Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1522707
MD5:	dcb556280972bcbd51ba0fa8ee7b6a46
SHA1:	152c09b925cb120c0fd646e0a3cbf2120c8e7ce6
SHA256:	2e96b64287a0b741837c9f8179e8e1596d0f854d66108b38e4b84cc71c02e6c3
Tags:	exeuser-jstrosch
Infos:

Detection

Gandcrab, ReflectiveLoader

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Gandcrab

Yara detected ReflectiveLoader

AI detected suspicious sample

Machine Learning detection for sample

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found large amount of non-executed APIs

One or more processes crash

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 6884 cmdline: "C:\Users\user\Desktop\file.exe" MD5: DCB556280972BCBD51BA0FA8EE7B6A46)

WerFault.exe (PID: 6436 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6884 -s 280 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Gandcrab	GandCrab was a Ransomware-as-a-Service (RaaS) emerged in January 28, 2018, managed by a criminal organization known to be confident and vocal, while running a rapidly evolving ransomware campaign. Through their aggressive, albeit unusual, marketing strategies and constant recruitment of affiliates, they were able to globally distribute a high volume of their malware.In a surprising announcement on May 31, 2019, the GandCrabs operators posted on a dark web forum, announced the end of a little more than a year of ransomware operations, citing staggering profit figures. However, If theres one thing that sets these threat actors apart from other groups, it is that they are unpredictable; so there is always the possibility that they might re-surface in one form or another.	Pinchy Spider	http://asec.ahnlab.com/1145 http://www.secureworks.com/research/threat-profiles/gold-garden http://www.vmray.com/cyber-security-blog/gandcrab-ransomware-evolution-analysis/ https://asec.ahnlab.com/en/41450/ https://blog.intel471.com/2020/03/31/revil-ransomware-as-a-service-an-analysis-of-a-ransomware-affiliate-operation/	https://malpedia.caad.fkie.fraunhofer.de/details/win.gandcrab

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
file.exe	JoeSecurity_ReflectiveLoader	Yara detected ReflectiveLoader	Joe Security
file.exe	JoeSecurity_Gandcrab	Yara detected Gandcrab	Joe Security
file.exe	Gandcrab	Gandcrab Payload	kevoreilly	0x1f2e8:$string3: action=result&e_files=%d&e_size=%I64u&e_time=%d&
file.exe	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x1fda1:$s1: _ReflectiveLoader@ 0x1fda2:$s2: ReflectiveLoader@

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.2310972685.0000000000352000.00000008.00000001.01000000.00000003.sdmp	JoeSecurity_ReflectiveLoader	Yara detected ReflectiveLoader	Joe Security
00000001.00000000.2280026514.0000000000351000.00000008.00000001.01000000.00000003.sdmp	JoeSecurity_ReflectiveLoader	Yara detected ReflectiveLoader	Joe Security
Process Memory Space: file.exe PID: 6884	JoeSecurity_ReflectiveLoader	Yara detected ReflectiveLoader	Joe Security
Process Memory Space: file.exe PID: 6884	JoeSecurity_Gandcrab	Yara detected Gandcrab	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.file.exe.3520c0.1.raw.unpack	JoeSecurity_ReflectiveLoader	Yara detected ReflectiveLoader	Joe Security
1.2.file.exe.3520c0.1.raw.unpack	Gandcrab	Gandcrab Payload	kevoreilly	0xee28:$string3: action=result&e_files=%d&e_size=%I64u&e_time=%d&
1.2.file.exe.3520c0.1.raw.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0xf8e1:$s1: _ReflectiveLoader@ 0xf8e2:$s2: ReflectiveLoader@
1.2.file.exe.3520c0.1.unpack	JoeSecurity_ReflectiveLoader	Yara detected ReflectiveLoader	Joe Security
1.2.file.exe.3520c0.1.unpack	Gandcrab	Gandcrab Payload	kevoreilly	0xe028:$string3: action=result&e_files=%d&e_size=%I64u&e_time=%d&
1.2.file.exe.3520c0.1.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0xeae1:$s1: _ReflectiveLoader@ 0xeae2:$s2: ReflectiveLoader@
1.0.file.exe.3520c0.1.unpack	JoeSecurity_ReflectiveLoader	Yara detected ReflectiveLoader	Joe Security
1.0.file.exe.3520c0.1.unpack	Gandcrab	Gandcrab Payload	kevoreilly	0xe028:$string3: action=result&e_files=%d&e_size=%I64u&e_time=%d&
1.0.file.exe.3520c0.1.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0xeae1:$s1: _ReflectiveLoader@ 0xeae2:$s2: ReflectiveLoader@
1.0.file.exe.3520c0.1.raw.unpack	JoeSecurity_ReflectiveLoader	Yara detected ReflectiveLoader	Joe Security
1.0.file.exe.3520c0.1.raw.unpack	Gandcrab	Gandcrab Payload	kevoreilly	0xee28:$string3: action=result&e_files=%d&e_size=%I64u&e_time=%d&
1.0.file.exe.3520c0.1.raw.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0xf8e1:$s1: _ReflectiveLoader@ 0xf8e2:$s2: ReflectiveLoader@
1.2.file.exe.340000.0.unpack	JoeSecurity_ReflectiveLoader	Yara detected ReflectiveLoader	Joe Security
1.2.file.exe.340000.0.unpack	Gandcrab	Gandcrab Payload	kevoreilly	0x1f2e8:$string3: action=result&e_files=%d&e_size=%I64u&e_time=%d&
1.2.file.exe.340000.0.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x1fda1:$s1: _ReflectiveLoader@ 0x1fda2:$s2: ReflectiveLoader@
1.0.file.exe.340000.0.unpack	JoeSecurity_ReflectiveLoader	Yara detected ReflectiveLoader	Joe Security
1.0.file.exe.340000.0.unpack	Gandcrab	Gandcrab Payload	kevoreilly	0x1f2e8:$string3: action=result&e_files=%d&e_size=%I64u&e_time=%d&
1.0.file.exe.340000.0.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x1fda1:$s1: _ReflectiveLoader@ 0x1fda2:$s2: ReflectiveLoader@
Click to see the 13 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 92%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Amcache.hve.4.dr

