Edit tour

Windows Analysis Report
http://jeevankiranfoundationcenter.co.in/css/rrp.htm

Overview

General Information

Sample URL:	http://jeevankiranfoundationcenter.co.in/css/rrp.htm
Analysis ID:	1522426
Infos:

Detection

Kutaki

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Yara detected Kutaki Keylogger

Downloads suspicious files via Chrome

Drops PE files to the startup folder

Machine Learning detection for dropped file

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected non-DNS traffic on DNS port

Drops PE files

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4432 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2872 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1940,i,4945317571024713380,2874552796453635385,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

unarchiver.exe (PID: 6492 cmdline: "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\Tax Payment Challan.zip" MD5: 16FF3CC6CC330A08EED70CBC1D35F5D2)

7za.exe (PID: 6584 cmdline: "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\e3mjp5er.s51" "C:\Users\user\Downloads\Tax Payment Challan.zip" MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 6596 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6672 cmdline: "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5868 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Tax Payment Challan.exe (PID: 6728 cmdline: "C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe" MD5: D251E27F5A696A3CE1068F768EF7CF15)

cmd.exe (PID: 6460 cmdline: cmd.exe /c C:\Users\user\AppData\Local\Temp\NewBitmapImage.bmp MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6444 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

lfozupfk.exe (PID: 2688 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfozupfk.exe" MD5: D251E27F5A696A3CE1068F768EF7CF15)

chrome.exe (PID: 6356 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://jeevankiranfoundationcenter.co.in/css/rrp.htm" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

lfozupfk.exe (PID: 6456 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfozupfk.exe" MD5: D251E27F5A696A3CE1068F768EF7CF15)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Kutaki	Cofense characterizes Kutaki as a data stealer that uses old-school techniques to detect sandboxes and debugging. Kutaki however works quite well against unhardened virtual machines and other analysis devices. By backdooring a legitimate application, it can fool unsophisticated detection methodologies.	No Attribution	https://cofense.com/kutaki-malware-bypasses-gateways-steal-users-credentials/ https://sequretek.com/kutaki-stealer-analysis/	https://malpedia.caad.fkie.fraunhofer.de/details/win.kutaki

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	JoeSecurity_Kutaki	Yara detected Kutaki Keylogger	Joe Security
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfozupfk.exe	JoeSecurity_Kutaki	Yara detected Kutaki Keylogger	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000014.00000002.1930374581.0000000000401000.00000020.00000001.01000000.0000000A.sdmp	JoeSecurity_Kutaki	Yara detected Kutaki Keylogger	Joe Security
00000009.00000000.1802887221.0000000000401000.00000020.00000001.01000000.00000008.sdmp	JoeSecurity_Kutaki	Yara detected Kutaki Keylogger	Joe Security
0000000C.00000000.1812012344.0000000000401000.00000020.00000001.01000000.0000000A.sdmp	JoeSecurity_Kutaki	Yara detected Kutaki Keylogger	Joe Security
0000000C.00000002.2537005341.0000000000401000.00000020.00000001.01000000.0000000A.sdmp	JoeSecurity_Kutaki	Yara detected Kutaki Keylogger	Joe Security
00000014.00000000.1925593595.0000000000401000.00000020.00000001.01000000.0000000A.sdmp	JoeSecurity_Kutaki	Yara detected Kutaki Keylogger	Joe Security
00000009.00000002.1819845941.0000000000401000.00000020.00000001.01000000.00000008.sdmp	JoeSecurity_Kutaki	Yara detected Kutaki Keylogger	Joe Security
Process Memory Space: Tax Payment Challan.exe PID: 6728	JoeSecurity_Kutaki	Yara detected Kutaki Keylogger	Joe Security
Process Memory Space: lfozupfk.exe PID: 2688	JoeSecurity_Kutaki	Yara detected Kutaki Keylogger	Joe Security
Process Memory Space: lfozupfk.exe PID: 6456	JoeSecurity_Kutaki	Yara detected Kutaki Keylogger	Joe Security
Click to see the 4 entries

