Edit tour

Windows Analysis Report
SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe

Overview

General Information

Sample name:	SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe
Analysis ID:	1521704
MD5:	8eb4565c6c7096c17ac94718b2a3724b
SHA1:	1bcec351f712f041e4b23545e9a14c421effcfd3
SHA256:	c700dc3bb675fb60dd69d26ed9628616c97b64af7faaeff92f6c65e7f4f2b8fe
Tags:	exe
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found large amount of non-executed APIs

One or more processes crash

Sample file is different than original file name gathered from version info

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe (PID: 816 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe" MD5: 8EB4565C6C7096C17AC94718B2A3724B)

WerFault.exe (PID: 6052 cmdline: C:\Windows\system32\WerFault.exe -u -p 816 -s 344 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe

ReversingLabs: Detection: 28%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.9% probability

Source: SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe

Code function: 0_2_00007FF76D5790E0 FindFirstFileExW,

0_2_00007FF76D5790E0

Source: Amcache.hve.4.dr

String found in binary or memory: http://upx.sf.net

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe	Code function: 0_2_00007FF76D571290	0_2_00007FF76D571290
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe	Code function: 0_2_00007FF76D57F688	0_2_00007FF76D57F688
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe	Code function: 0_2_00007FF76D572130	0_2_00007FF76D572130
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe	Code function: 0_2_00007FF76D577894	0_2_00007FF76D577894
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe	Code function: 0_2_00007FF76D5790E0	0_2_00007FF76D5790E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe	Code function: 0_2_00007FF76D581010	0_2_00007FF76D581010

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 816 -s 344

Source: SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe, 00000000.00000000.1256164830.00007FF76D594000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameAnyDeskCrashHandler.exe0 vs SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe
Source: SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe, 00000000.00000002.1415625778.00007FF76D594000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameAnyDeskCrashHandler.exe0 vs SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe
Source: SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe	Binary or memory string: OriginalFilenameAnyDeskCrashHandler.exe0 vs SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe

Source: classification engine

Classification label: mal52.winEXE@2/5@0/0

Source: C:\Windows\System32\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess816

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\409e9443-5c1f-4b57-91a9-95832f5ff294

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe

ReversingLabs: Detection: 28%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 816 -s 344

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe

Section loaded: apphelp.dll

Jump to behavior

Source: SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe	Code function: 0_2_00007FF76D57CD54 pushfq ; retf 0000h		0_2_00007FF76D57CD55
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe	Code function: 0_2_00007FF76D58784D push rcx; retf 003Fh		0_2_00007FF76D58784E

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe

API coverage: 2.5 %

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe

Code function: 0_2_00007FF76D5790E0 FindFirstFileExW,

0_2_00007FF76D5790E0

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe

Code function: 0_2_00007FF76D576964 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF76D576964

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe

Code function: 0_2_00007FF76D57B9E0 GetProcessHeap,

0_2_00007FF76D57B9E0

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe	Code function: 0_2_00007FF76D573194 SetUnhandledExceptionFilter,	0_2_00007FF76D573194
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe	Code function: 0_2_00007FF76D576964 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF76D576964
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe	Code function: 0_2_00007FF76D572FB4 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF76D572FB4

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe

Code function: 0_2_00007FF76D57F4D0 cpuid

0_2_00007FF76D57F4D0

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe

Code function: 0_2_00007FF76D572E74 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF76D572E74

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Software Packing	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Obfuscated Files or Information	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe	29%	ReversingLabs	Win64.Trojan.Generic

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.4.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1521704
Start date and time:	2024-09-29 02:25:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe
Detection:	MAL
Classification:	mal52.winEXE@2/5@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29
Excluded domains from analysis (whitelisted): login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, time.windows.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe

Simulations

Behavior and APIs

Time	Type	Description
20:26:20	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_dc444aea7037bbc0cbafead427273f931b99d060_e02d979f_dca1e886-1d26-4919-a40e-4d7a4551cc84\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.766624178255191
Encrypted:	false
SSDEEP:	192:SxwkdiALKz01YIScejPUzuiFxZ24lO8N:3pALKg1YIMj8zuiFxY4lO8N
MD5:	EB260304C408225848BEB3A9C32B3C00
SHA1:	90B962F73580CDB877D5CF5B930A69A55ED7A239
SHA-256:	179EF10ABA7055AF8C8125D91EB8B1F1328ABEFCDD802616632A1E3373C2EE93
SHA-512:	F03A281A7A35DF16973419EF08EC0EFE9D69309F956CE69DB62B1274C088D74FF18C07779D587B443AF5C2BFD694EFBD1443DF2CF6BEC01DDD85502D43F7384E
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.0.4.3.1.6.4.6.6.4.4.5.9.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.0.4.3.1.6.5.0.0.8.2.0.6.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.c.a.1.e.8.8.6.-.1.d.2.6.-.4.9.1.9.-.a.4.0.e.-.4.d.7.a.4.5.5.1.c.c.8.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.1.7.3.0.8.1.7.-.d.9.1.e.-.4.7.5.d.-.a.f.d.f.-.c.3.8.b.3.a.f.c.7.6.6.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...W.3.2...P.o.s.s.i.b.l.e.T.h.r.e.a.t...1.3.4.8.4...6.4.7.4...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.A.n.y.D.e.s.k.C.r.a.s.h.H.a.n.d.l.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.3.3.0.-.0.0.0.1.-.0.0.1.4.-.4.a.5.6.-.3.e.2.b.0.6.1.2.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.a.b.3.1.1.5.b.4.4.3.0.4.0.b.0.2.0.7.f.c.e.8.b.3.9.7.c.4.8.c.6.0.0.0.0.0.9.0.4.!.0.0.0.0.1.b.c.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6D9A.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sun Sep 29 00:26:04 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	53892
Entropy (8bit):	1.653057773878504
Encrypted:	false
SSDEEP:	192:iauQZMOWIu8Pf4KaBaZaxuJu/ujqrTsXPIZ7olvD:WKDE8Pf4BskU8WCTkPI1o
MD5:	1862A05967E9B4B06749BFB2FFB64F96
SHA1:	02A035FFDFDDF178F622DF3920EF30B7222A7A19
SHA-256:	A00F31DBC073ABB0962F9E8BE857236DE33A6392F9B2CC604F517F111DB6FCE8
SHA-512:	4254686594718057BEFE563E1FE255D40762E65F5F9DA2458699C0D3256D4831091395267948F70D10CE0A2448369564348E1216D0A1DC09C83772BE501511BB
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ..........f........................0................&..........T.......8...........T.......................................................................................................................eJ......P.......Lw......................T.......0......f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6E27.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8728
Entropy (8bit):	3.699516184613014
Encrypted:	false
SSDEEP:	192:R6l7wVeJT0eUqcv/6YNZPgmfklcAprj89b81ofQ70m:R6lXJgeUp6YTPgmfkQ8Kf4
MD5:	F919EA89E221A3054331DE6F4B8B274F
SHA1:	5AC14F09F4408A1A0F8E288C255A4DAF11C202F1
SHA-256:	C7ADF12225051C22416D74E7D4320657F35225D6D040494BBE860F3AED59BCE7
SHA-512:	905D40DABEDF2E44C26A543992A1A8C644F90FB892D0ED5F4AC62768339EF05EF50E69C13E54842B4AA96A6615D7962E82E04A95D3FE37D5C8B73CD7ADF98190
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.8.1.6.<./.P.i.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6E48.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4967
Entropy (8bit):	4.572518360756344
Encrypted:	false
SSDEEP:	48:cvIwWl8zsuJg771I9TQWpW8VYsYm8M4JH07aZFcyq85rUwo/nKgS5SHd:uIjfkI7Yp7VAJH0GAoUl/KgS5SHd
MD5:	02D97637A84D426AF07B3705BB0E560D
SHA1:	10818A1EAE73B9B3C1CED90B2D988C575BDFC3E2
SHA-256:	3066A7A00D3AC982EA7CAD40D586093BCC3C275AA1DF6BDB3DAB523D8A920A8A
SHA-512:	61EB28BC28F3DA691E50558B01EE781211491DCC83A98032D702FD7829EFB971F7BD568823F445945F42C4F3F3EB3FE7BC6459739810C23C6B388AD9855FB8B9
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="520768" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.417072376499763
Encrypted:	false
SSDEEP:	6144:Kcifpi6ceLPL9skLmb0mISWSPtaJG8nAgex285i2MMhA20X4WABlGuNC5+:ni58ISWIZBk2MM6AFB8o
MD5:	B5F05DB2574BB9EE775B516C4431B7AE
SHA1:	DFC466CFA7B00954E7672B552A5DBBE50321E989
SHA-256:	D67A04BFA81F7D394389AB935451549F767910BDDD0C6675D0B005923C234BA8
SHA-512:	D1AA723A6A260241776642D79E442567E2E627A897F39BEAF0E0450720E6F3C3580134C69D54CDD736ECDEFC8B39A783543A66990D2E44A5E755D685E6111257
Malicious:	false
Reputation:	low
Preview:	regfE...E....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..x+................................................................................................................................................................................................................................................................................................................................................v.o.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.756024662478089
TrID:	Win64 Executable GUI (202006/5) 81.26% UPX compressed Win32 Executable (30571/9) 12.30% Win64 Executable (generic) (12005/4) 4.83% Generic Win/DOS Executable (2004/3) 0.81% DOS Executable Generic (2002/1) 0.81%
File name:	SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe
File size:	60'416 bytes
MD5:	8eb4565c6c7096c17ac94718b2a3724b
SHA1:	1bcec351f712f041e4b23545e9a14c421effcfd3
SHA256:	c700dc3bb675fb60dd69d26ed9628616c97b64af7faaeff92f6c65e7f4f2b8fe
SHA512:	5ba97ce8b19efa125efb40aae9b1e1c9fb6a7e45b9261bd8327988c8c5474a5e27aace3e0ca77a0767740caeb7bf2060490dc77deba7eee474f6f3a998b1f0a6
SSDEEP:	1536:td3pwkJ+vSKrCdQN8ZAO/IYeBcWCgTumOC9N9b:TpwkAEQN8ZAOAYs2gTumOCJ
TLSH:	EA43015D1AECCC38DCEE4D38B7945F6F33A520243E5F72B8E68D9B296E638418845790
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................................?............g.......g.......g.......................f.......f........F......f......Rich...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140023aa0
Entrypoint Section:	UPX1
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66E2C679 [Thu Sep 12 10:46:17 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d090fd5cd28b959e47496dea062def88

Entrypoint Preview

Instruction
push ebx
push esi
push edi
push ebp
dec eax
lea esi, dword ptr [FFFF2555h]
dec eax
lea edi, dword ptr [esi-00015000h]
push edi
xor ebx, ebx
xor ecx, ecx
dec eax
or ebp, FFFFFFFFh
call 00007EFE24F39B85h
add ebx, ebx
je 00007EFE24F39B34h
rep ret
mov ebx, dword ptr [esi]
dec eax
sub esi, FFFFFFFCh
adc ebx, ebx
mov dl, byte ptr [esi]
rep ret
dec eax
lea eax, dword ptr [edi+ebp]
cmp ecx, 05h
mov dl, byte ptr [eax]
jbe 00007EFE24F39B53h
dec eax
cmp ebp, FFFFFFFCh
jnbe 00007EFE24F39B4Dh
sub ecx, 04h
mov edx, dword ptr [eax]
dec eax
add eax, 04h
sub ecx, 04h
mov dword ptr [edi], edx
dec eax
lea edi, dword ptr [edi+04h]
jnc 00007EFE24F39B21h
add ecx, 04h
mov dl, byte ptr [eax]
je 00007EFE24F39B42h
dec eax
inc eax
mov byte ptr [edi], dl
sub ecx, 01h
mov dl, byte ptr [eax]
dec eax
lea edi, dword ptr [edi+01h]
jne 00007EFE24F39B22h
rep ret
cld
inc ecx
pop ebx
jmp 00007EFE24F39B3Ah
dec eax
inc esi
mov byte ptr [edi], dl
dec eax
inc edi
mov dl, byte ptr [esi]
add ebx, ebx
jne 00007EFE24F39B3Ch
mov ebx, dword ptr [esi]
dec eax
sub esi, FFFFFFFCh
adc ebx, ebx
mov dl, byte ptr [esi]
jc 00007EFE24F39B18h
lea eax, dword ptr [ecx+01h]
inc ecx
call ebx
adc eax, eax
add ebx, ebx
jne 00007EFE24F39B3Ch
mov ebx, dword ptr [esi]
dec eax
sub esi, FFFFFFFCh
adc ebx, ebx
mov dl, byte ptr [esi]
jnc 00007EFE24F39B1Dh
sub eax, 03h
jc 00007EFE24F39B45h
shl eax, 08h
movzx edx, dl
or eax, edx
dec eax
inc esi
xor eax, FFFFFFFFh
je 00007EFE24F39B6Ch
dec eax
arpl ax, bp
lea eax, dword ptr [ecx+01h]
inc ecx
call ebx
adc ecx, ecx

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24540	0xe0	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24000	0x540	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x1e000	0x105c	UPX1
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24620	0x1c	.rsrc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x23ce8	0x140	UPX1
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x15000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0x16000	0xe000	0xe000	971217b39ca6b5ad20cf0699790781a7	False	0.9666224888392857	data	7.853520580690587	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24000	0x1000	0x800	0654d0427235b75a25140946cb4c5f4f	False	0.37646484375	data	3.56953370154622	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x240a4	0x318	data	English	United States	0.4393939393939394
RT_MANIFEST	0x243c0	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
KERNEL32.DLL	LoadLibraryA, ExitProcess, GetProcAddress, VirtualProtect
SHELL32.dll	CommandLineToArgvW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 29, 2024 02:26:24.440877914 CEST	53	59860	1.1.1.1	192.168.2.7