String found in binary or memory: http://upx.sf.net

Spam, unwanted Advertisements and Ransom Demands

Yara detected Gandcrab

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: Process Memory Space: file.exe PID: 6884, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: file.exe, type: SAMPLE	Matched rule: Gandcrab Payload Author: kevoreilly
Source: file.exe, type: SAMPLE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 1.2.file.exe.3520c0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Gandcrab Payload Author: kevoreilly
Source: 1.2.file.exe.3520c0.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 1.2.file.exe.3520c0.1.unpack, type: UNPACKEDPE	Matched rule: Gandcrab Payload Author: kevoreilly
Source: 1.2.file.exe.3520c0.1.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 1.0.file.exe.3520c0.1.unpack, type: UNPACKEDPE	Matched rule: Gandcrab Payload Author: kevoreilly
Source: 1.0.file.exe.3520c0.1.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 1.0.file.exe.3520c0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Gandcrab Payload Author: kevoreilly
Source: 1.0.file.exe.3520c0.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 1.2.file.exe.340000.0.unpack, type: UNPACKEDPE	Matched rule: Gandcrab Payload Author: kevoreilly
Source: 1.2.file.exe.340000.0.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 1.0.file.exe.340000.0.unpack, type: UNPACKEDPE	Matched rule: Gandcrab Payload Author: kevoreilly
Source: 1.0.file.exe.340000.0.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00349831	1_2_00349831
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00348052	1_2_00348052
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00347AE0	1_2_00347AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0034693C	1_2_0034693C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0034A79D	1_2_0034A79D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00341D9B	1_2_00341D9B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_003485C4	1_2_003485C4

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6884 -s 280

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe, type: SAMPLE	Matched rule: Gandcrab author = kevoreilly, description = Gandcrab Payload, cape_type = Gandcrab Payload
Source: file.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 1.2.file.exe.3520c0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Gandcrab author = kevoreilly, description = Gandcrab Payload, cape_type = Gandcrab Payload
Source: 1.2.file.exe.3520c0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 1.2.file.exe.3520c0.1.unpack, type: UNPACKEDPE	Matched rule: Gandcrab author = kevoreilly, description = Gandcrab Payload, cape_type = Gandcrab Payload
Source: 1.2.file.exe.3520c0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 1.0.file.exe.3520c0.1.unpack, type: UNPACKEDPE	Matched rule: Gandcrab author = kevoreilly, description = Gandcrab Payload, cape_type = Gandcrab Payload
Source: 1.0.file.exe.3520c0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 1.0.file.exe.3520c0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Gandcrab author = kevoreilly, description = Gandcrab Payload, cape_type = Gandcrab Payload
Source: 1.0.file.exe.3520c0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 1.2.file.exe.340000.0.unpack, type: UNPACKEDPE	Matched rule: Gandcrab author = kevoreilly, description = Gandcrab Payload, cape_type = Gandcrab Payload
Source: 1.2.file.exe.340000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 1.0.file.exe.340000.0.unpack, type: UNPACKEDPE	Matched rule: Gandcrab author = kevoreilly, description = Gandcrab Payload, cape_type = Gandcrab Payload
Source: 1.0.file.exe.340000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts

Source: classification engine

Classification label: mal88.rans.evad.winEXE@2/5@0/0

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6884

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\ec361043-d9a8-4f3e-b23d-ce934839d82b

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Command line argument: >C4

1_2_00344290

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 92%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6884 -s 280

