Edit tour

Windows Analysis Report
msiexec.exe

Overview

General Information

Sample name:	msiexec.exe
Analysis ID:	1523484
MD5:	c0d3bdde74c1ec82f75681d4d5ed44c8
SHA1:	8e743c5c800ce7f26d91c4bc9c5be41ab15d9bf9
SHA256:	ea2aa4ed1ff50d0f2e0a9c1df1960265aa28bf8da542469c0530a09b6da445d2
Infos:

Detection

Score:	25
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Sigma detected: System File Execution Location Anomaly

Binary contains a suspicious time stamp

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Detected potential crypto function

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

PE file contains sections with non-standard names

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Classification

Process Tree

System is w10x64

msiexec.exe (PID: 7352 cmdline: "C:\Users\user\Desktop\msiexec.exe" MD5: C0D3BDDE74C1EC82F75681D4D5ED44C8)

cleanup

Sigma Signatures

System Summary

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\Users\user\Desktop\msiexec.exe", CommandLine: "C:\Users\user\Desktop\msiexec.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\msiexec.exe, NewProcessName: C:\Users\user\Desktop\msiexec.exe, OriginalFileName: C:\Users\user\Desktop\msiexec.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Users\user\Desktop\msiexec.exe", ProcessId: 7352, ProcessName: msiexec.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: msiexec.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: msiexec.pdb source: msiexec.exe
Source:	Binary string: msiexec.pdbOGPS source: msiexec.exe

Source: C:\Users\user\Desktop\msiexec.exe	Code function: 0_2_00007FF7E8916068	0_2_00007FF7E8916068
Source: C:\Users\user\Desktop\msiexec.exe	Code function: 0_2_00007FF7E89135D4	0_2_00007FF7E89135D4
Source: C:\Users\user\Desktop\msiexec.exe	Code function: 0_2_00007FF7E891819B	0_2_00007FF7E891819B
Source: C:\Users\user\Desktop\msiexec.exe	Code function: 0_2_00007FF7E8913F08	0_2_00007FF7E8913F08
Source: C:\Users\user\Desktop\msiexec.exe	Code function: 0_2_00007FF7E8913AF0	0_2_00007FF7E8913AF0

Source: msiexec.exe

Binary or memory string: OriginalFilename vs msiexec.exe

Source: classification engine

Classification label: sus25.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\msiexec.exe

Code function: 0_2_00007FF7E89120BC GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,CloseHandle,AdjustTokenPrivileges,CloseHandle,GetLastError,

0_2_00007FF7E89120BC

Source: C:\Users\user\Desktop\msiexec.exe

Code function: 0_2_00007FF7E89191BC StartServiceCtrlDispatcherW,GetLastError,

0_2_00007FF7E89191BC

Source: C:\Users\user\Desktop\msiexec.exe

Code function: 0_2_00007FF7E89191BC StartServiceCtrlDispatcherW,GetLastError,

0_2_00007FF7E89191BC

Source: msiexec.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\msiexec.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior

Source: msiexec.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: msiexec.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: msiexec.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: msiexec.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: msiexec.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: msiexec.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: msiexec.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: msiexec.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: msiexec.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: msiexec.pdb source: msiexec.exe
Source:	Binary string: msiexec.pdbOGPS source: msiexec.exe

Source: msiexec.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: msiexec.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: msiexec.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: msiexec.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: msiexec.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: msiexec.exe

Static PE information: 0xFE3155BD [Sat Feb 21 07:54:37 2105 UTC]

Source: C:\Users\user\Desktop\msiexec.exe

Code function: 0_2_00007FF7E8912A08 LoadLibraryW,GetProcAddress,

0_2_00007FF7E8912A08

Source: msiexec.exe

Static PE information: section name: .didat

Source: C:\Users\user\Desktop\msiexec.exe

Code function: 0_2_00007FF7E89191BC StartServiceCtrlDispatcherW,GetLastError,

0_2_00007FF7E89191BC

Source: C:\Users\user\Desktop\msiexec.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-3472

Source: C:\Users\user\Desktop\msiexec.exe

API coverage: 6.9 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\msiexec.exe

API call chain: ExitProcess graph end node

graph_0-3611

Source: C:\Users\user\Desktop\msiexec.exe

Code function: 0_2_00007FF7E891A560 DelayLoadFailureHook,LdrResolveDelayLoadedAPI,LoadLibraryExA,memset,FreeLibrary,GetProcAddress,DelayLoadFailureHook,