Sigma Signatures

System Summary

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe, ProcessId: 6728, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfozupfk.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfozupfk.exe	Avira: detection malicious, Label: TR/Dropper.Gen

Multi AV Scanner detection for domain / URL

Source: http://justwantlove.lol/wp-content/Tax%20Payment%20Challan.zip

Virustotal: Detection: 5%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	Virustotal: Detection: 40%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfozupfk.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfozupfk.exe	Virustotal: Detection: 40%	Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfozupfk.exe	Joe Sandbox ML: detected

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.162.32:443 -> 192.168.2.4:49744 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 30 Sep 2024 00:59:19 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, Keep-AliveLast-Modified: Sun, 29 Sep 2024 23:24:14 GMTAccept-Ranges: bytesVary: Accept-EncodingContent-Encoding: gzipContent-Length: 170Keep-Alive: timeout=5, max=75Content-Type: text/htmlData Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8e 4b 0a c2 30 14 45 e7 85 ee 21 04 1c a6 a9 82 50 ad 71 e2 06 1c b8 81 67 fb 24 95 34 a9 c9 eb cf d5 db 50 05 47 f7 c3 e5 72 d2 24 4d 4e 9a 5a 73 8e 8a 50 47 6d 91 80 69 a2 4e e0 ab 6f 06 c5 3d 3e 3c 06 cd 59 e5 2c a1 25 c5 f3 92 a5 49 ef 8d 8a b3 a3 94 cf 3e d0 08 96 8c 1b 30 33 ce c8 b1 13 df b1 bc c1 b4 d9 e5 57 98 db 25 2d ee a2 c1 18 b0 d9 bb e9 fe 1e 09 27 92 91 a4 64 95 06 1f 90 54 13 9c 28 8a fd 41 6c 79 c4 92 3f 3e 79 77 f5 bc 36 2b f9 07 31 48 9c 2e c6 00 00 00 Data Ascii: MK0E!Pqg$4PGr$MNZsPGmiNo=><Y,%I>03W%-'dT(Aly?>yw6+1H.
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 30 Sep 2024 00:59:20 GMTContent-Type: application/zipContent-Length: 935409Last-Modified: Sun, 29 Sep 2024 23:02:43 GMTConnection: keep-aliveETag: "66f9dc93-e45f1"Strict-Transport-Security: max-age=31536000Accept-Ranges: bytesData Raw: 50 4b 03 04 14 00 00 00 08 00 2b be 3d 59 e4 f5 37 26 61 45 0e 00 d2 b4 1b 00 17 00 00 00 54 61 78 20 50 61 79 6d 65 6e 74 20 43 68 61 6c 6c 61 6e 2e 65 78 65 ec 9a 67 54 55 d7 b6 c7 27 8a 58 b0 60 05 3b 60 6f a0 26 18 7b 0e 04 54 54 e2 2e 5c 11 51 44 08 1a 02 22 2c 45 03 6a 62 89 85 18 8c 1a b0 60 63 ef 73 d4 10 4b d4 e8 8d 25 51 