Source: C:\Users\user\Desktop\file.exe

Section loaded: apphelp.dll

Jump to behavior

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected ReflectiveLoader

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 1.2.file.exe.3520c0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.file.exe.3520c0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.file.exe.3520c0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.file.exe.3520c0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.file.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.file.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2310972685.0000000000352000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.2280026514.0000000000351000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6884, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00342975 push ecx; ret

1_2_00342988

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00341D9B EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00341D9B

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

API coverage: 1.2 %

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\file.exe

API call chain: ExitProcess graph end node

graph_1-5271

Source: C:\Users\user\Desktop\file.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_0034330E __mtinitlocknum,LdrInitializeThunk,

1_2_0034330E

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00344070 _memset,IsDebuggerPresent,

1_2_00344070

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00344D5A EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

1_2_00344D5A

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00341F80 GetProcessHeap,

1_2_00341F80

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_003432F8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		1_2_003432F8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_003432C7 SetUnhandledExceptionFilter,		1_2_003432C7

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00342C5C cpuid

1_2_00342C5C

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_003427C0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

1_2_003427C0

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	51 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	12 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	92%	ReversingLabs	Win32.Ransomware.GandCrab
file.exe	100%	Avira	HEUR/AGEN.1317528
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.4.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1522707
Start date and time:	2024-09-30 15:47:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal88.rans.evad.winEXE@2/5@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 1 Number of non-executed functions: 11
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.89.179.12
Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, g.bing.com, umwatson.events.data.microsoft.com, onedsblobprdcus17.centralus.cloudapp.azure.com, arc.msn.com, fe3cr.delivery.mp.microsoft.com
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
09:48:20	API Interceptor	1x Sleep call for process: WerFault.exe modified

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4fbe18952d61b9ae40bb3841a1ba97fc25a62c_f84a56e5_99b26695-cd85-4ab3-90ba-f16152b8840b\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6761429324392154
Encrypted:	false
SSDEEP:	192:+/RbXvYPA0BU/b03juqzuiFYZ24IO8ThB:aYTBU/wj7zuiFYY4IO8L
MD5:	692FBCA37E235E884BD5E16108FB14F1
SHA1:	9EF40A67701C76616F07542E338100FA76476C4D
SHA-256:	5E6BCB2374BCD2E1A197ABE4DE213B14A85B7406D6392DC2411E0B60595BB133
SHA-512:	9537547AE1DF45FA8F40EE63D4ACD76D7E5224AC9218126A21F644577A40E1119370DB42E7D0751AB09EC0BCB8E78B49C2271ACAF2B4BCDEC72D8B6172360EF4
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.1.7.7.6.9.8.1.7.1.8.1.6.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.1.7.7.6.9.8.5.9.3.6.9.5.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.9.b.2.6.6.9.5.-.c.d.8.5.-.4.a.b.3.-.9.0.b.a.-.f.1.6.1.5.2.b.8.8.4.0.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.c.2.2.9.4.b.e.-.2.1.d.8.-.4.d.f.d.-.8.d.b.c.-.1.5.f.9.d.9.6.b.5.b.2.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.e.4.-.0.0.0.1.-.0.0.1.5.-.9.1.0.7.-.7.7.6.7.3.f.1.3.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.e.4.9.2.d.7.6.8.e.7.9.7.3.1.6.2.4.b.c.d.f.2.e.7.6.1.5.f.9.1.8.0.0.0.0.f.f.f.f.!.0.0.0.0.1.5.2.c.0.9.b.9.2.5.c.b.1.2.0.c.0.f.d.6.4.6.e.0.a.3.c.b.f.2.1.2.0.c.8.e.7.c.e.6.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.1.8././.0.4.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER69C1.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Sep 30 13:48:18 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	41372
Entropy (8bit):	1.6426375316816377
Encrypted:	false
SSDEEP:	192:EKLA8JYp8HtOaBpz6aRngrW6qQsgDcFcJ:88A5mng3Rcm
MD5:	34ED12D8DE0669085A52353CE080B0D4
SHA1:	D055A0C9CE4666BD16A343FFA601EFF47A60797B
SHA-256:	196EE366812E1F383BBDC89F5B9B179D76B26CE9A7D50BB705A48E02805B48B5
SHA-512:	943C8D9D883177FAA9B971E1622F81FC4A3A1E344322A6885429B2BBF07E5618BE1F5CEAF2CFEB1BEC8FA58E90415C4CC724F820F63C1F553DC4CC88B4235BE0
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ......."..f........................................<...........T.......8...........T...........................L...........8...............................................................................eJ..............GenuineIntel............T...........!..f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6A3F.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8270
Entropy (8bit):	3.689866710440127
Encrypted:	false
SSDEEP:	192:R6l7wVeJ+Cd6U6Y2DLSUOGLgmfBUJjnprP89bDusfuBm:R6lXJX6U6YGSUOGLgmf+JjKDtfp
MD5:	72DC839581A05E1072EFBB63B593EDA7
SHA1:	A0F351943DAACE9596F6B1C0021BF2CF331D696D
SHA-256:	45841A9024376839E3FA52ADE054C7A70DCBD25A966FC6C8C1ABC60B4BA5E89C
SHA-512:	40466BE9651BD6B1509A3DBF08CFE0FFB2A5B2E1FC0FA078A51CD11AA24084708450FCD6F4EBD0F8F472850E5162B1AB179EF1B277554FD97FCB6579E48114AB
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.8.8.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6A6F.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4555
Entropy (8bit):	4.428483558745421
Encrypted:	false
SSDEEP:	48:cvIwWl8zsPJg77aI9n8WpW8VYRYm8M4Jz8Fco+q83fR8uPXWd:uIjfxI7B17VBJ7oq7PXWd
MD5:	FC71BB530CA7A92D8D52B2142F24FA2A
SHA1:	D79F4C36BEA1298A48BAFABFFB49413DE0218E2F
SHA-256:	CBAD787DB221A55D0FF14C9C5410868BFCAB73B3570AFD5BDF85275F99525CCB
SHA-512:	CE730F0A54F3B54400F24B17BCB2897431423E6452989B179C2D9E7EF0BE67EF990CD9BEB48C6D2FD399446DC41B17B4AF059045F0DEBF6CBC76CE906A06C931
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="523010" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.468411858057873
Encrypted:	false
SSDEEP:	6144:szZfpi6ceLPx9skLmb0fuZWSP3aJG8nAgeiJRMMhA2zX4WABluuNbjDH5S:SZHtuZWOKnMM6bFp9j4
MD5:	2021284BD4C262F8503FA1583E39D7AB
SHA1:	F7D3BE50344BB31E6B6C4C8F751559113A57F1F8
SHA-256:	5193B641540181732EC19797A547FEF74E172C33B74A8C8AEB7F6024EFED0CB4
SHA-512:	7ABE6AC5579A8F8D512E229CD237E60673F07567FB1B3C43100204F7DBEC21049CFF4A90696411C387859AC7D31027FEC8EB195E0298D19CDC7207761F23F32C
Malicious:	false
Reputation:	low
Preview:	regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.g.g?...............................................................................................................................................................................................................................................................................................................................................S..S........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.446354373550859
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	146'432 bytes
MD5:	dcb556280972bcbd51ba0fa8ee7b6a46
SHA1:	152c09b925cb120c0fd646e0a3cbf2120c8e7ce6
SHA256:	2e96b64287a0b741837c9f8179e8e1596d0f854d66108b38e4b84cc71c02e6c3
SHA512:	026024db8d9068c405b673aa185a9a891eed834ca17dc0e890600fe20e046b6b1b76d193b60487a4d785b19bff4741d63f3d480803a92859e09e58be9be2bb3e
SSDEEP:	3072:o+HcL2ICfNTntqSQRruiMZMqqDL2/Awvdr7Vjp9:h1DtORruiMyqqDL6tvdRp9
TLSH:	5DE37B1B72D190B2F0F30675E9B4AD21092F3D202F949EEB26E655ED1D210F1AD3AB53
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~...............ND......Nz......NE......g6..............MA......M{.....Rich............PE..L...^..Z...........................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x401548
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5ACFC45E [Thu Apr 12 20:41:02 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	4b0a5cb1aa0992ea9901768198fd3e7e