0_2_00007FF7E891A560

Source: C:\Users\user\Desktop\msiexec.exe

Code function: 0_2_00007FF7E8915934 GetLastError,RegQueryValueExW,RegCloseKey,GlobalFree,RegCreateKeyExW,RegSetValueExW,lstrlenW,RegSetValueExW,RegCloseKey,memset,OutputDebugStringW,SetLastError,

0_2_00007FF7E8915934

Source: C:\Users\user\Desktop\msiexec.exe

Code function: 0_2_00007FF7E8912A08 LoadLibraryW,GetProcAddress,

0_2_00007FF7E8912A08

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\msiexec.exe	Code function: 0_2_00007FF7E89118FE SetUnhandledExceptionFilter,		0_2_00007FF7E89118FE
Source: C:\Users\user\Desktop\msiexec.exe	Code function: 0_2_00007FF7E89114B4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00007FF7E89114B4

Source: C:\Users\user\Desktop\msiexec.exe

Code function: 0_2_00007FF7E8913F08 AllocateAndInitializeSid,AllocateAndInitializeSid,AllocateAndInitializeSid,AllocateAndInitializeSid,AllocateAndInitializeSid,GetLastError,AllocateAndInitializeSid,AllocateAndInitializeSid,AllocateAndInitializeSid,GetLastError,AllocateAndInitializeSid,AllocateAndInitializeSid,GetLastError,AllocateAndInitializeSid,AllocateAndInitializeSid,AllocateAndInitializeSid,GetLastError,AllocateAndInitializeSid,AllocateAndInitializeSid,GetLastError,AllocateAndInitializeSid,AllocateAndInitializeSid,AllocateAndInitializeSid,GetLengthSid,memset,GlobalAlloc,InitializeAcl,GetLastError,AddAccessAllowedAce,GetAce,GetLastError,GetLastError,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetSecurityDescriptorLength,MakeSelfRelativeSD,GetLastError,GetLastError,GetLastError,

0_2_00007FF7E8913F08

Source: C:\Users\user\Desktop\msiexec.exe

Code function: 0_2_00007FF7E89138C8 AllocateAndInitializeSid,GetLastError,GetLengthSid,FreeSid,GetLengthSid,FreeSid,

0_2_00007FF7E89138C8

Source: C:\Users\user\Desktop\msiexec.exe

Code function: memset,GetACP,LoadLibraryW,GetProcAddress,GetLocaleInfoW,FreeLibrary,FormatMessageW,memset,GetVersionExW,GlobalFree,lstrlenW,WriteFile,WriteFile,

0_2_00007FF7E8912F1C

Source: C:\Users\user\Desktop\msiexec.exe

Code function: 0_2_00007FF7E8911AD4 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,GetTickCount,QueryPerformanceCounter,

0_2_00007FF7E8911AD4

Source: C:\Users\user\Desktop\msiexec.exe

Code function: 0_2_00007FF7E8916068 GetVersionExW,GetCommandLineW,GetStdHandle,GetFileType,memset,memset,GlobalFree,RegQueryValueExW,RegCloseKey,RegQueryValueExW,RegCloseKey,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,CompareStringW,CompareStringW,CompareStringW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,memset,lstrlenW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,CoInitialize,CoRegisterClassObject,GlobalFree,OpenEventW,WaitForSingleObject,CloseHandle,GlobalFree,GetCurrentThread,OpenThreadToken,GetLastError,GlobalFree,RevertToSelf,RegCloseKey,RegEnumKeyW,RevertToSelf,GetCurrentProcess,OpenProcessToken,GetTokenInformation,EqualSid,CloseHandle,GetLastError,memset,GlobalFree,GlobalFree,CloseHandle,GlobalFree,MakeAbsoluteSD,GetLastError,CloseHandle,CloseHandle,CreateEventW,CloseHandle,GetLastError,CreateEventW,CloseHandle,GetLastError,GlobalFree,CloseHandle,CloseHandle,CloseHandle,OpenProcess,CloseHandle,GetLastError,CloseHandle,CloseHandle,GlobalFree,MsgWaitForMultipleObjects,CloseHandle,OpenProcess,PeekMessageW,TranslateMessage,DispatchMessageW,CloseHandle,GetLastError,CloseHandle,CloseHandle,CoRevokeClassObject,CoUninitialize,GlobalFree,GlobalFree,GetLastError,GetMessageW,TranslateMessage,DispatchMessageW,

