvumuhRd
MD5:	6AB6BC042CA4A0C198EA68980ECDB557
SHA1:	769394818F9010DABB512AE7B5881128CDBBB1B9
SHA-256:	15066D03D2E83DFC9CFDD9DC79D7DC7C31482A457D15D6D46ACF84084FC73D78
SHA-512:	1D73D721FA1B59BA98C4707FABD565BF870AE7D16790B51BB30E6F153983CD58ECBE63A5C63C6D9F7D9C06DE0CAC47B61B4BAF3C2969F5976581FB22A288557D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="520528" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.469007815916115
Encrypted:	false
SSDEEP:	6144:HzZfpi6ceLPx9skLmb0faZWSP3aJG8nAgeiJRMMhA2zX4WABluuNOjDH5S:TZHtaZWOKnMM6bFpkj4
MD5:	C988162B2314CE43577FFFF15F2FAEB1
SHA1:	04964741570916A1E3C4EE025AE533C00F514F02
SHA-256:	C63C9648258CE9420FBDD672F19812DA671202BA6E32509E78221B619BAF7C43
SHA-512:	6AFCF957D0CF363203B5B12DC08073D3B35233B567E74E9C7492D9C181BCDEA35FCD49B795C1B0A3C80E642E43E782CFE3E317EB80FF94D1B4C54BA46E3D4ABA
Malicious:	false
Preview:	regfI...I....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.688944481915534
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe
File size:	753'664 bytes
MD5:	b954dc27c4bf7b87dcc365ee9e1c99db
SHA1:	405dd8848ecbc7dce62978bf96571d9c2a8bf8f8
SHA256:	5af43067ad6e35eca23cbfe8de88d89984e9f1996625a8bba845669c5f9fb10b
SHA512:	93e4422a32f9ead610ac73d6cca7c06f174806ab8df79d0c9fe7a5913dd6063ca8331a93c7080845792d73f6ede54ca44600bfdf1601c0622884763c7eea3150
SSDEEP:	12288:gj+jvIbgM7h8PzDlHkXOUoWwUF3g6jYc8dn9/Xp+2bqwldnBZP4OsRI+hRC:gj+8biPzDlHxUZG6j2dhZ+Y3jBZP4RIA
TLSH:	BFF40122B3C2D0B5D1C30F7469AA97108B30FDFB53B5550B79A25B8ACD72BA05E43B52
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+..KJ..KJ..KJ..+h..IJ..l...HJ...j..JJ...B..JJ...B..JJ..XB..JJ..l...JJ...i..JJ..NF..JJ..NF..JJ...U..JJ..l...JJ..NF..JJ..RichKJ.

File Icon


Icon Hash:	6623594c45050301

Static PE Info

General

Entrypoint:	0x81596
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x70000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x4724F87D [Sun Oct 28 21:00:45 2007 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	30d06e7f8bbe31666f40bdb01f63380e

Entrypoint Preview

Instruction
push 00000060h
push 000E6F30h
call 00007F58290841F3h
mov edi, 00000094h
mov eax, edi
call 00007F582907BE27h
mov dword ptr [ebp-18h], esp
mov esi, esp
mov dword ptr [esi], edi
push esi
call dword ptr [00087790h]
mov ecx, dword ptr [esi+10h]
mov dword ptr [000FE3BCh], ecx
mov eax, dword ptr [esi+04h]
mov dword ptr [000FE3C8h], eax
mov edx, dword ptr [esi+08h]
mov dword ptr [000FE3CCh], edx
mov esi, dword ptr [esi+0Ch]
and esi, 00007FFFh
mov dword ptr [000FE3C0h], esi
cmp ecx, 02h
je 00007F58290852DEh
or esi, 00008000h
mov dword ptr [000FE3C0h], esi
shl eax, 08h
add eax, edx
mov dword ptr [000FE3C4h], eax
xor esi, esi
push esi
mov edi, dword ptr [000875F8h]
call edi
cmp word ptr [eax], 5A4Dh
jne 00007F58290852F1h
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
cmp dword ptr [ecx], 00004550h
jne 00007F58290852E4h
movzx eax, word ptr [ecx+18h]
cmp eax, 0000010Bh
je 00007F58290852F1h
cmp eax, 0000020Bh
je 00007F58290852D7h
mov dword ptr [ebp-1Ch], esi
jmp 00007F58290852F9h
cmp dword ptr [ecx+00000084h], 0Eh
jbe 00007F58290852C4h
xor eax, eax
cmp dword ptr [ecx+000000F8h], esi
jmp 00007F58290852E0h
cmp dword ptr [ecx+74h], 0Eh
jbe 00007F58290852B4h
xor eax, eax
cmp dword ptr [ecx+000000E8h], esi
setne al
mov dword ptr [ebp-1Ch], eax

Rich Headers

Programming Language:

[ C ] VS2005 build 50727
[C++] VS2005 build 50727
[C++] VS2003 (.NET) build 3077
[ASM] VS2003 (.NET) build 3077
[ASM] VS2005 build 50727
[ C ] VS2003 (.NET) build 3077

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x88214	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xaa000	0xd6fc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x17958	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x17000	0x958	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x15e78	0x16000	3e777ec457934acbae462db3954e7cdd	False	0.6765913529829546	data	6.682217353526458	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x17000	0x745ed	0x75000	ff729987c895b9f0cc1b8779b7e59245	False	0.9185717982104701	data	7.952820554625134	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x8c000	0x1d058	0x1e000	bd9124e6bdf88aad7f3f486809dc3300	False	0.8010579427083333	data	7.228953730445401	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xaa000	0xd6fc	0xe000	10a5d0e4c4165d4f07d19f9897aaf881	False	0.34139578683035715	data	5.494393495853644	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0xaa688	0x2e90	Device independent bitmap graphic, 165 x 24 x 24, image size 0	English	United States	0.17181208053691274
RT_ICON	0xad518	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 0	English	United States	0.22073170731707317
RT_ICON	0xadb80	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	United States	0.5101351351351351
RT_ICON	0xadca8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	United States	0.5575692963752665
RT_ICON	0xaeb50	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	United States	0.6163294797687862
RT_ICON	0xaf0b8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.3403526970954357
RT_ICON	0xb1660	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.47701688555347094
RT_ICON	0xb2708	0xca8	Device independent bitmap graphic, 32 x 64 x 24, image size 0	English	United States	0.4527777777777778
RT_ICON	0xb33b0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.45286116322701686
RT_MENU	0xb4458	0x3ca	data	English	United States	0.48556701030927835
RT_MENU	0xb4824	0x22e	data	English	United States	0.514336917562724
RT_MENU	0xb4a54	0x3e8	data	English	United States	0.462
RT_MENU	0xb4e3c	0x422	data	English	United States	0.46313799621928164
RT_MENU	0xb5260	0x398	Matlab v4 mat-file (little endian) &, numeric, rows 2490384, columns 7602249, imaginary	English	United States	0.48043478260869565
RT_MENU	0xb55f8	0x88	data	English	United States	0.7352941176470589
RT_DIALOG	0xb5680	0x1f8	data	English	United States	0.5674603174603174
RT_DIALOG	0xb5878	0x210	data	English	United States	0.5397727272727273
RT_DIALOG	0xb5a88	0x1b0	data	English	United States	0.5555555555555556
RT_DIALOG	0xb5c38	0x14c	data	English	United States	0.608433734939759
RT_DIALOG	0xb5d84	0x2c8	data	English	United States	0.5154494382022472
RT_DIALOG	0xb604c	0x2b0	data	English	United States	0.5450581395348837
RT_DIALOG	0xb62fc	0x174	data	English	United States	0.5994623655913979
RT_DIALOG	0xb6470	0x188	data	English	United States	0.576530612244898
RT_DIALOG	0xb65f8	0x2e8	data	English	United States	0.4986559139784946
RT_DIALOG	0xb68e0	0x200	data	English	United States	0.517578125
RT_DIALOG	0xb6ae0	0xdc	data	English	United States	0.6818181818181818
RT_DIALOG	0xb6bbc	0x290	data	English	United States	0.5167682926829268
RT_MESSAGETABLE	0xb6e4c	0x538	Matlab v4 mat-file (little endian) \226_\001, rows 90000, columns 90001, imaginary	English	United States	0.469311377245509
RT_GROUP_ICON	0xb7384	0x5a	data	English	United States	0.7
RT_GROUP_ICON	0xb73e0	0x22	data	English	United States	1.0294117647058822
RT_VERSION	0xb7404	0x2f8	data	English	United States	0.4986842105263158