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: SecuriteInfo.com.W32.PossibleThreat.13484.6474.exePID: 816, Parent PID: 4056

General

Target ID:	0
Start time:	20:26:04
Start date:	28/09/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe"
Imagebase:	0x7ff76d570000
File size:	60'416 bytes
MD5 hash:	8EB4565C6C7096C17AC94718B2A3724B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 6052, Parent PID: 816

General

Target ID:	4
Start time:	20:26:04
Start date:	28/09/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 816 -s 344
Imagebase:	0x7ff6d4c40000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: SecuriteInfo.com.W32.PossibleThreat.13484.6474.exePID: 816, Parent PID: 4056COMMON

Execution Graph

Execution Coverage:	1.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.3%
Total number of Nodes:	1684
Total number of Limit Nodes:	2

Executed Functions

Function 00007FF76D571290 Relevance: 56.7, APIs: 8, Strings: 24, Instructions: 707
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 00007FF76D5712B4
CommandLineToArgvW.SHELL32 ref: 00007FF76D5712C4

Part of subcall function 00007FF76D5723F0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D57251D
Part of subcall function 00007FF76D5723F0: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76D572523

Sleep.KERNEL32 ref: 00007FF76D571503
OpenProcess.KERNEL32 ref: 00007FF76D571513
GetExitCodeProcess.KERNEL32 ref: 00007FF76D57152C
CloseHandle.KERNEL32 ref: 00007FF76D57154A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D57161D
CloseHandle.KERNEL32 ref: 00007FF76D571626

Part of subcall function 00007FF76D5711C0: CreateProcessW.KERNEL32 ref: 00007FF76D571248
Part of subcall function 00007FF76D5711C0: WaitForSingleObject.KERNEL32 ref: 00007FF76D57125C
Part of subcall function 00007FF76D5711C0: CloseHandle.KERNEL32 ref: 00007FF76D571267
Part of subcall function 00007FF76D5711C0: CloseHandle.KERNEL32 ref: 00007FF76D571272

Strings

e, xrefs: 00007FF76D571B54
f, xrefs: 00007FF76D571B2C
u, xrefs: 00007FF76D571B5C
1, xrefs: 00007FF76D571B44
E, xrefs: 00007FF76D571AD4
v, xrefs: 00007FF76D571B6C
O, xrefs: 00007FF76D571B7F
q, xrefs: 00007FF76D571BC4
e, xrefs: 00007FF76D571B24
^, xrefs: 00007FF76D571AFC
^, xrefs: 00007FF76D571ADC
f, xrefs: 00007FF76D571AEC
{, xrefs: 00007FF76D571B04
o, xrefs: 00007FF76D571B14
y, xrefs: 00007FF76D571AF4
4, xrefs: 00007FF76D571B1C
k, xrefs: 00007FF76D571AE4
g, xrefs: 00007FF76D571B34
", xrefs: 00007FF76D571B4C
c, xrefs: 00007FF76D571B64
q, xrefs: 00007FF76D571BAD
e, xrefs: 00007FF76D571B96
g, xrefs: 00007FF76D571B3C
v, xrefs: 00007FF76D571B0C

Memory Dump Source

Source File: 00000000.00000002.1415567108.00007FF76D571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF76D570000, based on PE: true

Associated: 00000000.00000002.1415551620.00007FF76D570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D58C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D592000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415612652.00007FF76D593000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415625778.00007FF76D594000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d570000_SecuriteInfo.jbxd

Similarity

API ID: CloseHandle$Process$CommandLine_invalid_parameter_noinfo_noreturn$ArgvCodeConcurrency::cancel_current_taskCreateExitObjectOpenSingleSleepWait
String ID: "$1$4$E$O$^$^$c$e$e$e$f$f$g$g$k$o$q$q$u$v$v$y${
API String ID: 2156799773-2036417650
Opcode ID: c1d2bd5ecab1e29387099a9231fbbf5fdd0bd6c6d5006ae6e3c12c42f7bb96a7
Instruction ID: 6659e96aead91932a26f2e5ef3a1063c5af0cb44c7e9373e1e81d557be4793cd
Opcode Fuzzy Hash: c1d2bd5ecab1e29387099a9231fbbf5fdd0bd6c6d5006ae6e3c12c42f7bb96a7
Instruction Fuzzy Hash: 24828659A29262C9E320BF71F4012FD77B0FF18709B405136EE884BA6AFB7C9545C729

Function 00007FF76D5727DC Relevance: 3.1, APIs: 2, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF76D572C70: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF76D572C84

__scrt_release_startup_lock.LIBCMT ref: 00007FF76D57286E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF76D5728C1

Memory Dump Source

Source File: 00000000.00000002.1415567108.00007FF76D571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF76D570000, based on PE: true

Associated: 00000000.00000002.1415551620.00007FF76D570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D58C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D592000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415612652.00007FF76D593000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415625778.00007FF76D594000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d570000_SecuriteInfo.jbxd

Similarity

API ID: __scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3070443116-0
Opcode ID: 4fc66f674771a642c276f3b7107815a4453248af2fe5cf5af13cbfa4e39b06b6
Instruction ID: 66eb7ce107a4fea10c5e6d9d9ac9b7105b286c0465a6a7fd74eaccf405226d96
Opcode Fuzzy Hash: 4fc66f674771a642c276f3b7107815a4453248af2fe5cf5af13cbfa4e39b06b6
Instruction Fuzzy Hash: FA315920E2D243C5FA24BB2594527BDE290AF41744FE44435EE4E87ED3FE2DA6458630

Non-executed Functions

Function 00007FF76D572FB4 Relevance: 10.6, APIs: 7, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF76D572FD0
RtlCaptureContext.KERNEL32 ref: 00007FF76D572FFD
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF76D573017
RtlVirtualUnwind.KERNEL32 ref: 00007FF76D573058
IsDebuggerPresent.KERNEL32 ref: 00007FF76D5730AC
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF76D5730C9
UnhandledExceptionFilter.KERNEL32 ref: 00007FF76D5730D4

Memory Dump Source

Source File: 00000000.00000002.1415567108.00007FF76D571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF76D570000, based on PE: true

Associated: 00000000.00000002.1415551620.00007FF76D570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D58C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D592000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415612652.00007FF76D593000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415625778.00007FF76D594000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d570000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 8f52d899b0c822738a6be879117695353cf3926ba201aa6cbb5a93e39f724cd6
Instruction ID: de6b913445a9baa9436bb62bc3f2d441ff7e4683ab6e2b0463d21f4383ac6ab3
Opcode Fuzzy Hash: 8f52d899b0c822738a6be879117695353cf3926ba201aa6cbb5a93e39f724cd6
Instruction Fuzzy Hash: 49314D72619BC1C6EB60AF61E8407EDB360FB84745F90403ADA4D47B99EF38D648C720