Entrypoint Preview

Instruction
call 00007F4BBC8137F8h
jmp 00007F4BBC812400h
cmp ecx, dword ptr [00411050h]
jne 00007F4BBC812584h
rep ret
jmp 00007F4BBC813B85h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov ecx, dword ptr [esp+08h]
mov eax, dword ptr [esp+04h]
push edi
push ebx
push esi
cmp dword ptr [00425460h], 01h
jc 00007F4BBC812754h
ja 00007F4BBC812683h
movzx edx, byte ptr [ecx]
mov ebx, edx
shl edx, 08h
or edx, ebx
je 00007F4BBC81266Fh
movd xmm3, edx
pshuflw xmm3, xmm3, 00h
movlhps xmm3, xmm3
pxor xmm0, xmm0
mov esi, ecx
or edi, FFFFFFFFh
movzx ebx, byte ptr [ecx]
add ecx, 01h
test ebx, ebx
je 00007F4BBC81259Fh
test ecx, 0000000Fh
jne 00007F4BBC812570h
movdqa xmm2, dqword ptr [ecx]
pcmpeqb xmm2, xmm0
pmovmskb ebx, xmm2
test ebx, ebx
jne 00007F4BBC812587h
mov edi, 0000000Fh
movd edx, xmm3
mov ebx, 00000FFFh
and ebx, eax
cmp ebx, 00000FF0h
jnbe 00007F4BBC8125A9h
movdqu xmm1, dqword ptr [eax]
pxor xmm2, xmm2
pcmpeqb xmm2, xmm1
pcmpeqb xmm1, xmm3
por xmm1, xmm2
pmovmskb ebx, xmm1
add eax, 10h
test ebx, ebx
je 00007F4BBC812554h
bsf ebx, ebx