Imports

DLL	Import
comdlg32.dll	PageSetupDlgA, GetSaveFileNameA, PrintDlgA, ChooseColorA, GetOpenFileNameW, GetOpenFileNameA, CommDlgExtendedError, ChooseColorW, GetSaveFileNameW
advapi32.dll	RegSetValueExA, GetLengthSid, LookupPrivilegeValueA, RegDeleteKeyW, SetSecurityDescriptorOwner, RegEnumValueA, RegCreateKeyW, ControlService, RegisterEventSourceW, DeleteService, RegCreateKeyExA, RegOpenKeyExW, QueryServiceStatus, RegQueryValueW, AdjustTokenPrivileges, DuplicateToken, CreateServiceW, ReportEventA, InitializeSecurityDescriptor, GetAclInformation, GetUserNameA, RegQueryInfoKeyA, RegDeleteKeyA, OpenThreadToken, EqualSid, DeregisterEventSource, RegEnumKeyExW, RegQueryInfoKeyW, RegisterEventSourceA, RegEnumKeyA, CloseServiceHandle, SetSecurityDescriptorDacl, RegCloseKey, SetSecurityDescriptorGroup, RevertToSelf, RegEnumValueW, GetFileSecurityW, GetFileSecurityA, GetSecurityDescriptorDacl, AccessCheck, SetServiceStatus, RegOpenKeyExA, RegDeleteValueA, OpenSCManagerA, MapGenericMask, LookupPrivilegeValueW, InitializeAcl, RegQueryValueExA, GetTokenInformation, RegCreateKeyExW, RegOpenKeyA, RegSetValueExW, FreeSid, RegEnumKeyW, OpenSCManagerW, RegQueryValueExW, RegSetValueA, RegQueryValueA, RegisterServiceCtrlHandlerA, OpenServiceA, RegDeleteValueW, OpenServiceW
winspool.drv	FindFirstPrinterChangeNotification, DeviceCapabilitiesW, SetJobW, OpenPrinterW, GetPrinterW, EnumJobsW, FindNextPrinterChangeNotification, EnumPortsW, EnumPrintersW, GetJobW, SetPrinterDataW, ClosePrinter, FreePrinterNotifyInfo, DocumentPropertiesW
user32.dll	HideCaret, DestroyWindow, GetClassLongA, IsZoomed, AppendMenuA, GetSysColorBrush, EnableMenuItem, IsDialogMessageW, TabbedTextOutA, CreatePopupMenu, MonitorFromPoint, SendDlgItemMessageA, WindowFromPoint, GetParent, DefWindowProcA, GetMenuItemRect, ShowScrollBar, GetWindowDC, MapWindowPoints, GetCapture, GetActiveWindow, LoadMenuA, SetDlgItemInt, ModifyMenuA, IsWindowVisible, PostThreadMessageW, GetUpdateRgn, wsprintfA, GetSubMenu, MoveWindow, GetSysColor, TranslateMDISysAccel, GetIconInfo, CreateMenu, IsWindowEnabled, CopyAcceleratorTableA, CharUpperBuffA, GetWindow, SetTimer, UnpackDDElParam, DispatchMessageA, SetActiveWindow, SetCapture, IsRectEmpty, GetMessagePos, GetAsyncKeyState, GetMenuItemCount, RegisterWindowMessageA, GetMessageTime, LoadIconA, DlgDirListA, GetMenuCheckMarkDimensions, RegisterClipboardFormatA, LoadMenuIndirectA, SetScrollInfo, ShowCaret, GetClassNameW, GetWindowRect, GetMenuDefaultItem, GrayStringA, TranslateMessage, CreateWindowExW, DrawIcon, GetNextDlgGroupItem, PostMessageA, SetCursor, GetDesktopWindow, ShowWindow, GetWindowTextW, UpdateWindow, IntersectRect, PostThreadMessageA, SetMenuItemInfoA, IsIconic, AppendMenuW, GetWindowRgn, DispatchMessageW, LoadCursorW, TrackPopupMenu, DrawStateA, SetForegroundWindow, DlgDirSelectExA, CreateDialogIndirectParamW, IsClipboardFormatAvailable, SetWindowLongW, TranslateAcceleratorA, GetWindowTextLengthW, DialogBoxIndirectParamW, CreateDialogParamA, GetDlgItemTextA, GetDC, SetCaretBlinkTime, AdjustWindowRectEx, IsWindowUnicode, GetPropA, SetDlgItemTextW, UnregisterClassW, InvalidateRect, mouse_event, PeekMessageA, BeginPaint, GetDlgItem, GetMenuStringW, DestroyIcon, GetScrollInfo, DdeGetData, ClientToScreen, LoadBitmapA, EnableWindow, RemoveMenu, SetWindowLongA, GetSystemMetrics, GetForegroundWindow, MessageBoxW, GetNextDlgTabItem, ArrangeIconicWindows, CharUpperA, IsDlgButtonChecked, DestroyCaret, RemovePropA, LoadImageA, DeferWindowPos, GetMenuContextHelpId, GetSystemMenu, SetMenu, DdeCreateDataHandle, GetMenuState, CallNextHookEx, KillTimer, SetScrollRange, BringWindowToTop, GetClientRect, ReleaseCapture, ExcludeUpdateRgn, DrawFocusRect, UnhookWindowsHookEx, SetScrollPos, DefFrameProcA, GetDlgCtrlID, CreateWindowExA, IsWindow, GetDlgItemInt, DrawIconEx, EmptyClipboard, SystemParametersInfoA, ToAsciiEx, wvsprintfA, SetClipboardViewer, DeleteMenu, ScreenToClient, PeekMessageW, DrawMenuBar, CopyRect, DrawFrameControl, GetScrollPos, InsertMenuA, GetClassInfoW, GetFocus, ReleaseDC, EndPaint, RedrawWindow, CallWindowProcA, GetTabbedTextExtentA, DdeFreeStringHandle, DdeConnect, GetWindowThreadProcessId, SetRectEmpty, WinHelpA, DrawTextA, GetTopWindow, GetClassInfoA, LoadCursorA, EnumChildWindows, DrawTextW, PostQuitMessage, SendDlgItemMessageW, CharLowerA, GetLastActivePopup, DrawEdge, IsMenu, SetWindowsHookExW, DestroyCursor, SetWindowRgn, RegisterClassExA, RegisterClassA, DefDlgProcA, CharNextA, GetWindowLongA, SetPropA, SetWindowsHookExA, MessageBoxA, GetCursorPos, SetRect, GetDialogBaseUnits, FrameRect, GetMenu, DestroyMenu, SetWindowTextA, SetDlgItemTextA, GetWindowTextLengthA, GetMessageW, EnableScrollBar, SetWindowPos, RegisterClassW, FillRect, SetMenuItemBitmaps, MapDialogRect, SetMenuDefaultItem, GetWindowPlacement, ModifyMenuW, GetClassNameA, DlgDirSelectComboBoxExA, GetCursor, EqualRect, OffsetRect, InflateRect, GetComboBoxInfo, MessageBeep, SendMessageA, EndDialog, SendMessageW, GetWindowTextA, DlgDirListComboBoxA, ValidateRect, CreateIconIndirect, SetWindowContextHelpId, CloseClipboard, GetWindowContextHelpId, CheckDlgButton, DefWindowProcW, GetPropW, PostMessageW, UnregisterClassA, ScrollWindowEx, GetKeyState, GetClipboardData, PtInRect, IsChild, CopyIcon, IsDialogMessageA, DragDetect, CheckMenuItem, SetFocus, GetMessageA
kernel32.dll	UnhandledExceptionFilter, WriteFile, GetVersion, QueryPerformanceCounter, lstrcpyA, TerminateThread, MapViewOfFile, VirtualFree, ReadFile, GetEnvironmentStringsW, TerminateProcess, EnumResourceLanguagesW, GetPrivateProfileStringA, FreeEnvironmentStringsW, CreateFileMappingW, FatalAppExitA, GetCommandLineA, GlobalHandle, DeleteFileA, GetCurrentThread, HeapAlloc, GetWindowsDirectoryW, GetUserDefaultLCID, FreeLibrary, HeapSize, GetStringTypeW, LocalFree, SetHandleCount, GetFullPathNameW, SetFileAttributesA, GlobalFindAtomA, GetOEMCP, GetCPInfo, GetEnvironmentVariableW, SetUnhandledExceptionFilter, MultiByteToWideChar, CreateDirectoryA, InterlockedDecrement, LCMapStringW, GetModuleFileNameA, lstrcpyW, SetLastError, WideCharToMultiByte, FindResourceA, GetFileAttributesA, GetPrivateProfileIntA, InterlockedIncrement, GetLocalTime, GetModuleHandleA, GetStdHandle, IsBadWritePtr, TlsAlloc, GlobalLock, GetTimeFormatA, TlsGetValue, ExitThread, SetFileTime, InterlockedCompareExchange, GetSystemTimeAsFileTime, MoveFileW, GetACP, GetLogicalDriveStringsA, IsDebuggerPresent, DisconnectNamedPipe, GetFullPathNameA, GetTempPathW, GetTimeZoneInformation, GetShortPathNameW, ExitProcess, GetFileTime, IsValidLocale, OpenMutexA, GetTickCount, GetStartupInfoA, TlsFree, GetFileAttributesW, HeapFree, lstrcatA, CloseHandle, GetFileSize, GetEnvironmentStrings, GetTempFileNameA, CreateMutexA, SetFileAttributesW, GetWindowsDirectoryA, EnumSystemLocalesA, FileTimeToLocalFileTime, GetStartupInfoW, GlobalMemoryStatus, UnlockFile, FlushFileBuffers, GlobalGetAtomNameA, CreateThread, FreeEnvironmentStringsA, GetStringTypeExW, GetLocaleInfoA, LCMapStringA, FindFirstFileA, MulDiv, GlobalFree, GlobalFlags, IsBadReadPtr, SuspendThread, SetStdHandle, VirtualProtect, WaitForSingleObject, GetProfileStringA, GetVersionExW, ResumeThread, GetModuleHandleW, WinExec, LoadLibraryA, SetEnvironmentVariableA, WritePrivateProfileStringW, lstrcmpiA, OpenEventA, VirtualQuery, GetOverlappedResult, GetCurrentProcess, GetExitCodeThread, GetSystemDefaultLangID, GetTempPathA, CopyFileA, UnmapViewOfFile, InterlockedExchange, SetEnvironmentVariableW, SetFilePointer, DeleteCriticalSection, RtlUnwind, VirtualAlloc, GetProcessHeap, IsValidCodePage, ReleaseMutex, EnumResourceLanguagesA, IsBadCodePtr, SetPriorityClass, GlobalFindAtomW, LoadResource, SearchPathA, HeapDestroy, GetThreadLocale, FindNextFileA, FindClose, Sleep, lstrcpynW, PeekNamedPipe, SetEndOfFile, FindNextFileW, GetCurrentProcessId, GetModuleFileNameW, GetVersionExA, ConvertDefaultLocale, InitializeCriticalSection, GlobalAddAtomW, WritePrivateProfileStringA, FindFirstFileW, SetThreadPriority, LoadLibraryW, DeleteFileW, FileTimeToSystemTime, lstrcmpW, GlobalSize, DuplicateHandle, GetCurrentDirectoryA, CreateFileA, CompareStringA, HeapCreate, LockFile, GetVolumeInformationA, RaiseException, GlobalDeleteAtom, FormatMessageW, CompareFileTime, SizeofResource, TlsSetValue, CreateFileMappingA, GetFileType, LeaveCriticalSection, GetSystemTime, SetEvent, lstrlenW, GetSystemInfo, LocalReAlloc, lstrlenA, GetCurrentThreadId, GlobalReAlloc, GetShortPathNameA, GetStringTypeA, ResetEvent, GetDateFormatA, CompareStringW, HeapReAlloc, WriteConsoleA, EnterCriticalSection, GetDiskFreeSpaceExW, GlobalAlloc, SetErrorMode, GetLocaleInfoW, GetConsoleMode, FindResourceW, SleepEx, GetLastError, GetProcAddress
shlwapi.dll	SHDeleteKeyA, PathIsUNCA, PathAddBackslashA, PathGetDriveNumberA, PathIsUNCServerA, PathUnquoteSpacesA, PathBuildRootA, PathFileExistsA, PathIsURLA, PathCombineA, PathStripToRootA, PathAppendA, PathFindExtensionA, UrlUnescapeA, PathRemoveExtensionA, PathIsDirectoryA, PathIsRootA, PathRemoveFileSpecA, PathFindFileNameA, PathRemoveBackslashA, PathIsUNCServerShareA, PathStripPathA, PathRenameExtensionA
comctl32.dll	ImageList_Destroy, ImageList_GetIcon, InitializeFlatSB, ImageList_GetBkColor, ImageList_GetImageCount, DestroyPropertySheetPage, ImageList_DragEnter, ImageList_SetDragCursorImage, ImageList_SetImageCount, ImageList_Replace, PropertySheetW, CreateStatusWindowW, ImageList_BeginDrag, InitCommonControlsEx, ImageList_GetImageInfo, ImageList_Remove, ImageList_LoadImageW, ImageList_ReplaceIcon, ImageList_Add, ImageList_EndDrag, ImageList_Draw, ImageList_Create, ImageList_DrawIndirect, ImageList_DragLeave, ImageList_DragMove, CreatePropertySheetPageA, FlatSB_EnableScrollBar, _TrackMouseEvent, ImageList_GetIconSize, ImageList_SetBkColor, ImageList_LoadImageA, ImageList_AddMasked
oleaut32.dll	LoadTypeLib