Function 00007FF76D576964 Relevance: 9.1, APIs: 6, Instructions: 83
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF76D5769DD
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF76D5769F5
RtlVirtualUnwind.KERNEL32 ref: 00007FF76D576A30
IsDebuggerPresent.KERNEL32 ref: 00007FF76D576A69
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF76D576A73
UnhandledExceptionFilter.KERNEL32 ref: 00007FF76D576A7E

Memory Dump Source

Source File: 00000000.00000002.1415567108.00007FF76D571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF76D570000, based on PE: true

Associated: 00000000.00000002.1415551620.00007FF76D570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D58C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D592000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415612652.00007FF76D593000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415625778.00007FF76D594000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d570000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: e2ea2adcc270ce3856cbe536865dde51c27872e812a40651d9b59811c8af80ab
Instruction ID: 61377cf07b6c4ea6476dd516c92f1279c0928970fcbd9ce1c7193541c5d5bfca
Opcode Fuzzy Hash: e2ea2adcc270ce3856cbe536865dde51c27872e812a40651d9b59811c8af80ab
Instruction Fuzzy Hash: 9C316232618B81C6D760DF25E8446AEB3A0FB88754FA00136EE9D43B55EF3CD545C710

Function 00007FF76D572E74 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF76D572EA0
GetCurrentThreadId.KERNEL32 ref: 00007FF76D572EAE
GetCurrentProcessId.KERNEL32 ref: 00007FF76D572EBA
QueryPerformanceCounter.KERNEL32 ref: 00007FF76D572ECA

Memory Dump Source

Source File: 00000000.00000002.1415567108.00007FF76D571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF76D570000, based on PE: true

Associated: 00000000.00000002.1415551620.00007FF76D570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D58C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D592000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415612652.00007FF76D593000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415625778.00007FF76D594000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d570000_SecuriteInfo.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 9a9e087552f48f16067c4e9381aaf7e9c0349c56c42918a85502eba34d99e3bf
Instruction ID: d471e0e4755bfc02c342a5b787397105f549be1609ea4e150ba17f81ee77dba4
Opcode Fuzzy Hash: 9a9e087552f48f16067c4e9381aaf7e9c0349c56c42918a85502eba34d99e3bf
Instruction Fuzzy Hash: 74115E22B28F51CAEB00DF60EC552B873A4FB18759F840E31DE2D42BA5EF38D1548350

Function 00007FF76D57F688 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF76D57F8D7
RaiseException.KERNEL32 ref: 00007FF76D57F8E8

Memory Dump Source

Source File: 00000000.00000002.1415567108.00007FF76D571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF76D570000, based on PE: true

Associated: 00000000.00000002.1415551620.00007FF76D570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D58C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D592000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415612652.00007FF76D593000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415625778.00007FF76D594000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d570000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 70e5190aba0a30e8a3c6e13cd35a682bc11a1b788da8d991d999369683fb2a1e
Instruction ID: 85a5c2c417012c33c8491fa9e521d0b4cf2f53e8fc1138b6fda91fc71980bbf4
Opcode Fuzzy Hash: 70e5190aba0a30e8a3c6e13cd35a682bc11a1b788da8d991d999369683fb2a1e
Instruction Fuzzy Hash: B6B16A73A28B89CAEB15CF29C44636CB7A0F744B48F648831DE5D83BA5DB39D451C710

Function 00007FF76D5790E0 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1415567108.00007FF76D571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF76D570000, based on PE: true

Associated: 00000000.00000002.1415551620.00007FF76D570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D58C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D592000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415612652.00007FF76D593000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415625778.00007FF76D594000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d570000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbda48c13a26031c3bdccd200ab5162332e8f0bd19a724b6d25107ba2d5d4a5c
Instruction ID: ecfd1047610c6f2de0533197e108ef9c0800c0126bd79c2c218901d6a9a4bcab
Opcode Fuzzy Hash: bbda48c13a26031c3bdccd200ab5162332e8f0bd19a724b6d25107ba2d5d4a5c
Instruction Fuzzy Hash: 2A51E422B2C691C5FB20EB72A8445AEBBA5FB447D4F644134EE5C27E96EE3CD501C710

Function 00007FF76D57B9E0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF76D57B9E4

Memory Dump Source

Source File: 00000000.00000002.1415567108.00007FF76D571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF76D570000, based on PE: true

Associated: 00000000.00000002.1415551620.00007FF76D570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D58C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D592000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415612652.00007FF76D593000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415625778.00007FF76D594000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d570000_SecuriteInfo.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: cd4e955e899a76dec8afab3bdd2be66e80efb0135898893da86be88b405ecd2f
Instruction ID: 552c3ed07f60a2607768bf0a579e7f724fd2fea3b51143bdbef2673555cd3ba4
Opcode Fuzzy Hash: cd4e955e899a76dec8afab3bdd2be66e80efb0135898893da86be88b405ecd2f
Instruction Fuzzy Hash: F9B09220E2BA12C6EA083B166C82A28A2E47F88710FC8013AC80D80721EF2C20A56720

Function 00007FF76D572130 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1415567108.00007FF76D571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF76D570000, based on PE: true

Associated: 00000000.00000002.1415551620.00007FF76D570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D58C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D592000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415612652.00007FF76D593000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415625778.00007FF76D594000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d570000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd508fb2eb488edaf68b778ccb69d5fbf80095a4700453bc25d13363f741229f
Instruction ID: 309deaad0c6c40aa60fb7082b7f0a284561dd79ceb3608c97e66cf29be50ae22
Opcode Fuzzy Hash: dd508fb2eb488edaf68b778ccb69d5fbf80095a4700453bc25d13363f741229f
Instruction Fuzzy Hash: 3171996320638286D354CB79C149A8F7372FB25E08F3AC5398A48DE421E7AB854FD75D

Function 00007FF76D577894 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1415567108.00007FF76D571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF76D570000, based on PE: true

Associated: 00000000.00000002.1415551620.00007FF76D570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D58C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D592000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415612652.00007FF76D593000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415625778.00007FF76D594000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d570000_SecuriteInfo.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: db086ef1d692fc8f0d6d882fc253e1940d9ace901fd5ef3b7d5fb5e85eb7b0fe
Instruction ID: 2d32d93a43ec6a70690c2136b7e80f7805ede7fbb6c6d4b3ef6723feb64dcd3a
Opcode Fuzzy Hash: db086ef1d692fc8f0d6d882fc253e1940d9ace901fd5ef3b7d5fb5e85eb7b0fe
Instruction Fuzzy Hash: F441D462B28A55C2EF04DF2AE914579A3A1FB48FD4B999136DE0D87F59EF3CD1418300