0_2_00007FF7E8916068

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Service Execution	3 Windows Service	1 Access Token Manipulation	1 Access Token Manipulation	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	3 Windows Service	1 Timestomp	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 DLL Side-Loading	Security Account Manager	13 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
msiexec.exe	0%	ReversingLabs

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523484
Start date and time:	2024-10-01 16:56:16 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 1m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	msiexec.exe
Detection:	SUS
Classification:	sus25.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 16 Number of non-executed functions: 31
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

VT rate limit hit for: msiexec.exe

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.087580949245158
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	msiexec.exe
File size:	176'128 bytes
MD5:	c0d3bdde74c1ec82f75681d4d5ed44c8
SHA1:	8e743c5c800ce7f26d91c4bc9c5be41ab15d9bf9
SHA256:	ea2aa4ed1ff50d0f2e0a9c1df1960265aa28bf8da542469c0530a09b6da445d2
SHA512:	e9a0e2e0c5ff36ba58e8b8dc000e5500a61dc4abae55a116a0ed82bdc0e5289642e65cf9dd813b2083198f0678335c30ba76c948c5ade92c7727080571680d08
SSDEEP:	3072:MRZHxKGLLqVcNnB2eA8uTx4rfw78X3Ix3V8xOTIKOZDBZcBk:QZHxLqVcL2enw7w3IkxsIKABZcy
TLSH:	E704AD5E66E424E8E07A4234D876822690B1BC7217B196EF32D8D67B4F31AD0D53FF21
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........F........................................].....................{.............Rich............................PE..d....U1....

File Icon


Icon Hash:	fdf5fdd8b3b39b1f

Static PE Info

General

Entrypoint:	0x140001200
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0xFE3155BD [Sat Feb 21 07:54:37 2105 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	10
OS Version Minor:	0
File Version Major:	10
File Version Minor:	0
Subsystem Version Major:	10
Subsystem Version Minor:	0
Import Hash:	0990a9500ff8df93e0e059ee13e7c796

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FCE54E179A0h
dec eax
add esp, 28h
jmp 00007FCE54E170DBh
int3
int3
int3
int3
int3
int3
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], edi
inc ecx
push esi
dec eax
sub esp, 000000B0h
and dword ptr [esp+20h], 00000000h
dec eax
lea ecx, dword ptr [esp+40h]
call dword ptr [0000A2ADh]
nop
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ebx, dword ptr [eax+08h]
xor edi, edi
xor eax, eax
dec eax
cmpxchg dword ptr [000100EAh], ebx
je 00007FCE54E170DCh
dec eax
cmp eax, ebx
jne 00007FCE54E170EFh
mov edi, 00000001h
mov eax, dword ptr [000100E0h]
cmp eax, 01h
jne 00007FCE54E170ECh
lea ecx, dword ptr [eax+1Eh]
call 00007FCE54E17834h
jmp 00007FCE54E17159h
mov ecx, 000003E8h
call dword ptr [0000A163h]
jmp 00007FCE54E17096h
mov eax, dword ptr [000100BBh]
test eax, eax
jne 00007FCE54E17135h
mov dword ptr [000100ADh], 00000001h
dec esp
lea esi, dword ptr [0000A436h]
dec eax
lea ebx, dword ptr [0000A417h]
dec eax
mov dword ptr [esp+30h], ebx
mov dword ptr [esp+24h], eax
dec ecx
cmp ebx, esi
jnc 00007FCE54E17101h
test eax, eax
jne 00007FCE54E17101h
dec eax
cmp dword ptr [ebx], 00000000h
je 00007FCE54E170ECh
dec ecx
mov edx, 5E523070h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xdba0	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x14000	0x16b10	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x12000	0x60c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2b000	0xd4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xcfb0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb0f0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xb230	0x428	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xda30	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x99f1	0xa000	eb0e41586bb3c0a84ddc1662910fa50e	False	0.5134521484375	data	6.081603328695104	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xb000	0x39c8	0x4000	2071145b2c26ceb749e5e257ef66ac05	False	0.333740234375	data	4.000173769693527	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xf000	0x2400	0x2000	a2bcbd23c6a04b5cf6238abf131cf113	False	0.019775390625	data	0.1828403109501297	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x12000	0x60c	0x1000	9beb52b5eb5484e041c11f625dec148b	False	0.20654296875	PEX Binary Archive	1.965541414957988	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.didat	0x13000	0x98	0x1000	5190fae5cf029155738e5f94440f22d7	False	0.02099609375	data	0.18389230938244008	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x14000	0x16b10	0x17000	5f7ec24e69a4148b2a22f7a777b9bd25	False	0.6768851902173914	data	6.979424124819375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2b000	0xd4	0x1000	5ad45dc849b19e8ca4f861e8f686b2bf	False	0.035400390625	data	0.45489600687466425	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
MUI	0x2aa40	0xd0	data	English	United States	0.5384615384615384
RT_ICON	0x14ca8	0xb594	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9955468548317701
RT_ICON	0x20240	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 0	English	United States	0.350909305621162
RT_ICON	0x24468	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.40051867219917014
RT_ICON	0x26a10	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 0	English	United States	0.4353550295857988
RT_ICON	0x28478	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.4699812382739212
RT_ICON	0x29520	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	English	United States	0.5426229508196722
RT_ICON	0x29ea8	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 0	English	United States	0.6023255813953489
RT_ICON	0x2a560	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.7597517730496454
RT_GROUP_ICON	0x2a9c8	0x76	data	English	United States	0.7542372881355932
RT_VERSION	0x14930	0x374	data	English	United States	0.47171945701357465
RT_MANIFEST	0x142d0	0x65a	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3966789667896679