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 28, 2024 22:25:20.495116949 CEST	60681	53	192.168.2.6	1.1.1.1
Sep 28, 2024 22:26:06.893265963 CEST	53	61583	162.159.36.2	192.168.2.6
Sep 28, 2024 22:26:07.734683037 CEST	53	52312	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 28, 2024 22:25:20.495116949 CEST	192.168.2.6	1.1.1.1	0x2a00	Standard query (0)	tse1.mm.bing.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 28, 2024 22:25:20.502981901 CEST	1.1.1.1	192.168.2.6	0x2a00	No error (0)	tse1.mm.bing.net	mm-mm.bing.net.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 28, 2024 22:25:20.502981901 CEST	1.1.1.1	192.168.2.6	0x2a00	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false
Sep 28, 2024 22:25:20.502981901 CEST	1.1.1.1	192.168.2.6	0x2a00	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false

Target ID:	4
Start time:	16:25:24
Start date:	28/09/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe"
Imagebase:	0x70000
File size:	753'664 bytes
MD5 hash:	B954DC27C4BF7B87DCC365EE9E1C99DB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:25:25
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 488
Imagebase:	0x310000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	16:25:29
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 508
Imagebase:	0x310000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.4%
Total number of Nodes:	612
Total number of Limit Nodes:	1

Executed Functions

Function 0007FE3D Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 29
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,000E68D8,00000010,0007E759,00000000,00000FA0,76230A60,00000000,00071393,00081676,?,000E6F30,00000060), ref: 0007FE60
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionAndSpinCount), ref: 0007FE70

Strings

kernel32.dll, xrefs: 0007FE5B
InitializeCriticalSectionAndSpinCount, xrefs: 0007FE6A
`#v, xrefs: 0007FE60

Memory Dump Source

Source File: 00000004.00000002.2370134059.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000004.00000002.2370114466.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370158930.0000000000087000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370213044.00000000000FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370229436.00000000000FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370243603.00000000000FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370260977.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370275222.000000000010D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370291300.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370307513.0000000000111000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370328321.000000000011A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_70000_SecuriteInfo.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: InitializeCriticalSectionAndSpinCount$`#v$kernel32.dll
API String ID: 1646373207-1060584518
Opcode ID: 4b3ed82881ca11208637f543533899a69845e0ab14a47a323e462dc9dc041c65
Instruction ID: d782d9a057071c4eb6cd8b5d152a04ac8cfd6e29b82e7b9281fbbc898b1e35cf
Opcode Fuzzy Hash: 4b3ed82881ca11208637f543533899a69845e0ab14a47a323e462dc9dc041c65
Instruction Fuzzy Hash: 7CF09070940346AEEB60AFA1EC0DA6936A4BB54740B148124A128A61F2DB3DD640EB18

Function 00075321 Relevance: 3.0, APIs: 2, Instructions: 26
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,00081664,00000001,?,000E6F30,00000060), ref: 00075332

Part of subcall function 00076121: HeapAlloc.KERNEL32(00000000,00000140,0007535A,000003F8,?,000E6F30,00000060), ref: 0007612E

HeapDestroy.KERNEL32(?,000E6F30,00000060), ref: 00075365

Memory Dump Source

Source File: 00000004.00000002.2370134059.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000004.00000002.2370114466.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370158930.0000000000087000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370213044.00000000000FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370229436.00000000000FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370243603.00000000000FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370260977.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370275222.000000000010D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370291300.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370307513.0000000000111000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370328321.000000000011A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_70000_SecuriteInfo.jbxd

Similarity

API ID: Heap$AllocCreateDestroy
String ID:
API String ID: 2236781399-0
Opcode ID: 34687259a38d4ed0ef743a0c118afcf7e96f288a12c0045829a40043a07fad4c
Instruction ID: 5b36d8269d99b3e75e302ca63aeb36f079890a7db702aad4512730628fa7a1e2
Opcode Fuzzy Hash: 34687259a38d4ed0ef743a0c118afcf7e96f288a12c0045829a40043a07fad4c
Instruction Fuzzy Hash: A7E0D830E48B02AAEB106B705D0576939D4FB40783F148539F05AD50F4EBF8C680EB45

Non-executed Functions

Function 0007B0F2 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 90
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(user32.dll,000E60F0,?,?), ref: 0007B10A
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 0007B126
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 0007B137
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 0007B144
GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA), ref: 0007B15A
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 0007B16B

Strings

GetActiveWindow, xrefs: 0007B131
GetUserObjectInformationA, xrefs: 0007B154
user32.dll, xrefs: 0007B105
MessageBoxA, xrefs: 0007B120
GetProcessWindowStation, xrefs: 0007B165
GetLastActivePopup, xrefs: 0007B139