Function 00007FF76D581010 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1415567108.00007FF76D571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF76D570000, based on PE: true

Associated: 00000000.00000002.1415551620.00007FF76D570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D58C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D592000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415612652.00007FF76D593000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415625778.00007FF76D594000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d570000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39478ef81b2f468aebf7aa4282a7d7dfe579628b5dfd2fc3f6e3175151e907a2
Instruction ID: d4e60f523f0b475c7648ac335fbed9ba99b3b6e90374566dad41d8f17f05bc3d
Opcode Fuzzy Hash: 39478ef81b2f468aebf7aa4282a7d7dfe579628b5dfd2fc3f6e3175151e907a2
Instruction Fuzzy Hash: 3021D997C1DBD1C7F3931E788C6656A7F90EB92E0678E8076CB94425C3FD1D28058762

Function 00007FF76D57F4D0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1415567108.00007FF76D571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF76D570000, based on PE: true

Associated: 00000000.00000002.1415551620.00007FF76D570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D58C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D592000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415612652.00007FF76D593000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415625778.00007FF76D594000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d570000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 203a0647e2d6663912e41e03e962fd136856b41587daf9f3029637f2d9a5f9f9
Instruction ID: 4c252a6857ececc2ea55a454f22deb6b6cf3bfc9c8eecea59c9351d4b9b5380f
Opcode Fuzzy Hash: 203a0647e2d6663912e41e03e962fd136856b41587daf9f3029637f2d9a5f9f9
Instruction Fuzzy Hash: 6BF01871B2D665CEDB94DF2DB44262977D0EB88394F90803BD98D83F15D63C94518F14

Function 00007FF76D573194 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1415567108.00007FF76D571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF76D570000, based on PE: true

Associated: 00000000.00000002.1415551620.00007FF76D570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D58C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D592000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415612652.00007FF76D593000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415625778.00007FF76D594000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d570000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c532a7e7973e6521e9087c9948b46ec7f20e37d18fef3b9412a635c7f6f5707b
Instruction ID: 570430bb8e47309bd66686d50981e2443be521f0be792f95ac2996b19c053c49
Opcode Fuzzy Hash: c532a7e7973e6521e9087c9948b46ec7f20e37d18fef3b9412a635c7f6f5707b
Instruction Fuzzy Hash: 13A0022192CED2D1F744AB01EC51830A330FB91311FD00032D82D418A2FF3CA548D321

Function 00007FF76D574688 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF76D5746E5

Part of subcall function 00007FF76D5755AC: __GetUnwindTryBlock.LIBCMT ref: 00007FF76D5755EF
Part of subcall function 00007FF76D5755AC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF76D575614

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF76D5747BD
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF76D574A0B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF76D574B18

Strings

csm, xrefs: 00007FF76D5746FF
csm, xrefs: 00007FF76D574766
csm, xrefs: 00007FF76D5747E0

Memory Dump Source

Source File: 00000000.00000002.1415567108.00007FF76D571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF76D570000, based on PE: true

Associated: 00000000.00000002.1415551620.00007FF76D570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D58C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D592000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415612652.00007FF76D593000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415625778.00007FF76D594000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d570000_SecuriteInfo.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 16a4851235c6518bd57d75e0bbaaf0572c504870d06300cd69717d705a9622f7
Instruction ID: 05efc45acc86e9f7866b26f79732aa446c25357ba94bde8ada8ad6e9d4d9451e
Opcode Fuzzy Hash: 16a4851235c6518bd57d75e0bbaaf0572c504870d06300cd69717d705a9622f7
Instruction Fuzzy Hash: C9D19032A2C741C6EB20AB65D4413ADB7A0FB59798FA00135EE4D57F96EF38E251C710

Function 00007FF76D57B490 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 00007FF76D57B60C
GetProcAddress.KERNEL32 ref: 00007FF76D57B618

Strings

api-ms-, xrefs: 00007FF76D57B556
ext-ms-, xrefs: 00007FF76D57B569

Memory Dump Source

Source File: 00000000.00000002.1415567108.00007FF76D571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF76D570000, based on PE: true

Associated: 00000000.00000002.1415551620.00007FF76D570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D58C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D592000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415612652.00007FF76D593000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415625778.00007FF76D594000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d570000_SecuriteInfo.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: b30e28bd0cd48f27bf1a31ff5ea156d3804f5e8b499c2477a6b867bb355f5e73
Instruction ID: c0276e05441292d6caf8cd060f86dadaff26a8366d6d298d6d72569c46d4d37b
Opcode Fuzzy Hash: b30e28bd0cd48f27bf1a31ff5ea156d3804f5e8b499c2477a6b867bb355f5e73
Instruction Fuzzy Hash: C841F521B3DA22C1EB15FB16A8105B5A392BF49BE0FA94135DD1E47B86FF3CE5058320

Function 00007FF76D575F74 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF76D575FB7
_invalid_parameter_noinfo.LIBCMT ref: 00007FF76D5763A4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF76D576640

Strings

p, xrefs: 00007FF76D576069
f, xrefs: 00007FF76D5760D9
p, xrefs: 00007FF76D5760E1

Memory Dump Source

Source File: 00000000.00000002.1415567108.00007FF76D571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF76D570000, based on PE: true

Associated: 00000000.00000002.1415551620.00007FF76D570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D58C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D592000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415612652.00007FF76D593000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415625778.00007FF76D594000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d570000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: 2db86bdd0b4c4cd621bef344b6d918bb67484dc4c7676120007631029398bba2
Instruction ID: 064b804ccec52d54cb1aed2e124d264b2430122b082088152355b984d4055144
Opcode Fuzzy Hash: 2db86bdd0b4c4cd621bef344b6d918bb67484dc4c7676120007631029398bba2
Instruction Fuzzy Hash: AC12A262A2C343C6FBA07A159154279F6A1FB40750FE44035EE9947EC6EF3CE6809BA1

Function 00007FF76D5758FC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32 ref: 00007FF76D575981
GetLastError.KERNEL32 ref: 00007FF76D57598F
LoadLibraryExW.KERNEL32 ref: 00007FF76D5759B9
FreeLibrary.KERNEL32 ref: 00007FF76D575A27
GetProcAddress.KERNEL32 ref: 00007FF76D575A33

Strings

api-ms-, xrefs: 00007FF76D5759A1

Memory Dump Source

Source File: 00000000.00000002.1415567108.00007FF76D571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF76D570000, based on PE: true

Associated: 00000000.00000002.1415551620.00007FF76D570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D58C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D592000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415612652.00007FF76D593000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415625778.00007FF76D594000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d570000_SecuriteInfo.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: ed90df822e7d59495b79f906fc16800e7d9b52045c0eb292820e9cf29d7ca3ef
Instruction ID: 46fc08221f089ef10053d41c98e976c32a2249c5d7e861ab27be38a39c20235a
Opcode Fuzzy Hash: ed90df822e7d59495b79f906fc16800e7d9b52045c0eb292820e9cf29d7ca3ef
Instruction Fuzzy Hash: 6931C222A2E752C1EE61AB12E8005B5A3A4BF44BB0FE90135DD2D47B96FE3CE540C320