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729
[LNK] VS2013 build 21005

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x10044	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x27000	0xcc4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xfce8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc000	0x114	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xa636	0xa800	5c29e900a781b9d86e5b9ec3fd48a242	False	0.5902390252976191	data	6.684915855353336	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xc000	0x467e	0x4800	902455cb5d03cf09ed5a649ca52d5a34	False	0.3879665798611111	data	4.5720862205325465	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x11000	0x15724	0x13a00	74bd8911a6d9febcbe78ce92c1ea0bbf	False	0.46954617834394907	data	6.401183667445254	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x27000	0xcc4	0xe00	941233e7b15967ef37c2fc67184d8917	False	0.7600446428571429	data	6.265825312774808	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	VirtualProtect, ExitProcess, OpenProcess, Sleep, GetFileAttributesW, GetModuleFileNameW, CreateFileW, ExitThread, lstrlenW, GetLastError, GetProcAddress, CloseHandle, SetFilePointerEx, SetStdHandle, GetConsoleMode, GetConsoleCP, FlushFileBuffers, GetCommandLineA, SetLastError, GetCurrentThreadId, EncodePointer, DecodePointer, GetModuleHandleExW, MultiByteToWideChar, WideCharToMultiByte, GetProcessHeap, GetStdHandle, GetFileType, DeleteCriticalSection, GetStartupInfoW, GetModuleFileNameA, WriteFile, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, FreeEnvironmentStringsW, IsDebuggerPresent, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, InitializeCriticalSectionAndSpinCount, GetCurrentProcess, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetModuleHandleW, EnterCriticalSection, LeaveCriticalSection, HeapFree, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, LoadLibraryExW, OutputDebugStringW, HeapAlloc, HeapReAlloc, GetStringTypeW, HeapSize, LCMapStringW, WriteConsoleW
USER32.dll	MessageBoxW
ntdll.dll	RtlUnwind

Network Behavior

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 30, 2024 15:48:37.790086985 CEST	53	59313	1.1.1.1	192.168.2.6

Target ID:	1
Start time:	09:48:17
Start date:	30/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x340000
File size:	146'432 bytes
MD5 hash:	DCB556280972BCBD51BA0FA8EE7B6A46
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_ReflectiveLoader, Description: Yara detected ReflectiveLoader, Source: 00000001.00000002.2310972685.0000000000352000.00000008.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_ReflectiveLoader, Description: Yara detected ReflectiveLoader, Source: 00000001.00000000.2280026514.0000000000351000.00000008.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:48:18
Start date:	30/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6884 -s 280
Imagebase:	0x8d0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.9%
Total number of Nodes:	1491
Total number of Limit Nodes:	1

Executed Functions

Function 003413CD Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fast_error_exit.LIBCMT ref: 00341434
_fast_error_exit.LIBCMT ref: 00341445
__RTC_Initialize.LIBCMT ref: 0034144B
__ioinit.LIBCMT ref: 00341454
_fast_error_exit.LIBCMT ref: 0034145F
GetCommandLineA.KERNEL32(0034FD70,00000014), ref: 00341465
___crtGetEnvironmentStringsA.LIBCMT ref: 00341470
__setargv.LIBCMT ref: 0034147A
__setenvp.LIBCMT ref: 0034148B
__cinit.LIBCMT ref: 0034149E

Strings

.$, xrefs: 00341414

Memory Dump Source

Source File: 00000001.00000002.2310919959.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000001.00000002.2310905336.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310937303.000000000034C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310957115.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310972685.0000000000352000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310993708.0000000000364000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2311010690.0000000000367000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_340000_file.jbxd

Yara matches

Similarity

API ID: _fast_error_exit$CommandEnvironmentInitializeLineStrings___crt__cinit__ioinit__setargv__setenvp
String ID: .$
API String ID: 3919536372-2223841709
Opcode ID: ea5ee0f50b77f23cbe7c5a7265dedd557f3c0ff846e2624e76e82db4c8c4e736
Instruction ID: ac0812978959ab0e09315f75788122f777e0ebf34f352dbfc7711cc534b70a6f
Opcode Fuzzy Hash: ea5ee0f50b77f23cbe7c5a7265dedd557f3c0ff846e2624e76e82db4c8c4e736
Instruction Fuzzy Hash: 0A21F730A40B009EDB137BF1AD8276D32E8AF01344F118429F5049F2D3EBB5B9C08B55

Non-executed Functions

Function 003432F8 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,0034416E,?,?,?,00000000), ref: 003432FD
UnhandledExceptionFilter.KERNEL32(?,?,?,00000000), ref: 00343306