Memory Dump Source

Source File: 00000004.00000002.2370134059.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000004.00000002.2370114466.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370158930.0000000000087000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370213044.00000000000FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370229436.00000000000FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370243603.00000000000FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370260977.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370275222.000000000010D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370291300.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370307513.0000000000111000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370328321.000000000011A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_70000_SecuriteInfo.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$user32.dll
API String ID: 2238633743-1612076079
Opcode ID: cca90460177e211d2bc1d292868e81e174b2465f57a9d3cb9655b4d13e4c9037
Instruction ID: c88212032ca38cb6f312a1e5c18b5c9ed02826f9157c6a9940a96b292e235f7f
Opcode Fuzzy Hash: cca90460177e211d2bc1d292868e81e174b2465f57a9d3cb9655b4d13e4c9037
Instruction Fuzzy Hash: 1F21A531F00385AAEB519F75DC9DB3B3AE8AB14740BC4842DA905D34A0EB7DDA00DB65

Function 00081596 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(?,000E6F30,00000060), ref: 000815B6
GetModuleHandleA.KERNEL32(00000000,?,000E6F30,00000060), ref: 00081609
_fast_error_exit.LIBCMT ref: 0008166B
_fast_error_exit.LIBCMT ref: 0008167C
GetCommandLineA.KERNEL32(?,000E6F30,00000060), ref: 0008169B
GetStartupInfoA.KERNEL32(?), ref: 000816EF
__wincmdln.LIBCMT ref: 000816F5
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00081712

Strings

`#v, xrefs: 00081603

Memory Dump Source

Source File: 00000004.00000002.2370134059.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000004.00000002.2370114466.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370158930.0000000000087000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370213044.00000000000FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370229436.00000000000FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370243603.00000000000FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370260977.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370275222.000000000010D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370291300.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370307513.0000000000111000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370328321.000000000011A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_70000_SecuriteInfo.jbxd

Similarity

API ID: HandleModule_fast_error_exit$CommandInfoLineStartupVersion__wincmdln
String ID: `#v
API String ID: 3897392166-272240289
Opcode ID: 71c8a95b6e56dc900321f0bfebf4d291456cf5f8fe8f5d05a0377e78c4efede6
Instruction ID: 8bbf54397037834bd24f57d9499cf701d4e2d14851b4c70e87fa592d51edf297
Opcode Fuzzy Hash: 71c8a95b6e56dc900321f0bfebf4d291456cf5f8fe8f5d05a0377e78c4efede6
Instruction Fuzzy Hash: 47419170D00711CADB60BB7498096ED77E8BF44710F248829F4D9AB192EA78D993DB94

Function 0007EEE8 Relevance: 10.7, APIs: 7, Instructions: 212
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 0007EEFB

Part of subcall function 0007E881: EnterCriticalSection.KERNEL32(?,?,?,0007553B,00000004,000E5FB8,0000000C,0007E79A,00000000,?,00071478,?,000E6F30,00000060), ref: 0007E8A9

_strcat.LIBCMT ref: 0007EF8A
_strncpy.LIBCMT ref: 0007EFA3

Part of subcall function 00075518: __lock.LIBCMT ref: 00075536
Part of subcall function 00075518: HeapFree.KERNEL32(00000000,?,000E5FB8,0000000C,0007E79A,00000000,?,00071478,?,000E6F30,00000060), ref: 0007557D

GetTimeZoneInformation.KERNEL32(000FE67C,000E71C8,00000018,0007F1BE,000E71D8,00000008,0007D0D2), ref: 0007F00C
WideCharToMultiByte.KERNEL32(00000000,00000000,000FE680,000000FF,0000003F,00000000,?), ref: 0007F09A
WideCharToMultiByte.KERNEL32(00000000,00000000,000FE6D4,000000FF,0000003F,00000000,?), ref: 0007F0CE

Memory Dump Source

Source File: 00000004.00000002.2370134059.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000004.00000002.2370114466.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370158930.0000000000087000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370213044.00000000000FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370229436.00000000000FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370243603.00000000000FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370260977.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370275222.000000000010D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370291300.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370307513.0000000000111000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370328321.000000000011A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_70000_SecuriteInfo.jbxd

Similarity

API ID: ByteCharMultiWide__lock$CriticalEnterFreeHeapInformationSectionTimeZone_strcat_strncpy
String ID:
API String ID: 2250874180-0
Opcode ID: 31f2e7fe82b2b5de968947733bce968ddcf87a0f04a2a158cd7e86d09a6e6f73
Instruction ID: e496289ba807e71a44b58fb6805895ce799a5f1a76fddcd37659c67ca3226071
Opcode Fuzzy Hash: 31f2e7fe82b2b5de968947733bce968ddcf87a0f04a2a158cd7e86d09a6e6f73
Instruction Fuzzy Hash: E0713B30D04282AEE765AB28EC01BB5BBE5E715350F74C16AE698C76B2D73C4881CB59

Function 00071762 Relevance: 7.6, APIs: 5, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0007177C
GetSystemInfo.KERNEL32(?,?,?,0000001C), ref: 0007178D
VirtualQuery.KERNEL32(?,?,0000001C,?,?,0000001C), ref: 000717D3
VirtualAlloc.KERNEL32(?,?,00001000,00000004,?,?,0000001C), ref: 00071811
VirtualProtect.KERNEL32(?,?,00000002,?,?,?,0000001C), ref: 00071837

Memory Dump Source

Source File: 00000004.00000002.2370134059.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000004.00000002.2370114466.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370158930.0000000000087000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370213044.00000000000FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370229436.00000000000FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370243603.00000000000FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370260977.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370275222.000000000010D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370291300.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370307513.0000000000111000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370328321.000000000011A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_70000_SecuriteInfo.jbxd

Similarity

API ID: Virtual$Query$AllocInfoProtectSystem
String ID:
API String ID: 4136887677-0
Opcode ID: 2856887ff5deca205fded5e99ac677954652cbd90bbdbba7b3a39feac4c4d4bf
Instruction ID: 01f415028a6571e9ca7bee99c0b100c897064b0f6e7aa4a5b24e673167875668
Opcode Fuzzy Hash: 2856887ff5deca205fded5e99ac677954652cbd90bbdbba7b3a39feac4c4d4bf
Instruction Fuzzy Hash: 7231C332D04219EBDF20CFA8DC89AEDBBB8EB04710F148165E945E7190DB38DE41DB94

Function 0007DBB1 Relevance: 3.1, APIs: 2, Instructions: 122libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,00081433), ref: 0007DB67
GetProcAddress.KERNEL32(00000000,?), ref: 0007DB71

Memory Dump Source

Source File: 00000004.00000002.2370134059.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000004.00000002.2370114466.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370158930.0000000000087000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370213044.00000000000FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370229436.00000000000FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370243603.00000000000FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370260977.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370275222.000000000010D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370291300.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370307513.0000000000111000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370328321.000000000011A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_70000_SecuriteInfo.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: 5a09dc29ed97c0e7633c318b25a77ee8724ef662057f26c237208de7d9c665bd
Instruction ID: 978d73893e7dbcf4134efac010f1ce3b3209805db6728794b7c98efe536b3329
Opcode Fuzzy Hash: 5a09dc29ed97c0e7633c318b25a77ee8724ef662057f26c237208de7d9c665bd
Instruction Fuzzy Hash: F0514A75A04280CFE718CF28EC845697BF2FF88314F15852AE84997B61C738A941EF81

Function 0007846D Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00001004,?,00000006), ref: 0007848D

Memory Dump Source

Source File: 00000004.00000002.2370134059.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000004.00000002.2370114466.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370158930.0000000000087000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370213044.00000000000FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370229436.00000000000FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370243603.00000000000FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370260977.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370275222.000000000010D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370291300.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370307513.0000000000111000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370328321.000000000011A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_70000_SecuriteInfo.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 4d79bc3eef71ff87657c19f124961f2ab59df5a26c7a62242eec04ebbe550a44
Instruction ID: 84c67808acccf9e334bc7704cbc94afae5e6f9611d6c422ebbad34bf35274451
Opcode Fuzzy Hash: 4d79bc3eef71ff87657c19f124961f2ab59df5a26c7a62242eec04ebbe550a44
Instruction Fuzzy Hash: FEE09230E48208BBDB11DBA4DD05BDD7BB86F04324F10C2A5F61CDA1C1EBB4DA008759

Function 00083774 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2370134059.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000004.00000002.2370114466.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370158930.0000000000087000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370213044.00000000000FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370229436.00000000000FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370243603.00000000000FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370260977.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370275222.000000000010D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370291300.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370307513.0000000000111000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370328321.000000000011A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_70000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f53be4966a4236c17d9a3db5d526e57aa0c53ebd156c4e495a1da7b2482d113
Instruction ID: 50d0c315cea60367cffb02529d54229110dac260836ed06b7823d6a4c06069fa
Opcode Fuzzy Hash: 1f53be4966a4236c17d9a3db5d526e57aa0c53ebd156c4e495a1da7b2482d113
Instruction Fuzzy Hash: 1F218672900204DBCB14EF68C8819ABBBA9FF85750B45C568E9599B246DB30FA15C7E0