c1 68 14 2b d6 58 63 b8 6a 2c d8 45 a3 51 79 ff 7d e6 e6 a2 f7 8d 37 de 18 ef d3 fb c0 1a e3 97 b9 ff 73 cd 3d d7 5a 73 ad b5 81 24 41 43 e7 53 79 22 72 04 c5 c5 44 db 89 9b 85 fe f7 b6 17 54 6f ba b3 3a 6d ad 7c d4 63 bb c3 c0 a3 1e c1 1f c7 8c 73 4f 10 63 47 8b 91 63 dc a3 46 c6 c7 8f 1d ef 1e 19 ed 2e 92 e2 dd 63 e2 dd fd 07 a9 ee 63 c6 7e 14 ed 55 ad 5a 95 e6 66 8e 23 27 62 e3 e7 6c ae d0 ab 04 e7 0d ce bd 52 61 ff d8 58 b5 d7 1e d8 91 1b 2b d9 b5 12 13 f5 b1 d1 ff 9f 73 90 02 88 06 3a 94 a7 83 53 fe 1a 55 e2 bb 4a 35 1c 9c 1d 9c 88 12 5c 89 3a 56 e0 38 19 ff 70 01 53 e1 33 56 e7 c2 da 58 77 39 62 6b 6f 9b 1a d9 fd 8b 32 1a d9 fd 76 e1 f2 a6 fd b7 b1 b7 f4 4f 5c a9 b5 f1 30 df 8d a6 d6 f9 77 96 ff 73 eb 88 41 dd 8d 07 17 ec 45 f9 ff 39 ce 6b 7c f4 a7 e3 61 5b 63 7c fb 84 12 5c df 9e 18 d9 f3 44 78 7d 34 72 fc 48 3c 6f aa e8 c0 6b 37 62 ec 35 28 6d 16 6c a5 97 18 27 a2 8c 2e 63 0d 58 0b b9 1b f6 bf c5 59 e2 2e 84 f5 77 79 c3 17 a4 0e f6 1b 1c d4 a5 a3 97 ff c0 81 54 d6 ca 5a 59 2b 6b 65 ad ac 95 b5 b2 56 d6 ca 5a 59 2b 6b 65 ed ff 6d db bd 2c 4b dc 9e 68 13 be 4b 6c e2 d1 04 ab a8 58 41 17 b3 be b1 8a e7 95 ad 62 94 ae 89 f7 a0 ef 7d 62 13 69 c2 26 fc 73 b3 44 a7 8f 6d a2 b8 07 f4 11 4d 1c f2 d2 c4 f8 b9 36 b1 ec 13 5d b4 a9 af 0b e7 44 5d bc 18 ac 8b 39 bb b3 44 24 e2 77 96 b3 8a dc 1a ba b8 84 31 7e 8a b2 89 7d ab 34 f1 63 82 2e 42 7e d1 c4 e4 06 ba f0 c5 18 8b 7f d4 44 56 92 2e 1c 26 e8 22 6f b9 26 1e 67 69 22 64 a9 4d fc 30 c2 26 26 20 6f bb 8f ac c2 11 31 dd f7 65 89 cf e3 74 31 1e 73 5a 07 7f 3c 72 fb 5c d4 c4 50 cc db d2 cd 26 22 f0 1c ba 25 4b bc ce 41 be 2b 9a 48 fa ca 26 be c0 38 15 8e 6a e2 c8 37 36 d1 af bf 2e 5c c2 ad a2 3b 74 f9 20 5d 3c c4 5c 3a e7 6b 62 45 20 c6 3e a5 09 a7 f2 56 51 09 63 3b 39 5a 45 0f bc f7 ec 6a 96 b8 76 3c 4b 04 8e b0 8a 71 d5 74 71 2c dc 26 3c 30 47 57 f4 cd 4c c4 9a 93 6c e2 5e ba 55 bc da ab 89 82 b1 ba e8 38 ce 26 76 4c d1 45 0e e6 ee 8d 35 ea f1 36 71 3b d2 2a da f6 b4 89 29 be 9a f8 1b 7d e3 51 87 ef 3e c7 3c 90 c3 77 b8 26 ae a0 56 8b 32 74 b1 f1 80 26 9e 2e b6 89 d5 21 ba a8 8d 75 fb 4a 9a a8 84 fa 64 6b 9a 78 95 95 2e 2a 1c d6 44 39 ac e9 d7 34 9b d8 92 61 13 2f 1c 74 f1 2e c6 9f 84 fe d6 c6 bb a8 a3 f2 a1 2e 5a 60 2f 46 a2 06 c7 b1 17 55 f6 69 62 19 f6 6e 38 6a 37 1b e3 3a a2 6e 31 c7 b2 44 ed ee 36 71 09 fd df 64 58 45 2a 72 1d 5c 84 f5 64 66 09 0b fc 8f e0 8f 98 60 13 bf f7 d5 c5