Function 00007FF76D578700 Relevance: 10.6, APIs: 7, Instructions: 62
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00007FF76D57870F
FlsGetValue.KERNEL32 ref: 00007FF76D578724
FlsSetValue.KERNEL32 ref: 00007FF76D578745
FlsSetValue.KERNEL32 ref: 00007FF76D578772
FlsSetValue.KERNEL32 ref: 00007FF76D578783
FlsSetValue.KERNEL32 ref: 00007FF76D578794
SetLastError.KERNEL32 ref: 00007FF76D5787AF

Memory Dump Source

Source File: 00000000.00000002.1415567108.00007FF76D571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF76D570000, based on PE: true

Associated: 00000000.00000002.1415551620.00007FF76D570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D58C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D592000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415612652.00007FF76D593000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415625778.00007FF76D594000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d570000_SecuriteInfo.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 8b63ef19f9df0f4c288cac1842f9729c2262ba617c372d28031ee4c08f10457d
Instruction ID: f7d8210d2421447c121825562899cd3b552e2971dcf75c10c09a5cc52f342a51
Opcode Fuzzy Hash: 8b63ef19f9df0f4c288cac1842f9729c2262ba617c372d28031ee4c08f10457d
Instruction Fuzzy Hash: 57215724B2D286C2FA587321695513DE6525F447F0FF44735DD3E06EC7FE2CA6009222

Function 00007FF76D57EF9C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteConsoleW.KERNEL32 ref: 00007FF76D57EFCD
GetLastError.KERNEL32 ref: 00007FF76D57EFD9
CloseHandle.KERNEL32 ref: 00007FF76D57EFF1
CreateFileW.KERNEL32 ref: 00007FF76D57F01C
WriteConsoleW.KERNEL32 ref: 00007FF76D57F03B

Strings

CONOUT$, xrefs: 00007FF76D57EFFD

Memory Dump Source

Source File: 00000000.00000002.1415567108.00007FF76D571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF76D570000, based on PE: true

Associated: 00000000.00000002.1415551620.00007FF76D570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D58C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D592000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415612652.00007FF76D593000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415625778.00007FF76D594000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d570000_SecuriteInfo.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: da70c63ec7be9f21d8993bfcef2884285bdc39009cb66d938cb2b7c8fc8294fa
Instruction ID: e48846db547d4c3f7905b22c37d31c0063170021c8f56719ceb7579f82af375e
Opcode Fuzzy Hash: da70c63ec7be9f21d8993bfcef2884285bdc39009cb66d938cb2b7c8fc8294fa
Instruction Fuzzy Hash: 12118431B2CA91C6E3509B42E844725A2A0FB48BE5F544234ED6E87F95EF3CD5448754

Function 00007FF76D578878 Relevance: 9.1, APIs: 6, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00007FF76D578887
FlsSetValue.KERNEL32(?,?,?,00007FF76D57828D,?,?,?,?,00007FF76D578B70), ref: 00007FF76D5788BD
FlsSetValue.KERNEL32(?,?,?,00007FF76D57828D,?,?,?,?,00007FF76D578B70), ref: 00007FF76D5788EA
FlsSetValue.KERNEL32(?,?,?,00007FF76D57828D,?,?,?,?,00007FF76D578B70), ref: 00007FF76D5788FB
FlsSetValue.KERNEL32(?,?,?,00007FF76D57828D,?,?,?,?,00007FF76D578B70), ref: 00007FF76D57890C
SetLastError.KERNEL32 ref: 00007FF76D578927

Memory Dump Source

Source File: 00000000.00000002.1415567108.00007FF76D571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF76D570000, based on PE: true

Associated: 00000000.00000002.1415551620.00007FF76D570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D58C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D592000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415612652.00007FF76D593000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415625778.00007FF76D594000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d570000_SecuriteInfo.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: afbb12fcad02bafca9b27522c9550e3d77d0b2974f4a39fa0265fdc4056edb3d
Instruction ID: 1ce1d61e975ede22c2965390da2fe640dd3faece4bb9cdd3569afd9075e33747
Opcode Fuzzy Hash: afbb12fcad02bafca9b27522c9550e3d77d0b2974f4a39fa0265fdc4056edb3d
Instruction Fuzzy Hash: A3114920B2D696C2FA54B721A55517DEA525F847F0FE44B35DC2E06FC7FE2CA6018222

Function 00007FF76D5711C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32 ref: 00007FF76D571248
WaitForSingleObject.KERNEL32 ref: 00007FF76D57125C
CloseHandle.KERNEL32 ref: 00007FF76D571267
CloseHandle.KERNEL32 ref: 00007FF76D571272

Strings

h, xrefs: 00007FF76D5711DF

Memory Dump Source

Source File: 00000000.00000002.1415567108.00007FF76D571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF76D570000, based on PE: true

Associated: 00000000.00000002.1415551620.00007FF76D570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D58C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D592000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415612652.00007FF76D593000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415625778.00007FF76D594000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d570000_SecuriteInfo.jbxd

Similarity

API ID: CloseHandle$CreateObjectProcessSingleWait
String ID: h
API String ID: 2059082233-2439710439
Opcode ID: 5b8cf0092febe8dd4bed2618a947a67060a1088977b281d69a45aa787853e3eb
Instruction ID: aadec912eac7ab7023574f34934a414049bea161759314c0fcbc9df953a8e0b8
Opcode Fuzzy Hash: 5b8cf0092febe8dd4bed2618a947a67060a1088977b281d69a45aa787853e3eb
Instruction Fuzzy Hash: 4B110722E2CBC1C2E7509B24E85436EB3A0F7D9784F516339EA9D46A25EF78D1958B00

Function 00007FF76D575E84 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF76D575EA9
GetProcAddress.KERNEL32 ref: 00007FF76D575EBF
FreeLibrary.KERNEL32 ref: 00007FF76D575EE6

Strings

mscoree.dll, xrefs: 00007FF76D575EA0
CorExitProcess, xrefs: 00007FF76D575EB8

Memory Dump Source

Source File: 00000000.00000002.1415567108.00007FF76D571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF76D570000, based on PE: true

Associated: 00000000.00000002.1415551620.00007FF76D570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D58C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D592000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415612652.00007FF76D593000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415625778.00007FF76D594000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d570000_SecuriteInfo.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 601fe3a390ecbed2954148d0ced979f55aad1695c3df72d69a231db1b69d0d0c
Instruction ID: 3ef7e9954dd6b61905be4649cc223bc5ca44854b5e1d2e83277d1cca350ceaad
Opcode Fuzzy Hash: 601fe3a390ecbed2954148d0ced979f55aad1695c3df72d69a231db1b69d0d0c
Instruction Fuzzy Hash: 59F0AF61A2C616C1EB10AB24E454779A320AF487A1F940235CD6E45AE5EF2CD5848320