Memory Dump Source

Source File: 00000001.00000002.2310919959.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000001.00000002.2310905336.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310937303.000000000034C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310957115.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310972685.0000000000352000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310993708.0000000000364000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2311010690.0000000000367000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_340000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: bee3bffc2677855d0a1e9b11e8fa69ecc55e4a97ed40d0e517d80af54d3f46d9
Instruction ID: 0f44e0a0d6790cea6b35e77288a9e190426cc281f2d87554c0da7060731a311d
Opcode Fuzzy Hash: bee3bffc2677855d0a1e9b11e8fa69ecc55e4a97ed40d0e517d80af54d3f46d9
Instruction Fuzzy Hash: 61B0923506520CEBCB822BA1EC09B58BF2CEB06756F405010F60E480618F72A4108AA1

Function 003432C7 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?,?,0034181E,003417D3), ref: 003432CD

Memory Dump Source

Source File: 00000001.00000002.2310919959.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000001.00000002.2310905336.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310937303.000000000034C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310957115.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310972685.0000000000352000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310993708.0000000000364000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2311010690.0000000000367000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_340000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 29bb4036d9b6f1ab41e81f8ddf84ef98399f0a8d2c0c56620ccf1e1817b684be
Instruction ID: a16bb69f4bbf264b837a1770c3fbb71b2373116d37cc4d8f534ee738327db76d
Opcode Fuzzy Hash: 29bb4036d9b6f1ab41e81f8ddf84ef98399f0a8d2c0c56620ccf1e1817b684be
Instruction Fuzzy Hash: 3AA0113000020CEB8F022B82EC088883F2CEA022A8B800020F80E080208B23A8208A80

Function 00341F80 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(0034142E,0034FD70,00000014), ref: 00341F80

Memory Dump Source

Source File: 00000001.00000002.2310919959.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000001.00000002.2310905336.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310937303.000000000034C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310957115.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310972685.0000000000352000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310993708.0000000000364000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2311010690.0000000000367000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_340000_file.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 2506b704b4c81faf452e7e268c6953db6d1c90930d1276bff2b8d91aec17e6bb
Instruction ID: 569beeb139baba7ce6e511a17ccfd7bba2427f9a94ea5feab8868da6b413943a
Opcode Fuzzy Hash: 2506b704b4c81faf452e7e268c6953db6d1c90930d1276bff2b8d91aec17e6bb
Instruction Fuzzy Hash: 88B012B070230387474A4F797C1410935DC6708301700807DB003C6170DF20C4109F00

Function 00341220 Relevance: 49.1, APIs: 7, Strings: 21, Instructions: 97
stringwindowthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNEL32(?), ref: 003412BC
lstrlenW.KERNEL32(003A0043,0034FCE0,00000040), ref: 003412D2
MessageBoxW.USER32(00000000,?), ref: 003412DF
OpenProcess.KERNEL32(00000000,00000000,00000000), ref: 00341338
GetLastError.KERNEL32 ref: 0034133E
ExitProcess.KERNEL32(00000000), ref: 0034134B
ExitThread.KERNEL32 ref: 003413C6

Strings

a, xrefs: 00341245
, xrefs: 00341292
C, xrefs: 00341236
\, xrefs: 0034123E
H, xrefs: 0034127D
r, xrefs: 00341253
, xrefs: 003412AE
b, xrefs: 0034125A
c, xrefs: 003412A0
l, xrefs: 00341284
a, xrefs: 00341299
l, xrefs: 003412A7
o, xrefs: 0034128B
A, xrefs: 0034126F
), xrefs: 003412B5
s, xrefs: 00341268
t, xrefs: 00341261
@3#v, xrefs: 003412BC
s, xrefs: 00341276
w, xrefs: 0034124C
", xrefs: 003412F9

Memory Dump Source

Source File: 00000001.00000002.2310919959.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000001.00000002.2310905336.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310937303.000000000034C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310957115.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310972685.0000000000352000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310993708.0000000000364000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2311010690.0000000000367000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_340000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$AttributesErrorFileLastMessageOpenThreadlstrlen
String ID: $ $"$)$@3#v$A$C$H$\$a$a$b$c$l$l$o$r$s$s$t$w
API String ID: 3477480091-3518619610
Opcode ID: ef9708b68583c2915b20da6bf324e731a323ac851983d13dacd1ea136b199f92
Instruction ID: 73f771af0f34e29403567a3953f74d2164555da63bf3c7e54fd84750c59f68ea
Opcode Fuzzy Hash: ef9708b68583c2915b20da6bf324e731a323ac851983d13dacd1ea136b199f92
Instruction Fuzzy Hash: DE419AB0900208DBEB16CFE5D89879EBFB5FB05708F20451CE411AF192C7B99989CF94

Function 00341BEC Relevance: 10.5, APIs: 7, Instructions: 45
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__init_pointers.LIBCMT ref: 00341BEC