Imports

DLL	Import
ADVAPI32.dll	GetTokenInformation, SetSecurityDescriptorGroup, MakeAbsoluteSD, MakeSelfRelativeSD, RegQueryValueExW, OpenThreadToken, AddAccessAllowedAce, GetSecurityDescriptorLength, GetLengthSid, StartServiceCtrlDispatcherW, RegOpenKeyExW, InitializeAcl, InitializeSecurityDescriptor, SetThreadToken, FreeSid, OpenProcessToken, RegSetValueExW, RegisterServiceCtrlHandlerW, RegCreateKeyExW, SetServiceStatus, AllocateAndInitializeSid, EqualSid, GetAce, SetSecurityDescriptorOwner, RegEnumKeyW, RegCloseKey, RevertToSelf, AdjustTokenPrivileges, SetSecurityDescriptorDacl, LookupPrivilegeValueW
KERNEL32.dll	CompareStringW, SetLastError, EnterCriticalSection, GetCommandLineW, GetCurrentProcess, lstrlenW, GetStdHandle, WriteFile, GetModuleHandleExW, GetModuleFileNameW, LeaveCriticalSection, InitializeCriticalSection, GetEnvironmentVariableW, GetLocaleInfoW, WaitForSingleObject, OpenEventW, GetVersionExW, GetSystemDefaultLangID, GetACP, OpenProcess, GetVersion, SetProcessMitigationPolicy, CreateEventW, MultiByteToWideChar, Sleep, FormatMessageW, GetLastError, OutputDebugStringW, SetEvent, GetCurrentThread, GlobalAlloc, GlobalFree, CloseHandle, LoadLibraryW, CreateThread, SetCurrentDirectoryW, GetProcAddress, DeleteCriticalSection, ExitProcess, UnhandledExceptionFilter, GetModuleHandleW, FreeLibrary, WideCharToMultiByte, GetFileType, lstrcmpW, LoadLibraryExW, GetSystemDirectoryW, LoadLibraryExA, GetTickCount, GetSystemTimeAsFileTime, GetCurrentThreadId, GetCurrentProcessId, QueryPerformanceCounter, TerminateProcess, SetUnhandledExceptionFilter, DelayLoadFailureHook, GetStartupInfoW
USER32.dll	MsgWaitForMultipleObjects, DispatchMessageW, PeekMessageW, IsCharAlphaNumericW, TranslateMessage, PostThreadMessageW, PostQuitMessage, GetMessageW
msvcrt.dll	_XcptFilter, _amsg_exit, __getmainargs, __set_app_type, exit, _exit, _cexit, _ismbblead, __setusermatherr, _initterm, _acmdln, _fmode, _commode, _lock, _unlock, __dllonexit, _onexit, memcpy, memset, ?terminate@@YAXXZ, _vsnprintf, _wcsicmp, __C_specific_handler, _vsnwprintf
ntdll.dll	RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind
ole32.dll	CoUninitialize, CoRegisterClassObject, StgOpenStorage, CoRevokeClassObject, CoInitialize