Function 00007FF76D57F2EC Relevance: 7.6, APIs: 5, Instructions: 56
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_set_statfp.LIBCMT ref: 00007FF76D57F314
_set_statfp.LIBCMT ref: 00007FF76D57F32F
_set_statfp.LIBCMT ref: 00007FF76D57F34B
_set_statfp.LIBCMT ref: 00007FF76D57F387

Memory Dump Source

Source File: 00000000.00000002.1415567108.00007FF76D571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF76D570000, based on PE: true

Associated: 00000000.00000002.1415551620.00007FF76D570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D58C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D592000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415612652.00007FF76D593000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415625778.00007FF76D594000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d570000_SecuriteInfo.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 42c32d3acaf94be8bf6c9fa5576b7a947ae4a2e90c63d94789f449aabdcb8345
Instruction ID: 48bd21dddc09fb5631e6fd05c09dacf77ab774549c897852845cbf1eabc25916
Opcode Fuzzy Hash: 42c32d3acaf94be8bf6c9fa5576b7a947ae4a2e90c63d94789f449aabdcb8345
Instruction Fuzzy Hash: 6B118222E3CA03D5F7A8B139E44137990416F993E0FA80675ED6E47ADBAE2CAA414130

Function 00007FF76D578940 Relevance: 7.6, APIs: 5, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF76D5768F3,?,?,00000000,00007FF76D576B8E,?,?,?,?,?,00007FF76D576B1A), ref: 00007FF76D57895F
FlsSetValue.KERNEL32(?,?,?,00007FF76D5768F3,?,?,00000000,00007FF76D576B8E,?,?,?,?,?,00007FF76D576B1A), ref: 00007FF76D57897E
FlsSetValue.KERNEL32(?,?,?,00007FF76D5768F3,?,?,00000000,00007FF76D576B8E,?,?,?,?,?,00007FF76D576B1A), ref: 00007FF76D5789A6
FlsSetValue.KERNEL32(?,?,?,00007FF76D5768F3,?,?,00000000,00007FF76D576B8E,?,?,?,?,?,00007FF76D576B1A), ref: 00007FF76D5789B7
FlsSetValue.KERNEL32(?,?,?,00007FF76D5768F3,?,?,00000000,00007FF76D576B8E,?,?,?,?,?,00007FF76D576B1A), ref: 00007FF76D5789C8

Memory Dump Source

Source File: 00000000.00000002.1415567108.00007FF76D571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF76D570000, based on PE: true

Associated: 00000000.00000002.1415551620.00007FF76D570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D58C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D592000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415612652.00007FF76D593000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415625778.00007FF76D594000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d570000_SecuriteInfo.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 0f9621ba38eac4d4c9221c1909a7449da67151443a31084acbc08cdd0f3ab668
Instruction ID: 2dab1938f130165ec83f6a0d8fec5cb52455972bef505755ffeaacf4300eafbd
Opcode Fuzzy Hash: 0f9621ba38eac4d4c9221c1909a7449da67151443a31084acbc08cdd0f3ab668
Instruction Fuzzy Hash: 57116D20B2D64AC5FA58B326A55117DE9525F843F0FE84335EC7E06FC7FE2CA6018222

Function 00007FF76D5787D4 Relevance: 7.6, APIs: 5, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FlsGetValue.KERNEL32 ref: 00007FF76D5787E5
FlsSetValue.KERNEL32 ref: 00007FF76D578804
FlsSetValue.KERNEL32 ref: 00007FF76D57882C
FlsSetValue.KERNEL32 ref: 00007FF76D57883D
FlsSetValue.KERNEL32 ref: 00007FF76D57884E

Memory Dump Source

Source File: 00000000.00000002.1415567108.00007FF76D571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF76D570000, based on PE: true

Associated: 00000000.00000002.1415551620.00007FF76D570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D58C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D592000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415612652.00007FF76D593000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415625778.00007FF76D594000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d570000_SecuriteInfo.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 894ac61070d366438315e3218e1dfb48ca6c91d06236f37a1e460a36819cefe7
Instruction ID: f0fa371b038395e801e7ec72c54db17731c19dfad30042b0fe04dd054b2767bd
Opcode Fuzzy Hash: 894ac61070d366438315e3218e1dfb48ca6c91d06236f37a1e460a36819cefe7
Instruction Fuzzy Hash: 88111810E2D24BC5FA58726258111BDA5515F443B4EF80B35DD3E0AED3FE2CB6018232

Function 00007FF76D573DFC Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF76D573E27
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF76D573EBE
RtlUnwindEx.KERNEL32 ref: 00007FF76D573F18

Strings

csm, xrefs: 00007FF76D573EA5

Memory Dump Source

Source File: 00000000.00000002.1415567108.00007FF76D571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF76D570000, based on PE: true

Associated: 00000000.00000002.1415551620.00007FF76D570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D58C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D592000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415612652.00007FF76D593000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415625778.00007FF76D594000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d570000_SecuriteInfo.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 9ec0b71a165466a9c67599c9ab78e621c696c82d4bac01c73983b7531b60d568
Instruction ID: ab043edafbc18c1ce605ea42bf2f526a6571e17620cd8f869903ce75adf28b97
Opcode Fuzzy Hash: 9ec0b71a165466a9c67599c9ab78e621c696c82d4bac01c73983b7531b60d568
Instruction Fuzzy Hash: 9A51B421B2D542CAEB14EF15D444A78B3A1EB44BA4FA04135EE6E43B86FF3DE941C710

Function 00007FF76D574F08 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF76D574F30
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF76D575018

Strings

csm, xrefs: 00007FF76D574F52
csm, xrefs: 00007FF76D57506A

Memory Dump Source

Source File: 00000000.00000002.1415567108.00007FF76D571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF76D570000, based on PE: true

Associated: 00000000.00000002.1415551620.00007FF76D570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D58C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D592000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415612652.00007FF76D593000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415625778.00007FF76D594000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d570000_SecuriteInfo.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 78f3bdf085cd92ad20dc991ed7b11ee6dea2a72f9a24a56b215421e1564ee266
Instruction ID: 9a1c1d1acc55ef3a0bbeece8b6250cba09c5028d13e0f48326e975a2f54f0778
Opcode Fuzzy Hash: 78f3bdf085cd92ad20dc991ed7b11ee6dea2a72f9a24a56b215421e1564ee266
Instruction Fuzzy Hash: 6F51AF3292C242CAEB64AF119054378B794FB54B95FA84135DE9C47F86EF3CE651C710

Function 00007FF76D574B58 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL ref: 00007FF76D574BB7
_CallSETranslator.LIBVCRUNTIME ref: 00007FF76D574C03