Function 000843C6 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2370134059.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000004.00000002.2370114466.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370158930.0000000000087000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370213044.00000000000FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370229436.00000000000FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370243603.00000000000FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370260977.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370275222.000000000010D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370291300.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370307513.0000000000111000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370328321.000000000011A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_70000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a2926ecaae9c02c98bff142c9d937081e804562fe089b5cd7e9810069b52322
Instruction ID: c52125e899334c5666b6e0a49c2d79cfe527d02f11d9590fce1b09a906654fea
Opcode Fuzzy Hash: 9a2926ecaae9c02c98bff142c9d937081e804562fe089b5cd7e9810069b52322
Instruction Fuzzy Hash: FE210835A042818FE718CF29EC846697BE2FFCC310F16812ED849D7B65D678A845EB81

Function 00075E71 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2370134059.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000004.00000002.2370114466.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370158930.0000000000087000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370213044.00000000000FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370229436.00000000000FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370243603.00000000000FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370260977.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370275222.000000000010D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370291300.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370307513.0000000000111000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370328321.000000000011A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_70000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3abceb86a2e80372f29956a0c928d5b83b0ea29cd75e5213236b8f7da63a9200
Instruction ID: 2c7375f913755082feaf4badc1d172a0187ffd7b3494f5469dab8b9e24c2b717
Opcode Fuzzy Hash: 3abceb86a2e80372f29956a0c928d5b83b0ea29cd75e5213236b8f7da63a9200
Instruction Fuzzy Hash: 9BF0657540D6958FDB299F604CD09C93B76AF02245B1AD4DAD44A0E0A3D26C4A09DB25

Function 0007138E Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 71
libraryloaderthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,76230A60,00000000,00081676,?,000E6F30,00000060), ref: 000713A6
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 000713BE
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 000713CB
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 000713D8
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 000713E5
GetCurrentThreadId.KERNEL32 ref: 00071463

Part of subcall function 000711B9: DeleteCriticalSection.KERNEL32(00000000,00000000,00000000,?,00071478,?,000E6F30,00000060), ref: 0007E792
Part of subcall function 000711B9: DeleteCriticalSection.KERNEL32(00000004,00000000,?,00071478,?,000E6F30,00000060), ref: 0007E7BC

Strings

kernel32.dll, xrefs: 000713A1
`#v, xrefs: 000713A6
FlsFree, xrefs: 000713DA
FlsSetValue, xrefs: 000713CD
FlsGetValue, xrefs: 000713C0
FlsAlloc, xrefs: 000713B8

Memory Dump Source

Source File: 00000004.00000002.2370134059.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000004.00000002.2370114466.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370158930.0000000000087000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370213044.00000000000FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370229436.00000000000FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370243603.00000000000FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370260977.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370275222.000000000010D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370291300.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370307513.0000000000111000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370328321.000000000011A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_70000_SecuriteInfo.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentHandleModuleThread
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$`#v$kernel32.dll
API String ID: 3190854022-141970118
Opcode ID: 1f5372fa5e9db1368ad8d5ad4ac25a154221d6eeb19ddbe9a8f1454b6720ca39
Instruction ID: 3a94f6cb5fc312d2153e906696a036f80cab37c43dd7210600ae769d420e1356
Opcode Fuzzy Hash: 1f5372fa5e9db1368ad8d5ad4ac25a154221d6eeb19ddbe9a8f1454b6720ca39
Instruction Fuzzy Hash: B92192B1E093889AE7605F3AFC09D663FE4FB617903108529E068DB6F0DBBC8441DB55

Function 0008335D Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 185
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,000E62A8,00000118,00077CF4,00000001,00000000,000E60B0,00000008,0007116C,00000000,00000000,00000000), ref: 000833DE
_strcat.LIBCMT ref: 000833F4
_strncpy.LIBCMT ref: 0008342F
_strcat.LIBCMT ref: 00083454

Part of subcall function 0007C146: LCMapStringW.KERNEL32(00000000,00000100,000E6304,00000001,00000000,00000000,000E62E0,00000038,00083519,?,00000200,?,000000FF,00000000,00000000,?), ref: 0007C16D
Part of subcall function 0007C146: MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,000E62E0,00000038,00083519,?,00000200,?,000000FF,00000000,00000000,?), ref: 0007C206
Part of subcall function 0007C146: MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 0007C287
Part of subcall function 0007C146: LCMapStringW.KERNEL32(?,?,?,00000000,00000000,00000000), ref: 0007C2A1

_strcat.LIBCMT ref: 0008359A

Strings

<program name unknown>, xrefs: 000833E8
Unknown security failure detected!, xrefs: 000833A4
..., xrefs: 00083429
Buffer overrun detected!, xrefs: 000833BA, 00083452
Microsoft Visual C++ Runtime Library, xrefs: 0008348F
Program: , xrefs: 00083465

Memory Dump Source

Source File: 00000004.00000002.2370134059.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000004.00000002.2370114466.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370158930.0000000000087000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370213044.00000000000FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370229436.00000000000FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370243603.00000000000FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370260977.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370275222.000000000010D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370291300.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370307513.0000000000111000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370328321.000000000011A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_70000_SecuriteInfo.jbxd

Similarity

API ID: _strcat$ByteCharMultiStringWide$FileModuleName_strncpy
String ID: ...$<program name unknown>$Buffer overrun detected!$Microsoft Visual C++ Runtime Library$Program: $Unknown security failure detected!
API String ID: 4156849676-1673886896
Opcode ID: 8a53c9e70790236d31418f81687c83a93519c52cc3dd9654f7ebd0fd826e70e3
Instruction ID: 3ab841e9040fcddd2c568aa7726aad9a1ebf354e9906d9173f9b329a72cd75a6
Opcode Fuzzy Hash: 8a53c9e70790236d31418f81687c83a93519c52cc3dd9654f7ebd0fd826e70e3
Instruction Fuzzy Hash: C7511472D00654AFEF21BB64DC42EDE7BA4BF44720F104119F598AB283DB39DB808B95

Function 00071000 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 115
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,00000000,00000000), ref: 00071081
_strcat.LIBCMT ref: 00071094
_strncpy.LIBCMT ref: 000710C7
_strcat.LIBCMT ref: 000710FB
GetStdHandle.KERNEL32(000000F4,000E6E90,00000000,?,00000000,00000000,00000000,00000000), ref: 0007114E
WriteFile.KERNEL32(00000000), ref: 00071155

Strings

<program name unknown>, xrefs: 0007108E
..., xrefs: 000710C1
Runtime Error!Program: , xrefs: 000710F5
Microsoft Visual C++ Runtime Library, xrefs: 00071123

Memory Dump Source

Source File: 00000004.00000002.2370134059.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000004.00000002.2370114466.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370158930.0000000000087000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370213044.00000000000FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370229436.00000000000FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370243603.00000000000FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370260977.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370275222.000000000010D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370291300.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370307513.0000000000111000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370328321.000000000011A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_70000_SecuriteInfo.jbxd

Similarity

API ID: File_strcat$HandleModuleNameWrite_strncpy
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3279267778-4022980321
Opcode ID: 80dc1867ad5093a59418e513bfd95792dfa371f64e49c063eb47e4729de1c418
Instruction ID: 8d49498bab3fb0a7961220dc5e6361e8e96d535e37ca46b9ba746c24936b978c
Opcode Fuzzy Hash: 80dc1867ad5093a59418e513bfd95792dfa371f64e49c063eb47e4729de1c418
Instruction Fuzzy Hash: 32314832D002049AEB35BB78DC86EEE37A9FB44320F10841AF599D6193DE79D6848B58

Function 0007C146 Relevance: 16.8, APIs: 11, Instructions: 299
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringW.KERNEL32(00000000,00000100,000E6304,00000001,00000000,00000000,000E62E0,00000038,00083519,?,00000200,?,000000FF,00000000,00000000,?), ref: 0007C16D
GetLastError.KERNEL32 ref: 0007C17F
MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,000E62E0,00000038,00083519,?,00000200,?,000000FF,00000000,00000000,?), ref: 0007C206
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 0007C287
LCMapStringW.KERNEL32(?,?,?,00000000,00000000,00000000), ref: 0007C2A1
LCMapStringW.KERNEL32(?,?,?,00000000,?,?), ref: 0007C2DC

Memory Dump Source

Source File: 00000004.00000002.2370134059.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000004.00000002.2370114466.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370158930.0000000000087000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370213044.00000000000FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370229436.00000000000FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370243603.00000000000FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370260977.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370275222.000000000010D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370291300.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370307513.0000000000111000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370328321.000000000011A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_70000_SecuriteInfo.jbxd

Similarity

API ID: String$ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1775797328-0
Opcode ID: 8603bc0e30da4305954f2cea76467bbe1c2de02f516117f8596a9c692dcf7c89
Instruction ID: b44d512eccecb0530d72566499c7bcef852470267376e0f454b8d88644f3fc05
Opcode Fuzzy Hash: 8603bc0e30da4305954f2cea76467bbe1c2de02f516117f8596a9c692dcf7c89
Instruction Fuzzy Hash: E2B15AB2C00259EFEF219FA4DC84CEE7BB5FB09324F10C129F919A2161D7398A51DB94