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /css/rrp.htm HTTP/1.1Host: jeevankiranfoundationcenter.co.inConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/Tax%20Payment%20Challan.zip HTTP/1.1Host: justwantlove.lolConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://jeevankiranfoundationcenter.co.in/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: jeevankiranfoundationcenter.co.inConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://jeevankiranfoundationcenter.co.in/css/rrp.htmAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: jeevankiranfoundationcenter.co.in
Source: global traffic	DNS traffic detected: DNS query: justwantlove.lol
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: 241.42.69.40.in-addr.arpa

Source: Amcache.hve.10.dr	String found in binary or memory: http://upx.sf.net
Source: lfozupfk.exe, 0000000C.00000002.2537897049.000000000082D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 64393 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64393
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443

Source: Yara match	File source: 00000014.00000002.1930374581.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.1802887221.0000000000401000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.1812012344.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2537005341.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000000.1925593595.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1819845941.0000000000401000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Tax Payment Challan.exe PID: 6728, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lfozupfk.exe PID: 2688, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lfozupfk.exe PID: 6456, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfozupfk.exe, type: DROPPED

Source: Tax Payment Challan.exe, 00000009.00000000.1802887221.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Tax Payment Challan.exe, 00000009.00000002.1819845941.0000000000401000.00000020.00000001.01000000.00000008.sdmp, lfozupfk.exe, 0000000C.00000002.2537005341.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, lfozupfk.exe, 0000000C.00000000.1812012344.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, lfozupfk.exe, 00000014.00000002.1930374581.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, lfozupfk.exe, 00000014.00000000.1925593595.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Tax Payment Challan.exe.5.dr, lfozupfk.exe.9.dr	Binary or memory string: W*\AC:\NEW LINK\NEW LINK UPDATE\132-Software Engineering\CVS.vbptem\Project1.vbpp@d@W
Source: Tax Payment Challan.exe, 00000009.00000002.1825785541.0000000000578000.00000004.00000001.01000000.00000008.sdmp, lfozupfk.exe, 0000000C.00000002.2537337329.0000000000578000.00000004.00000001.01000000.0000000A.sdmp, lfozupfk.exe, 00000014.00000002.1930536349.0000000000578000.00000004.00000001.01000000.0000000A.sdmp	Binary or memory string: B*\AC:\NEW LINK\NEW LINK UPDATE\132-Software Engineering\CVS.vbp

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfozupfk.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6596:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5868:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6444:120:WilError_03

Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	Section loaded: 7z.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	Section loaded: msvbvm60.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	Section loaded: vb6zz.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1940,i,4945317571024713380,2874552796453635385,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://jeevankiranfoundationcenter.co.in/css/rrp.htm"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\Tax Payment Challan.zip"
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\e3mjp5er.s51" "C:\Users\user\Downloads\Tax Payment Challan.zip"
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe "C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe"
Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c C:\Users\user\AppData\Local\Temp\NewBitmapImage.bmp
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfozupfk.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfozupfk.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfozupfk.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfozupfk.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1940,i,4945317571024713380,2874552796453635385,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\Tax Payment Challan.zip"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\e3mjp5er.s51" "C:\Users\user\Downloads\Tax Payment Challan.zip"	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe "C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c C:\Users\user\AppData\Local\Temp\NewBitmapImage.bmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfozupfk.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfozupfk.exe"	Jump to behavior

Source: lfozupfk.exe.9.dr	Static PE information: real checksum: 0x1c9596 should be: 0x1ca7da
Source: Tax Payment Challan.exe.5.dr	Static PE information: real checksum: 0x1c9596 should be: 0x1ca7da

Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfozupfk.exe			Jump to dropped file

Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfozupfk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfozupfk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfozupfk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfozupfk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfozupfk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfozupfk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfozupfk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfozupfk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: 980000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: 25F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: 45F0000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: Amcache.hve.10.dr	Binary or memory string: VMware
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.10.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.10.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.10.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.10.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.10.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.10.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.10.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.10.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.10.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.10.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Tax Payment Challan.exe, 00000009.00000003.1818156353.0000000000670000.00000004.00000020.00020000.00000000.sdmp, Tax Payment Challan.exe, 00000009.00000002.1826057850.0000000000672000.00000004.00000020.00020000.00000000.sdmp, Tax Payment Challan.exe, 00000009.00000003.1817405198.0000000000655000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.10.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.10.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.10.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.10.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.10.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.10.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.10.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.10.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.10.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.10.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.10.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.10.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.10.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.10.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.10.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: Amcache.hve.10.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: MsMpEng.exe