Part of subcall function 00341D9B: EncodePointer.KERNEL32(00000000,?,00341BF1,0034143F,0034FD70,00000014), ref: 00341D9E
Part of subcall function 00341D9B: __initp_misc_winsig.LIBCMT ref: 00341DB9
Part of subcall function 00341D9B: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00343043
Part of subcall function 00341D9B: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00343057
Part of subcall function 00341D9B: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 0034306A
Part of subcall function 00341D9B: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 0034307D
Part of subcall function 00341D9B: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00343090
Part of subcall function 00341D9B: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 003430A3
Part of subcall function 00341D9B: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 003430B6
Part of subcall function 00341D9B: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 003430C9
Part of subcall function 00341D9B: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 003430DC
Part of subcall function 00341D9B: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 003430EF
Part of subcall function 00341D9B: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00343102
Part of subcall function 00341D9B: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00343115
Part of subcall function 00341D9B: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00343128
Part of subcall function 00341D9B: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 0034313B
Part of subcall function 00341D9B: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 0034314E
Part of subcall function 00341D9B: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00343161

__mtinitlocks.LIBCMT ref: 00341BF1
__mtterm.LIBCMT ref: 00341BFA

Part of subcall function 00341C62: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00341BFF,0034143F,0034FD70,00000014), ref: 00343359
Part of subcall function 00341C62: _free.LIBCMT ref: 00343360
Part of subcall function 00341C62: DeleteCriticalSection.KERNEL32(pT6,?,?,00341BFF,0034143F,0034FD70,00000014), ref: 00343382

__calloc_crt.LIBCMT ref: 00341C1F
__initptd.LIBCMT ref: 00341C41
GetCurrentThreadId.KERNEL32 ref: 00341C48

Memory Dump Source

Source File: 00000001.00000002.2310919959.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000001.00000002.2310905336.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310937303.000000000034C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310957115.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310972685.0000000000352000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310993708.0000000000364000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2311010690.0000000000367000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_340000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 7f855602a166841801a6aa255ca58540f2d7ac4ff3ba61dff6acb762d6ffb62e
Instruction ID: 748a54f69ee54590d59f84d30e39c2a30ed2184f801ce103698afd5396bb1f0c
Opcode Fuzzy Hash: 7f855602a166841801a6aa255ca58540f2d7ac4ff3ba61dff6acb762d6ffb62e
Instruction Fuzzy Hash: 1CF0F032168B2199E227BB747C43B8B27C8CF01771F220619F064DE0E5FF10B8C04190

Function 00341C7F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,?,00341CBE,00000000,?,00344FB8,000000FF,0000001E,00000000,00000000,00000000,?,00343523), ref: 00341C8E
GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00341CA0

Strings

CorExitProcess, xrefs: 00341C98
mscoree.dll, xrefs: 00341C87

Memory Dump Source

Source File: 00000001.00000002.2310919959.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000001.00000002.2310905336.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310937303.000000000034C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310957115.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310972685.0000000000352000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310993708.0000000000364000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2311010690.0000000000367000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_340000_file.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: 23cc7e8d0a4dbae24f1783cf6151cc38acec7dc04c63db320fdce8bd3bab3cfc
Instruction ID: ebff6fa58461cc5d70a25481b0c81ecd64b912cc67b092c9f113ff8eddde9ed7
Opcode Fuzzy Hash: 23cc7e8d0a4dbae24f1783cf6151cc38acec7dc04c63db320fdce8bd3bab3cfc
Instruction Fuzzy Hash: FED01235691208BBDB939B91DD45F9D77ADDB01781F041154F808E8051DE71FE549650

Function 0034751A Relevance: 6.1, APIs: 4, Instructions: 97
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00347550
__isleadbyte_l.LIBCMT ref: 0034757E
MultiByteToWideChar.KERNEL32(00000080,00000009,00000108,00000001,?,00000000), ref: 003475AC
MultiByteToWideChar.KERNEL32(00000080,00000009,00000108,00000001,?,00000000), ref: 003475E2

Memory Dump Source

Source File: 00000001.00000002.2310919959.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000001.00000002.2310905336.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310937303.000000000034C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310957115.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310972685.0000000000352000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310993708.0000000000364000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2311010690.0000000000367000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_340000_file.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 6bccfea978309457a230727f7f4b1a237a311272952979d237a119f7ef739d18
Instruction ID: 403ba7373f3a37599cee59831cd589a6cd90b4d5261499605a4bb46229f8a22a
Opcode Fuzzy Hash: 6bccfea978309457a230727f7f4b1a237a311272952979d237a119f7ef739d18
Instruction Fuzzy Hash: 9B31AC31608256AFDB229F66CC44BAA7BE9BF42310F1644A9E8158F1A0E730F850DB90

Function 0034501D Relevance: 6.1, APIs: 4, Instructions: 67
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 0034503C

Part of subcall function 00344F8B: __FF_MSGBANNER.LIBCMT ref: 00344FA2
Part of subcall function 00344F8B: __NMSG_WRITE.LIBCMT ref: 00344FA9
Part of subcall function 00344F8B: HeapAlloc.KERNEL32(009C0000,00000000,00000001,00000000,00000000,00000000,?,00343523,00000000,00000000,00000000,00000000,?,003433D8,00000018,0034FE40), ref: 00344FCE