Function 000719C2 Relevance: 13.8, APIs: 9, Instructions: 291
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CompareStringW.KERNEL32(00000000,00000000,000E6304,00000001,000E6304,00000001,000E62B8,00000040,00071E95,?,00000001,?,00000000,?,00000000,?), ref: 000719EE
GetLastError.KERNEL32 ref: 00071A00
GetCPInfo.KERNEL32(?,?,000E62B8,00000040,00071E95,?,00000001,?,00000000,?,00000000,?), ref: 00071AAA
MultiByteToWideChar.KERNEL32(?,00000009,00000000,?,00000000,00000000), ref: 00071B38
MultiByteToWideChar.KERNEL32(?,00000001,00000000,?,?,00000000), ref: 00071BB1
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00071BCE
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 00071C44

Memory Dump Source

Source File: 00000004.00000002.2370134059.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000004.00000002.2370114466.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370158930.0000000000087000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370213044.00000000000FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370229436.00000000000FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370243603.00000000000FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370260977.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370275222.000000000010D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370291300.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370307513.0000000000111000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370328321.000000000011A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_70000_SecuriteInfo.jbxd

Similarity

API ID: ByteCharMultiWide$CompareErrorInfoLastString
String ID:
API String ID: 1773772771-0
Opcode ID: 0680862f06ad5474ccec719b2306111544f0f38fa7a60acad3dd86607165e537
Instruction ID: 4fab2d320805a582a17dd44c2d8c8e477f3a6161257fcf21ea6f0b946e671e3c
Opcode Fuzzy Hash: 0680862f06ad5474ccec719b2306111544f0f38fa7a60acad3dd86607165e537
Instruction Fuzzy Hash: 97B1BD71D01249AFDF22CFA8DC85AEE7BF5AF44350F208019F818A61E1D7398950CB9A

Function 000801C2 Relevance: 12.1, APIs: 8, Instructions: 131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNEL32(76230A60,00000000,?,?,?,?,000816AB,?,000E6F30,00000060), ref: 000801DE
GetLastError.KERNEL32(?,?,?,?,000816AB,?,000E6F30,00000060), ref: 000801F2
GetEnvironmentStringsW.KERNEL32(76230A60,00000000,?,?,?,?,000816AB,?,000E6F30,00000060), ref: 00080214
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,76230A60,00000000,?,?,?,?,000816AB), ref: 00080248
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,000816AB,?,000E6F30,00000060), ref: 0008026A
FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,000816AB,?,000E6F30,00000060), ref: 00080283
GetEnvironmentStrings.KERNEL32(76230A60,00000000,?,?,?,?,000816AB,?,000E6F30,00000060), ref: 00080299
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 000802D5

Memory Dump Source

Source File: 00000004.00000002.2370134059.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000004.00000002.2370114466.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370158930.0000000000087000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370213044.00000000000FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370229436.00000000000FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370243603.00000000000FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370260977.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370275222.000000000010D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370291300.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370307513.0000000000111000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370328321.000000000011A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_70000_SecuriteInfo.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide$ErrorLast
String ID:
API String ID: 883850110-0
Opcode ID: 99bd50f0d75e14a4fea7dea42c201e706e054c2da21295a1bdc41d897c7b8844
Instruction ID: 517ed5a843f8f0b8946537d70f9a9e246a0324104aad4bc08032a9bc83d06e4a
Opcode Fuzzy Hash: 99bd50f0d75e14a4fea7dea42c201e706e054c2da21295a1bdc41d897c7b8844
Instruction Fuzzy Hash: C231E5B25092196FEBF07F78AC8C83ABBDCFB453547250A29F5C5C3111E6A49C488BA1

Function 000784B0 Relevance: 10.7, APIs: 7, Instructions: 169
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(?,?,000E6A98,00000038,0007EC9B,?,00000000,?,?,00000000,00000000,000E6308,0000001C,000855B6,00000001,?), ref: 000784EE
GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,000784A5,?), ref: 00078501
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,000784A5), ref: 00078546

Memory Dump Source

Source File: 00000004.00000002.2370134059.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000004.00000002.2370114466.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370158930.0000000000087000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370213044.00000000000FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370229436.00000000000FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370243603.00000000000FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370260977.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370275222.000000000010D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370291300.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370307513.0000000000111000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370328321.000000000011A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_70000_SecuriteInfo.jbxd

Similarity

API ID: Info$ByteCharMultiWide
String ID:
API String ID: 1166650589-0
Opcode ID: 0a6b25738dc5eb4b4fc07bd5ad752d3a7a3074f3a279183a3631d338b000e46c
Instruction ID: 448b6ec37a9e7244a7e66ab4c37fd1704f25a9d7bbec3f8ebb2c3ec2618641c4
Opcode Fuzzy Hash: 0a6b25738dc5eb4b4fc07bd5ad752d3a7a3074f3a279183a3631d338b000e46c
Instruction Fuzzy Hash: 67516871D40608BBCF619F95EC88DAEBBB9FF84760F24C51AF418A2190EB748950CB64

Function 0007159B Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 13
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(mscoree.dll,00071709,?,000E6B08,00000008,00071740,?,00000001,00000000,000834A4,00000003), ref: 000715A0
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 000715B0
ExitProcess.KERNEL32 ref: 000715C4

Strings

mscoree.dll, xrefs: 0007159B
`#v, xrefs: 000715A0
CorExitProcess, xrefs: 000715AA

Memory Dump Source

Source File: 00000004.00000002.2370134059.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000004.00000002.2370114466.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370158930.0000000000087000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370213044.00000000000FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370229436.00000000000FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370243603.00000000000FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370260977.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370275222.000000000010D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370291300.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370307513.0000000000111000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370328321.000000000011A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_70000_SecuriteInfo.jbxd

Similarity

API ID: AddressExitHandleModuleProcProcess
String ID: CorExitProcess$`#v$mscoree.dll
API String ID: 75539706-966225676
Opcode ID: 06a6733590d9ca14e7de26208a70d5675b718ff03c8a336ce09fe08186e7978f
Instruction ID: 2e771a567c905a057f2fe5951358b42583f698ff588ac9738087ec0d3765034e
Opcode Fuzzy Hash: 06a6733590d9ca14e7de26208a70d5675b718ff03c8a336ce09fe08186e7978f
Instruction Fuzzy Hash: 4BD0C730648702FFE7002F669C4DE1B3AD8BF50B817148424B45AE10A4DF7AD950DB2A

Function 00080667 Relevance: 9.2, APIs: 6, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStringTypeW.KERNEL32(00000001,000E6304,00000001,?,000E6AB8,00000024), ref: 0008068B
GetLastError.KERNEL32 ref: 0008069D
GetStringTypeW.KERNEL32(?,?,?,?,000E6AB8,00000024), ref: 000806C7
WideCharToMultiByte.KERNEL32(?,00000000,?,?,00000000,00000000,00000000,00000000,000E6AB8,00000024), ref: 0008071F
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 000807A2
GetStringTypeA.KERNEL32(?,?,?,00000000,?), ref: 00080834

Part of subcall function 000793D2: __lock.LIBCMT ref: 00079416
Part of subcall function 000793D2: HeapAlloc.KERNEL32(00000008,?,000E5FA8,00000010,000711FE,00000001,0000008C,?,0007553B,00000004,000E5FB8,0000000C,0007E79A,00000000,?,00071478), ref: 00079454

Memory Dump Source

Source File: 00000004.00000002.2370134059.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000004.00000002.2370114466.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370158930.0000000000087000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370213044.00000000000FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370229436.00000000000FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370243603.00000000000FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370260977.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370275222.000000000010D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370291300.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370307513.0000000000111000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370328321.000000000011A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_70000_SecuriteInfo.jbxd

Similarity

API ID: StringType$ByteCharMultiWide$AllocErrorHeapLast__lock
String ID:
API String ID: 892864237-0
Opcode ID: c1cd5ede65a09846e62903b26f85f7f8408358f6ae352db53c0ee6afef16ea58
Instruction ID: 2032d777c852418add6debd72989f29bbd8b9c9baa9d40fb2c865536fe4bb1a0
Opcode Fuzzy Hash: c1cd5ede65a09846e62903b26f85f7f8408358f6ae352db53c0ee6afef16ea58
Instruction Fuzzy Hash: 16518F71C00219EFDFA1AFA4DC499EE7BB4FF09760B208119F894A2161D7348AA5DFD0

Function 0007EB18 Relevance: 9.1, APIs: 6, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,000E6304,00000001,?,000E6308,0000001C,000855B6,00000001,?,00000001,?,?,?,00000001,?,?), ref: 0007EB3C
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,000784A5,?), ref: 0007EB4E
MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,000E6308,0000001C,000855B6,00000001,?,00000001,?,?,?,00000001), ref: 0007EBB0
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 0007EC2E
GetStringTypeW.KERNEL32(?,?,00000000,?), ref: 0007EC40