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	12 Registry Run Keys / Startup Folder	11 Process Injection	1 Masquerading	OS Credential Dumping	111 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	12 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	4 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	12 System Information Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfozupfk.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfozupfk.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	40%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe	45%	ReversingLabs	Win32.Trojan.Kutaki
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfozupfk.exe	45%	ReversingLabs	Win32.Trojan.Kutaki
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfozupfk.exe	40%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe
http://justwantlove.lol/wp-content/Tax%20Payment%20Challan.zip	5%	Virustotal		Browse

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://jeevankiranfoundationcenter.co.in/css/rrp.htm

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe

C:\Users\user\AppData\Local\Temp\unarchiver.log

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfozupfk.exe

C:\Users\user\Downloads\Tax Payment Challan.zip (copy)

C:\Users\user\Downloads\Tax Payment Challan.zip.crdownload

C:\Users\user\Downloads\b697d749-3067-430d-9943-bcf7d6e45fa5.tmp

C:\Windows\appcompat\Programs\Amcache.hve

Chrome Cache Entry: 53

Chrome Cache Entry: 54

Chrome Cache Entry: 55

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
http://jeevankiranfoundationcenter.co.in/css/rrp.htm

Name	IP	Active	Malicious	Reputation
justwantlove.lol	23.94.221.14	true	false	unknown
jeevankiranfoundationcenter.co.in	103.21.58.228	true	false	unknown
www.google.com	142.250.74.196	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
241.42.69.40.in-addr.arpa	unknown	unknown	false	unknown

Name	Malicious	Antivirus Detection	Reputation
http://justwantlove.lol/wp-content/Tax%20Payment%20Challan.zip	false	5%, Virustotal, Browse	unknown
http://jeevankiranfoundationcenter.co.in/favicon.ico	false		unknown
http://jeevankiranfoundationcenter.co.in/css/rrp.htm	false		unknown

IP	Domain	Country	ASN	ASN Name	Malicious
23.94.221.14	justwantlove.lol	United States	36352	AS-COLOCROSSINGUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
103.21.58.228	jeevankiranfoundationcenter.co.in	United Arab Emirates	394695	PUBLIC-DOMAIN-REGISTRYUS	false
142.250.185.132	unknown	United States	15169	GOOGLEUS	false
142.250.74.196	www.google.com	United States	15169	GOOGLEUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1522426
Start date and time:	2024-09-30 02:58:20 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://jeevankiranfoundationcenter.co.in/css/rrp.htm
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.adwa.spyw.win@35/13@8/6

Time	Type	Description
01:59:28	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfozupfk.exe
20:59:24	API Interceptor	1x Sleep call for process: Tax Payment Challan.exe modified
20:59:25	API Interceptor	11617x Sleep call for process: lfozupfk.exe modified