Memory Dump Source

Source File: 00000001.00000002.2310919959.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000001.00000002.2310905336.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310937303.000000000034C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310957115.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310972685.0000000000352000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310993708.0000000000364000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2311010690.0000000000367000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_340000_file.jbxd

Yara matches

Similarity

API ID: AllocHeap_free
String ID:
API String ID: 1080816511-0
Opcode ID: cefd973072523b50968d3a0e4c67dd8ccec8e7ca926fdefc19cf1b3ed4d8873f
Instruction ID: 05e44f402a38b6fa28d17020e599da0fb51e38a03470d3160ef269a63d93156d
Opcode Fuzzy Hash: cefd973072523b50968d3a0e4c67dd8ccec8e7ca926fdefc19cf1b3ed4d8873f
Instruction Fuzzy Hash: 7011A03AD05A11ABCB332FB4BC0475936DCAF15361F214935F9049E192EB74F8408AD4

Function 00348D8D Relevance: 6.0, APIs: 4, Instructions: 48
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__cftof_l.LIBCMT ref: 00348DB1

Part of subcall function 00349498: __fltout2.LIBCMT ref: 003494C1

__cftog_l.LIBCMT ref: 00348DD7
__cftoe_l.LIBCMT ref: 00348E09

Memory Dump Source

Source File: 00000001.00000002.2310919959.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000001.00000002.2310905336.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310937303.000000000034C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310957115.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310972685.0000000000352000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310993708.0000000000364000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2311010690.0000000000367000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_340000_file.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 2cb3898d52a2afa3b80efc2dabade83c3dd21bdc7efb1f811b0d780245f9d57c
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: D9014B3280014EBBCF135F88CC118EE3FA6BB19354B598815FA185C171D736EAB1AB81

Function 00341552 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00342B6C
___raise_securityfailure.LIBCMT ref: 00342C53

Strings

@Q6, xrefs: 00342C4E

Memory Dump Source

Source File: 00000001.00000002.2310919959.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000001.00000002.2310905336.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310937303.000000000034C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310957115.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310972685.0000000000352000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310993708.0000000000364000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2311010690.0000000000367000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_340000_file.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: @Q6
API String ID: 3761405300-3821120862
Opcode ID: c8ca9d6a9dbb769425ce814054293e62864144dee0497e74a178c537812df8e3
Instruction ID: d43d50502b326b83065e573f08b49a0d9c81a1bf641ccf340dbdd23f6baf85fb
Opcode Fuzzy Hash: c8ca9d6a9dbb769425ce814054293e62864144dee0497e74a178c537812df8e3
Instruction Fuzzy Hash: 642104B8511B049ADB22CF14F9A67447BECFB58311F50993AE9089B3B0E3F05884CF59

Function 003448F2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 00344914
__calloc_crt.LIBCMT ref: 0034492D

Strings

`V6, xrefs: 00344944

Memory Dump Source

Source File: 00000001.00000002.2310919959.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000001.00000002.2310905336.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310937303.000000000034C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310957115.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310972685.0000000000352000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2310993708.0000000000364000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2311010690.0000000000367000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_340000_file.jbxd

Yara matches

Similarity

API ID: __calloc_crt
String ID: `V6
API String ID: 3494438863-2496494969
Opcode ID: e9e47454973560999052c1681ea4dc70042edee9fb995108e17ea2f336acbd73
Instruction ID: 863484485e286614db2e6692937a92460e846b84866c23a312e698b59f2b5f66
Opcode Fuzzy Hash: e9e47454973560999052c1681ea4dc70042edee9fb995108e17ea2f336acbd73
Instruction Fuzzy Hash: EBF0627120D3119AF71BCF69FD12FA667D8E7147B0F11803AE604CF6A0E7B0AC519681

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4fbe18952d61b9ae40bb3841a1ba97fc25a62c_f84a56e5_99b26695-cd85-4ab3-90ba-f16152b8840b\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER69C1.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6A3F.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6A6F.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

UDP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

Windows Analysis Report
file.exe

Function 003413CD Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 86
COMMON

Function 00341220 Relevance: 49.1, APIs: 7, Strings: 21, Instructions: 97
stringwindowthreadCOMMON

Function 00341BEC Relevance: 10.5, APIs: 7, Instructions: 45
threadCOMMON

Function 00341C7F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20
libraryloaderCOMMONLIBRARYCODE

Function 0034751A Relevance: 6.1, APIs: 4, Instructions: 97
COMMONLIBRARYCODE

Function 0034501D Relevance: 6.1, APIs: 4, Instructions: 67
COMMONLIBRARYCODE

Function 00348D8D Relevance: 6.0, APIs: 4, Instructions: 48
COMMONLIBRARYCODE

Function 00341552 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60
COMMONLIBRARYCODE

Function 003448F2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45
COMMON