Memory Dump Source

Source File: 00000004.00000002.2370134059.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000004.00000002.2370114466.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370158930.0000000000087000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370213044.00000000000FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370229436.00000000000FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370243603.00000000000FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370260977.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370275222.000000000010D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370291300.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370307513.0000000000111000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370328321.000000000011A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_70000_SecuriteInfo.jbxd

Similarity

API ID: ByteCharMultiStringTypeWide$ErrorLast
String ID:
API String ID: 3581945363-0
Opcode ID: 01848215c3a20cc4c2cc5515498e83bfd4cc9d2d1523d4b00058399fd2ca35e4
Instruction ID: 80f7cb2f6730666f4dd8036b3b656916c0f6fcfc269398787934c73b47670dff
Opcode Fuzzy Hash: 01848215c3a20cc4c2cc5515498e83bfd4cc9d2d1523d4b00058399fd2ca35e4
Instruction Fuzzy Hash: 1941C175C01655EBDF228F64DC49AEE3FA5FF08B60F248144F908A61A1C739C951DBA8

Function 00077A47 Relevance: 7.7, APIs: 5, Instructions: 184COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,?,?,?,?,?,000837B5,?), ref: 00077AFA
InterlockedExchange.KERNEL32(000FE2F4,00000001), ref: 00077B78
InterlockedExchange.KERNEL32(000FE2F4,00000000), ref: 00077BDD
InterlockedExchange.KERNEL32(000FE2F4,00000001), ref: 00077C01
InterlockedExchange.KERNEL32(000FE2F4,00000000), ref: 00077C61

Memory Dump Source

Source File: 00000004.00000002.2370134059.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000004.00000002.2370114466.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370158930.0000000000087000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370213044.00000000000FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370229436.00000000000FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370243603.00000000000FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370260977.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370275222.000000000010D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370291300.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370307513.0000000000111000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370328321.000000000011A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_70000_SecuriteInfo.jbxd

Similarity

API ID: ExchangeInterlocked$QueryVirtual
String ID:
API String ID: 2947987494-0
Opcode ID: 2f59f4c627ad6f74709f7efb077c3d8c34e41711166af645bdaa2cf3bddd6a50
Instruction ID: a71bf7a562c56f3a235464864ff39cbe8645095d194f2608e6e35437ebe6332b
Opcode Fuzzy Hash: 2f59f4c627ad6f74709f7efb077c3d8c34e41711166af645bdaa2cf3bddd6a50
Instruction Fuzzy Hash: 4151F430F086459FEBA68F28C8C477C73E5AB89790F24C129D85D872A1E378DD81C74A

Function 0007F313 Relevance: 7.7, APIs: 5, Instructions: 172COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 0007F370
GetFileType.KERNEL32(?), ref: 0007F41A
GetStdHandle.KERNEL32(-000000F6), ref: 0007F49B

Memory Dump Source

Source File: 00000004.00000002.2370134059.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000004.00000002.2370114466.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370158930.0000000000087000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370213044.00000000000FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370229436.00000000000FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370243603.00000000000FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370260977.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370275222.000000000010D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370291300.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370307513.0000000000111000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370328321.000000000011A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_70000_SecuriteInfo.jbxd

Similarity

API ID: FileHandleInfoStartupType
String ID:
API String ID: 2461013171-0
Opcode ID: 5e497053f563c57ff14c9d2d7af8582d78700e1b81314d738683e7db058cc79f
Instruction ID: b04c22d3e43f50b89564a9630b21cef8b508d341d1b7098d934377a242849feb
Opcode Fuzzy Hash: 5e497053f563c57ff14c9d2d7af8582d78700e1b81314d738683e7db058cc79f
Instruction Fuzzy Hash: 6E519F719087438FD764CB28C884A7677E4BB05324F28CA39E5AEC71E2DB78D449DB19

Function 0007789A Relevance: 7.6, APIs: 5, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2370134059.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000004.00000002.2370114466.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370158930.0000000000087000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370213044.00000000000FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370229436.00000000000FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370243603.00000000000FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370260977.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370275222.000000000010D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370291300.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370307513.0000000000111000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370328321.000000000011A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_70000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cda5b39ad5a41ca12c7350cb144cdcb40ed0bf20cd431a1f4231d0bb4d27c884
Instruction ID: 8f1758ac30ae5ceaad50b3984df04cd7d459d4607001cb68ae7962231c3f712c
Opcode Fuzzy Hash: cda5b39ad5a41ca12c7350cb144cdcb40ed0bf20cd431a1f4231d0bb4d27c884
Instruction Fuzzy Hash: 5B416771D06162ABDF607F64CC888AF7AA4FB403A0710C639F91DA6192E73C4D41CBDA

Function 0007C132 Relevance: 7.6, APIs: 5, Instructions: 133COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,000E6304,00000001,00000000,00000000,000E62E0,00000038,00083519,?,00000200,?,000000FF,00000000,00000000,?), ref: 0007C16D
MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,000E62E0,00000038,00083519,?,00000200,?,000000FF,00000000,00000000,?), ref: 0007C206
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 0007C287
LCMapStringW.KERNEL32(?,?,?,00000000,00000000,00000000), ref: 0007C2A1

Memory Dump Source

Source File: 00000004.00000002.2370134059.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000004.00000002.2370114466.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370158930.0000000000087000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370213044.00000000000FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370229436.00000000000FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370243603.00000000000FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370260977.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370275222.000000000010D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370291300.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370307513.0000000000111000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370328321.000000000011A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_70000_SecuriteInfo.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 279061e1eaa192b514e1f9d143510237e77893c6c808ebddcc9267417c177dfc
Instruction ID: 8cb14dd4cab344e7cb36ea6ba9b7823b08d8bc6eb8fd97f9649216f1b0a1692f
Opcode Fuzzy Hash: 279061e1eaa192b514e1f9d143510237e77893c6c808ebddcc9267417c177dfc
Instruction Fuzzy Hash: 484168B1C00249EFEF218FA4DC849EE7FB5FB09314F10C129F919A21A1C7798A51DB94

Function 0008370E Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00083EB0: GetCurrentThreadId.KERNEL32 ref: 00083ECA

GetCurrentProcessId.KERNEL32 ref: 00082F82

Strings

1ce0383e, xrefs: 0008372E
1ce0383e ) -600116419 ) 30fc6189, xrefs: 00082F75
%x ) %d ) %08x, xrefs: 00082F70

Memory Dump Source

Source File: 00000004.00000002.2370134059.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000004.00000002.2370114466.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370158930.0000000000087000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370213044.00000000000FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370229436.00000000000FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370243603.00000000000FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370260977.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370275222.000000000010D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370291300.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370307513.0000000000111000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370328321.000000000011A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_70000_SecuriteInfo.jbxd

Similarity

API ID: Current$ProcessThread
String ID: %x ) %d ) %08x$1ce0383e$1ce0383e ) -600116419 ) 30fc6189
API String ID: 2063062207-3315764354
Opcode ID: 42e0cad06661989af4018a1bfe30eafe5c597bb6fc32b63a72eac73c87c8e486
Instruction ID: 7cf9ded32cd1a9377fe2cac0b0aa3a2e8d767f8cc673d16a9e840997aa49f8b8
Opcode Fuzzy Hash: 42e0cad06661989af4018a1bfe30eafe5c597bb6fc32b63a72eac73c87c8e486
Instruction Fuzzy Hash: 0A0182B1C043446FE711BBA4DD0AA6E3A70EB10700F140434F94526663F7BA5529D797

Function 000797BF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00079BB0), ref: 000797C9
LoadLibraryA.KERNEL32(?), ref: 000797DB
LoadLibraryA.KERNEL32 ref: 000797FC

Strings

`#v, xrefs: 000797C9

Memory Dump Source

Source File: 00000004.00000002.2370134059.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000004.00000002.2370114466.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370158930.0000000000087000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370213044.00000000000FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370229436.00000000000FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370243603.00000000000FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370260977.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370275222.000000000010D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370291300.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370307513.0000000000111000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370328321.000000000011A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_70000_SecuriteInfo.jbxd

Similarity

API ID: LibraryLoad$HandleModule
String ID: `#v
API String ID: 2593893887-272240289
Opcode ID: 900c21839467a17b24c72a6253bf84a6febb72ccd99c368752dcfb63c4043e21
Instruction ID: 5eae93d5017cc9d2cc5799f91aa78d5c014378b1d87df17126cc82a6c633d41a
Opcode Fuzzy Hash: 900c21839467a17b24c72a6253bf84a6febb72ccd99c368752dcfb63c4043e21
Instruction Fuzzy Hash: 8CE0C935905381EFEB51AF70EC489697FB1FB44301F108925E44992A35DB3D9060EB02

Function 0007DDCC Relevance: 6.2, APIs: 4, Instructions: 167fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,00000000,?,00000000), ref: 0007DE46
GetLastError.KERNEL32 ref: 0007DE50
ReadFile.KERNEL32(?,?,00000001,?,00000000), ref: 0007DF19
GetLastError.KERNEL32 ref: 0007DF23