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1815762
Entropy (8bit):	7.00198689482094
Encrypted:	false
SSDEEP:	24576:Ln/8D3krldJvB9D9dP0rkPrkUBJfZiAxtkFnNrpThhNZOFxUVAntznfmP/UDMS0z:rkD3gTP990rQrkYJfMN03fmP/SA8NC
MD5:	D251E27F5A696A3CE1068F768EF7CF15
SHA1:	2D02063073B02E63CA8E6B585B03AA354A6BA3E8
SHA-256:	BF2509759DD5AA05817181435307F2ECBCA9A1006A53E6E884462BC81B46F820
SHA-512:	0290C3C9971FFAEC58FC48C1D6D7F8D50996A940412D05ECC35D0E288BBAA4756D14A2701ADD54A3B328BCDFB437FB6A848A2BEA2C3BCADA6F12D2C6B2E2D2A2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Kutaki, Description: Yara detected Kutaki Keylogger, Source: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 40%, Browse Antivirus: ReversingLabs, Detection: 45%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........kn...=...=...=...=...=..=...=a..=...=Rich...=................PE..L....}.f.................p...0......PQ............@..........................................................................j..(...........................................................................0... ....................................text...(j.......p.................. ..`.data...............................@....rsrc............ ..................@..@l.[J............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Windows\SysWOW64\unarchiver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1479
Entropy (8bit):	5.125797780831324
Encrypted:	false
SSDEEP:	24:bRqFu0fSniJyniJjWIyniJyniJUwsniJffniJyniJFTAFuniJb4niJTFuniJoVnN:bRquwSnGynGbynGynGpsnGHnGynGp4un
MD5:	9AAEFCEF03AFB8A8F2F63B0416D809D6
SHA1:	D18E957F22ABC1F869D07424637AB993ACFE5340
SHA-256:	677651AFF062F09F11D55D2C13A496B853C2DAE71B7F5FE164FAC036564F0E0F
SHA-512:	161B578FD5E3BDF530D0ED98AD2BD91610797CF1D5AE6754066C6F4134FC91A63D97386E6E07B768963B4C845908B724F76D0EA48D414B68227ECCAD1B5FBFCF
Malicious:	false
Reputation:	low
Preview:	09/29/2024 8:59 PM: Unpack: C:\Users\user\Downloads\Tax Payment Challan.zip..09/29/2024 8:59 PM: Tmp dir: C:\Users\user\AppData\Local\Temp\e3mjp5er.s51..09/29/2024 8:59 PM: Received from standard out: ..09/29/2024 8:59 PM: Received from standard out: 7-Zip 18.05 (x86) : Copyright (c) 1999-2018 Igor Pavlov : 2018-04-30..09/29/2024 8:59 PM: Received from standard out: ..09/29/2024 8:59 PM: Received from standard out: Scanning the drive for archives:..09/29/2024 8:59 PM: Received from standard out: 1 file, 935409 bytes (914 KiB)..09/29/2024 8:59 PM: Received from standard out: ..09/29/2024 8:59 PM: Received from standard out: Extracting archive: C:\Users\user\Downloads\Tax Payment Challan.zip..09/29/2024 8:59 PM: Received from standard out: --..09/29/2024 8:59 PM: Received from standard out: Path = C:\Users\user\Downloads\Tax Payment Challan.zip..09/29/2024 8:59 PM: Received from standard out: Type = zip..09/29/2024 8:59 PM: Received from standard out: Physical Size = 935409..09/29/20

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	935409
Entropy (8bit):	7.999054579462363
Encrypted:	true
SSDEEP:	24576:CYyL6TVzwf+rvw8CrkmHjVzYL2zChUR/R4L7RTCVJ3ojOB/GpMSQ8Can0:CnL+VKldZYLZL7RuVJ4jOB/iU890
MD5:	51EBC72E8526010B9FE3F4CC076D9E7A
SHA1:	5821F32DDCA1548791911CD3BD39B442D50FA0F0
SHA-256:	019F104014826438C6C9790C43CF82E47DD1A1F942B936FB28C64F10D6122C2C
SHA-512:	5C57B78D3DE9995DFDE8CFE2ADF678AE842B722720332DA44FDB9CE0C2C8B4959451DDC6BB77529E6EE542F08A632901F83DC3D8DE4B117E54494AC1F9AF4FF4
Malicious:	true
Reputation:	low
Preview:	PK........+.=Y..7&aE.........Tax Payment Challan.exe.gTU..'.X.`.;`o.&.{..TT..\.QD...",E.jb......`c.s..K..%Q.h.+.Xc.j,.E.Qy.}....7.........s.=.Zs...$AC.Sy"r...D.......To..:m.\|.c........sO.cG..c.F...........c......c.~..U.Z..f.#'b..l......Ra..X.....+........s....:...S..U.J5......\.:V.8..p.S.3V...Xw9bko.....2...v.......O\...0....w..s.A....E..9.k\|...a[c\|...\....Dx}4r.H<o...k7b.5(m.l...'...c.X......Y....wy.............T..ZY+ke.....V..ZY+ke..m.,K.h..Kl.....XA......b......}b.i.&.s.D..m.....M......6...].....D]....9..D$.w........1~...}.4.c..B~...........DV...&."o.&.gi"d.M.0.&& o.....1..e...t1.sZ..<r.\..P....&"...%K..A.+.H..&..8..j..76...\..;t. ]<.\:.kbE .>....VQ.c;9ZE....j..v<K....q.tq,.&<0GW..L..l.^.U.......8.&vL.E...5..6q;.....)....}.Q..>.<..w.&..V.2t..&.....!...u.J....dk.x.....D9...4..a./.t...........Z`/F....U.ib..n8j7..:.n1.D..6q...dXE*r.\..df.......`......)V.K.UX1..{.D".[~..T'..Z.a.gq...........c.S.i.6.6N.....P...N.......]]..TM.C.F.....4Q.....".O