Strings

MOC, xrefs: 00007FF76D574BCB
RCC, xrefs: 00007FF76D574BD3

Memory Dump Source

Source File: 00000000.00000002.1415567108.00007FF76D571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF76D570000, based on PE: true

Associated: 00000000.00000002.1415551620.00007FF76D570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D58C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D592000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415612652.00007FF76D593000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415625778.00007FF76D594000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d570000_SecuriteInfo.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 582590e0508bbd1300525430ea8ab693eb7a7b7207769477c28eb59a10e6996e
Instruction ID: f0ee57938e4c92dcb0680d35550b6930cae7fad79134844dcc95b343891b8a0c
Opcode Fuzzy Hash: 582590e0508bbd1300525430ea8ab693eb7a7b7207769477c28eb59a10e6996e
Instruction Fuzzy Hash: 39617E3291CB85C6E760AB15E4407AAB7A4FB88794F544235EF9C07B56EF7CD290CB10

Function 00007FF76D57D540 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF76D57D5BF
WriteFile.KERNEL32 ref: 00007FF76D57D887
WriteFile.KERNEL32 ref: 00007FF76D57D8CD
GetLastError.KERNEL32 ref: 00007FF76D57D983

Memory Dump Source

Source File: 00000000.00000002.1415567108.00007FF76D571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF76D570000, based on PE: true

Associated: 00000000.00000002.1415551620.00007FF76D570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D58C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D592000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415612652.00007FF76D593000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415625778.00007FF76D594000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d570000_SecuriteInfo.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: d3fb5c5a4305f20a5b910567b94ca3d6b86f08d4eb07c482a73a96056ee82046
Instruction ID: bedf0fc5214b52f3127d968bd5c0a93ac3400c7181e3fd861bef6e07f8e746f2
Opcode Fuzzy Hash: d3fb5c5a4305f20a5b910567b94ca3d6b86f08d4eb07c482a73a96056ee82046
Instruction Fuzzy Hash: 6FD1D132B2CA41C9E711DF65D4402ECB7B1FB85B98BA44236CE5D97B9AEE38D506C310

Function 00007FF76D57DE68 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 00007FF76D57DF84
GetLastError.KERNEL32 ref: 00007FF76D57E00F

Memory Dump Source

Source File: 00000000.00000002.1415567108.00007FF76D571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF76D570000, based on PE: true

Associated: 00000000.00000002.1415551620.00007FF76D570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D58C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D592000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415612652.00007FF76D593000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415625778.00007FF76D594000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d570000_SecuriteInfo.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 197305ce307c94d7c752f16767a557a4ae6d33c22abbc4c6e91266b11f46d5a1
Instruction ID: 333686606c2addd5ad867be2b9808fd5372e0977c0fa75e1a4b1fb3d6ca8e7f3
Opcode Fuzzy Hash: 197305ce307c94d7c752f16767a557a4ae6d33c22abbc4c6e91266b11f46d5a1
Instruction Fuzzy Hash: EC91C972F2C752C5F750AF6584806BDABA0BB45788FA44139DE0E97E86EE3CD542C720

Function 00007FF76D57DBD8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF76D57DCEF
GetLastError.KERNEL32 ref: 00007FF76D57DD11

Strings

U, xrefs: 00007FF76D57DC9B

Memory Dump Source

Source File: 00000000.00000002.1415567108.00007FF76D571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF76D570000, based on PE: true

Associated: 00000000.00000002.1415551620.00007FF76D570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D58C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D592000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415612652.00007FF76D593000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415625778.00007FF76D594000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d570000_SecuriteInfo.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 6d23fd177495eb1cf3c6af8b1d658aefedd24363c73960ae3563ba64990bfd83
Instruction ID: 5d82cea5d21a87a370727eba4493578b0f1b78dfb12c6aa6c5f7b93067612b97
Opcode Fuzzy Hash: 6d23fd177495eb1cf3c6af8b1d658aefedd24363c73960ae3563ba64990bfd83
Instruction Fuzzy Hash: DD41C522B2CA81C1DB20EF25E4447A9A7A5FB88784FA14032EE4D87B59FF7CD501C760

Function 00007FF76D573D54 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF76D573DA4
RaiseException.KERNEL32 ref: 00007FF76D573DE5

Strings

csm, xrefs: 00007FF76D573DD2

Memory Dump Source

Source File: 00000000.00000002.1415567108.00007FF76D571000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF76D570000, based on PE: true

Associated: 00000000.00000002.1415551620.00007FF76D570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D58C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415567108.00007FF76D592000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415612652.00007FF76D593000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1415625778.00007FF76D594000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d570000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 4316c429adb968347ab1774c5765e22e2dafea5f83a08b0f330515f8cecce910
Instruction ID: 65a27bc0eca43366682c45391795a412058c1a312d50facb50c4dd56bffb57de
Opcode Fuzzy Hash: 4316c429adb968347ab1774c5765e22e2dafea5f83a08b0f330515f8cecce910
Instruction Fuzzy Hash: EA115B3662CB81C2EB609F15F400269B7E0FB88B94FA84230DE9D07B59EF3DC5558B00

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_dc444aea7037bbc0cbafead427273f931b99d060_e02d979f_dca1e886-1d26-4919-a40e-4d7a4551cc84\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6D9A.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6E27.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6E48.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

UDP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Windows Analysis Report
SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe

Function 00007FF76D571290 Relevance: 56.7, APIs: 8, Strings: 24, Instructions: 707
sleepCOMMON

Function 00007FF76D5727DC Relevance: 3.1, APIs: 2, Instructions: 98
COMMON

Function 00007FF76D572FB4 Relevance: 10.6, APIs: 7, Instructions: 71
COMMON

Function 00007FF76D576964 Relevance: 9.1, APIs: 6, Instructions: 83
COMMONLIBRARYCODE

Function 00007FF76D574688 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310
COMMON

Function 00007FF76D57B490 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Function 00007FF76D5758FC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88
libraryloaderCOMMONLIBRARYCODE

Function 00007FF76D578700 Relevance: 10.6, APIs: 7, Instructions: 62
COMMONLIBRARYCODE

Function 00007FF76D57EF9C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
fileCOMMON

Function 00007FF76D578878 Relevance: 9.1, APIs: 6, Instructions: 57
COMMONLIBRARYCODE

Function 00007FF76D5711C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44
processsynchronizationCOMMON

Function 00007FF76D575E84 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27
libraryloaderCOMMON

Function 00007FF76D57F2EC Relevance: 7.6, APIs: 5, Instructions: 56
COMMONLIBRARYCODE

Function 00007FF76D578940 Relevance: 7.6, APIs: 5, Instructions: 54
COMMONLIBRARYCODE

Function 00007FF76D5787D4 Relevance: 7.6, APIs: 5, Instructions: 50
COMMON