Memory Dump Source

Source File: 00000004.00000002.2370134059.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000004.00000002.2370114466.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370158930.0000000000087000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370213044.00000000000FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370229436.00000000000FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370243603.00000000000FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370260977.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370275222.000000000010D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370291300.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370307513.0000000000111000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370328321.000000000011A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_70000_SecuriteInfo.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 6a6a2fb55ba79ac9f95cae2bf3e7b8478b69c41f983fbfea8b39e0b56cefc34d
Instruction ID: 7288ec63e648d031b3ff35f39ac93c252d92b6168c36e1d9cc01dda9b0d3c120
Opcode Fuzzy Hash: 6a6a2fb55ba79ac9f95cae2bf3e7b8478b69c41f983fbfea8b39e0b56cefc34d
Instruction Fuzzy Hash: CB61C670E043859FDB21CF58C884BAD7BF0AF12314F54C0ABE86A9B296C778D951CB59

Function 00080979 Relevance: 6.1, APIs: 4, Instructions: 145fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,?,0010CDF0,00000001), ref: 00080A61

Memory Dump Source

Source File: 00000004.00000002.2370134059.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000004.00000002.2370114466.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370158930.0000000000087000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370213044.00000000000FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370229436.00000000000FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370243603.00000000000FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370260977.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370275222.000000000010D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370291300.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370307513.0000000000111000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370328321.000000000011A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_70000_SecuriteInfo.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: bcbe1d5fcf13e541f2079d18d8934fd03805ee11229da594ed68ec7de2e9f6f0
Instruction ID: 65b6463833d531aac3e6a29a7d1ef7205d7f9c2aaff0dafc39a66db6fde63401
Opcode Fuzzy Hash: bcbe1d5fcf13e541f2079d18d8934fd03805ee11229da594ed68ec7de2e9f6f0
Instruction Fuzzy Hash: 8A514A31A04248CFDB76EFA9CC85AEDBBF8BF45304F244119E8999B256D7709A05CF12

Function 00071B6E Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

Part of subcall function 00071762: VirtualQuery.KERNEL32(?,?,0000001C), ref: 0007177C
Part of subcall function 00071762: GetSystemInfo.KERNEL32(?,?,?,0000001C), ref: 0007178D
Part of subcall function 00071762: VirtualQuery.KERNEL32(?,?,0000001C,?,?,0000001C), ref: 000717D3

MultiByteToWideChar.KERNEL32(?,00000001,00000000,?,?,00000000), ref: 00071BB1
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00071BCE
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 00071C44
CompareStringW.KERNEL32(?,?,?,00000000,?,00000000,?,00000000), ref: 00071C5A

Memory Dump Source

Source File: 00000004.00000002.2370134059.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000004.00000002.2370114466.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370158930.0000000000087000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370213044.00000000000FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370229436.00000000000FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370243603.00000000000FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370260977.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370275222.000000000010D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370291300.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370307513.0000000000111000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370328321.000000000011A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_70000_SecuriteInfo.jbxd

Similarity

API ID: ByteCharMultiWide$QueryVirtual$CompareInfoStringSystem
String ID:
API String ID: 1997773198-0
Opcode ID: bbbdf4217883f493cddcf87dc7557e15c91346feef404cef4b0e7b85976355d9
Instruction ID: d6b80e24fb170c6fc479f6d2c6ccdd3e7a81895bb66f339d4fcb051cfa5dc982
Opcode Fuzzy Hash: bbbdf4217883f493cddcf87dc7557e15c91346feef404cef4b0e7b85976355d9
Instruction Fuzzy Hash: 2A315731C41608ABDF229FA8DD49BDEBFB6BF44750F208104F828A61E1CB789951DB94

Function 0007F8EC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 0007F908

Strings

, xrefs: 0007F956
, xrefs: 0007F92F

Memory Dump Source

Source File: 00000004.00000002.2370134059.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000004.00000002.2370114466.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370158930.0000000000087000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370213044.00000000000FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370229436.00000000000FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370243603.00000000000FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370260977.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370275222.000000000010D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370291300.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370307513.0000000000111000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370328321.000000000011A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_70000_SecuriteInfo.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: 312a6cc7d374cb0af64f80c8b83cb5c083d62539e7bcd4432ee83953350b2ef1
Instruction ID: 74be24d51cb822bd444cb36515ca18854361710f1b1bbbdef310d16b6df34bcf
Opcode Fuzzy Hash: 312a6cc7d374cb0af64f80c8b83cb5c083d62539e7bcd4432ee83953350b2ef1
Instruction Fuzzy Hash: 3F41487090028E7EEB258758DC59FFA7FE8AB05704F28C4F0D64DCB153C1684A85DB9A

Function 0007A0AA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

___initmbctable.LIBCMT ref: 0007A0BC
GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\Internet Explorer\iexplore.exe,00000104,76230A60,00000000,?,?,?,?,000816B5,?,000E6F30,00000060), ref: 0007A0D4

Strings

C:\Program Files (x86)\Internet Explorer\iexplore.exe, xrefs: 0007A0C6, 0007A0CB

Memory Dump Source

Source File: 00000004.00000002.2370134059.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000004.00000002.2370114466.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370158930.0000000000087000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370213044.00000000000FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370229436.00000000000FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370243603.00000000000FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370260977.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370275222.000000000010D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370291300.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370307513.0000000000111000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370328321.000000000011A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_70000_SecuriteInfo.jbxd

Similarity

API ID: FileModuleName___initmbctable
String ID: C:\Program Files (x86)\Internet Explorer\iexplore.exe
API String ID: 767393020-908218840
Opcode ID: 53ca78f9c7cf0eceb9151c977e06f58b4aa88aea31a3c1b8ba8d8cab091a9c60
Instruction ID: ec197f2e778c7317529da3e20e555ca5af74fcf3394cc1999d6a3d8adb97d826
Opcode Fuzzy Hash: 53ca78f9c7cf0eceb9151c977e06f58b4aa88aea31a3c1b8ba8d8cab091a9c60
Instruction Fuzzy Hash: E0112C72F04244AFE720CBA8EC459AE77F8EB85360F10017AF909D3251D67C9E44CBA5

Function 000764AC Relevance: 5.1, APIs: 4, Instructions: 57memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,00000050,00000000,00076A9D,00000000,?,00000000), ref: 000764D3
HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,00076A9D,00000000,?,00000000), ref: 0007650C
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 0007652A
HeapFree.KERNEL32(00000000,?), ref: 00076541

Memory Dump Source

Source File: 00000004.00000002.2370134059.0000000000071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00070000, based on PE: true

Associated: 00000004.00000002.2370114466.0000000000070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370158930.0000000000087000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370213044.00000000000FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370229436.00000000000FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370243603.00000000000FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370260977.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370275222.000000000010D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370291300.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370307513.0000000000111000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2370328321.000000000011A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_70000_SecuriteInfo.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: 5b9ebf3769984cb59699bba59586b692b8bfde7e4a832e423f2b5c2ef929b994
Instruction ID: 8055a99bc8b9843e078cb0bacb68f4ce1da5047fd2200952caca5e975e3ce210
Opcode Fuzzy Hash: 5b9ebf3769984cb59699bba59586b692b8bfde7e4a832e423f2b5c2ef929b994
Instruction Fuzzy Hash: 03119D30204A05EFD7308F29EC45D26BBF1FB81354B208A29F1A6C39B4D3B5A886DF44

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_7dd5f59ad4b8c3eff5e6cb56669dac635af4597_e30bf782_3c08e170-e099-426f-ab81-7dafb72511c7\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_9f8a51d2e97124c38f6ead774f7a4d26f0c08f_e30bf782_44600bb9-7195-4d8d-b9e1-633f0683a2ec\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER90AF.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER95FF.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER961F.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA149.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA3EA.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA40A.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
SecuriteInfo.com.Trojan.Swizzor.based.8485.27277.exe

Function 0007FE3D Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 29
libraryloaderCOMMONLIBRARYCODE

Function 00075321 Relevance: 3.0, APIs: 2, Instructions: 26
memoryCOMMON

Function 0007B0F2 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 90
libraryloaderCOMMONLIBRARYCODE

Function 00081596 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 134
COMMON

Function 0007EEE8 Relevance: 10.7, APIs: 7, Instructions: 212
timeCOMMON

Function 0007138E Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 71
libraryloaderthreadCOMMON

Function 0008335D Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 185
COMMONLIBRARYCODE

Function 00071000 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 115
fileCOMMONLIBRARYCODE

Function 0007C146 Relevance: 16.8, APIs: 11, Instructions: 299
COMMONLIBRARYCODE

Function 000719C2 Relevance: 13.8, APIs: 9, Instructions: 291
COMMON

Function 000801C2 Relevance: 12.1, APIs: 8, Instructions: 131
COMMON

Function 000784B0 Relevance: 10.7, APIs: 7, Instructions: 169
COMMONLIBRARYCODE

Function 0007159B Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 13
libraryloaderCOMMONLIBRARYCODE

Function 00080667 Relevance: 9.2, APIs: 6, Instructions: 168
COMMON