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.462942634347709
Encrypted:	false
SSDEEP:	6144:PIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uN2dwBCswSbn:gXD94+WlLZMM6YFHg+n
MD5:	93D5AB9AF94545E5C473736B7C1A6E34
SHA1:	D21D2C92566A5D8D55A57805416DC0479A7A445E
SHA-256:	4392A6CE0B603F3B94C1DAAA81999551FFFDC548DAD3E4E8346466FC60C09305
SHA-512:	69B7A25910BDC89E342A4DE0A1624DA9AAA8CD070E306A71EF24032EDE83787027087E96593ED066D43B1398F82AEEDF52733F9D8A978E6F02763F0097E0E4D5
Malicious:	false
Reputation:	low
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmV.k.................................................................................................................................................................................................................................................................................................................................................#R\|.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 30, 2024 02:59:16.399744034 CEST	53	56953	1.1.1.1	192.168.2.4
Sep 30, 2024 02:59:16.416079044 CEST	53	57715	1.1.1.1	192.168.2.4
Sep 30, 2024 02:59:17.474288940 CEST	53	52404	1.1.1.1	192.168.2.4
Sep 30, 2024 02:59:18.216422081 CEST	58641	53	192.168.2.4	1.1.1.1
Sep 30, 2024 02:59:18.216686010 CEST	50757	53	192.168.2.4	1.1.1.1
Sep 30, 2024 02:59:18.730691910 CEST	53	58641	1.1.1.1	192.168.2.4
Sep 30, 2024 02:59:18.742103100 CEST	53	50757	1.1.1.1	192.168.2.4
Sep 30, 2024 02:59:19.936621904 CEST	54556	53	192.168.2.4	1.1.1.1
Sep 30, 2024 02:59:19.937225103 CEST	61316	53	192.168.2.4	1.1.1.1
Sep 30, 2024 02:59:19.947926998 CEST	53	54556	1.1.1.1	192.168.2.4
Sep 30, 2024 02:59:19.951091051 CEST	53	61316	1.1.1.1	192.168.2.4
Sep 30, 2024 02:59:21.131335020 CEST	54497	53	192.168.2.4	1.1.1.1
Sep 30, 2024 02:59:21.131695032 CEST	49704	53	192.168.2.4	1.1.1.1
Sep 30, 2024 02:59:21.138222933 CEST	53	54497	1.1.1.1	192.168.2.4
Sep 30, 2024 02:59:21.138235092 CEST	53	49704	1.1.1.1	192.168.2.4
Sep 30, 2024 02:59:33.310120106 CEST	138	138	192.168.2.4	192.168.2.255
Sep 30, 2024 02:59:34.721438885 CEST	53	59881	1.1.1.1	192.168.2.4
Sep 30, 2024 02:59:45.432491064 CEST	53	52863	162.159.36.2	192.168.2.4
Sep 30, 2024 02:59:45.960849047 CEST	54833	53	192.168.2.4	1.1.1.1
Sep 30, 2024 02:59:45.967824936 CEST	53	54833	1.1.1.1	192.168.2.4
Sep 30, 2024 03:00:21.129698992 CEST	58261	53	192.168.2.4	1.1.1.1
Sep 30, 2024 03:00:21.137229919 CEST	53	58261	1.1.1.1	192.168.2.4