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	10:57:06
Start date:	01/10/2024
Path:	C:\Users\user\Desktop\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\msiexec.exe"
Imagebase:	0x7ff7e8910000
File size:	176'128 bytes
MD5 hash:	C0D3BDDE74C1EC82F75681D4D5ED44C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	51.2%
Total number of Nodes:	1157
Total number of Limit Nodes:	16

Executed Functions

Function 00007FF7E8916068 Relevance: 234.5, APIs: 94, Strings: 39, Instructions: 1784registrystringCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?,?,?,?,?,00007FF7E8919820), ref: 00007FF7E89160CB
GetCommandLineW.KERNEL32(?,?,?,?,?,00007FF7E8919820), ref: 00007FF7E8916114
GetStdHandle.KERNEL32(?,?,?,?,?,00007FF7E8919820), ref: 00007FF7E8916159
GetFileType.KERNEL32(?,?,?,?,?,00007FF7E8919820), ref: 00007FF7E8916175
memset.MSVCRT ref: 00007FF7E89161A2
memset.MSVCRT ref: 00007FF7E89161B3
GlobalFree.KERNEL32 ref: 00007FF7E8916255
RegQueryValueExW.ADVAPI32(?,?,?,?,?,00007FF7E8919820), ref: 00007FF7E89162BB
RegCloseKey.ADVAPI32(?,?,?,?,?,00007FF7E8919820), ref: 00007FF7E89162E6
RegQueryValueExW.ADVAPI32(?,?,?,?,?,00007FF7E8919820), ref: 00007FF7E8916317
RegCloseKey.ADVAPI32(?,?,?,?,?,00007FF7E8919820), ref: 00007FF7E8916329
GlobalFree.KERNEL32 ref: 00007FF7E8916378
GlobalFree.KERNEL32 ref: 00007FF7E891639A
GlobalFree.KERNEL32 ref: 00007FF7E89163CD
GlobalFree.KERNEL32 ref: 00007FF7E89168CF

Part of subcall function 00007FF7E8918B64: GlobalAlloc.KERNEL32 ref: 00007FF7E8918B8C

GlobalFree.KERNEL32 ref: 00007FF7E89163FF
GlobalFree.KERNEL32 ref: 00007FF7E8916421
CompareStringW.KERNEL32(?,?,?,?,?,00007FF7E8919820), ref: 00007FF7E8916692
CompareStringW.KERNEL32(?,?,?,?,?,00007FF7E8919820), ref: 00007FF7E89166C8
CompareStringW.KERNEL32(?,?,?,?,?,00007FF7E8919820), ref: 00007FF7E89167B2
GlobalFree.KERNEL32 ref: 00007FF7E8916855
GlobalFree.KERNEL32 ref: 00007FF7E8916877
GlobalFree.KERNEL32 ref: 00007FF7E89168AD
memset.MSVCRT ref: 00007FF7E89169A7
lstrlenW.KERNEL32(?,?,?,?,?,00007FF7E8919820), ref: 00007FF7E8916AAE
GlobalFree.KERNEL32 ref: 00007FF7E8916D24
GlobalFree.KERNEL32 ref: 00007FF7E8916D4D
GlobalFree.KERNEL32 ref: 00007FF7E8916DD5

Strings

ServerMain (CA): Open synchronization event failed, xrefs: 00007FF7E8917F8D
ServerMain (CA): Wait on synchronization event failed, xrefs: 00007FF7E89171F4
REBOOTPROMPT="", xrefs: 00007FF7E8916532
help, xrefs: 00007FF7E8916498
ServerMain (CA): Error: Format SD, xrefs: 00007FF7E8917684
ServerMain (CA): Create Custom Action Server failed., xrefs: 00007FF7E891792C
quiet, xrefs: 00007FF7E89164B4
promptrestart, xrefs: 00007FF7E8916524
OpenProcessToken failed with %d, xrefs: 00007FF7E891740F
Software\Microsoft\Windows\CurrentVersion\Installer\RunOnceEntries, xrefs: 00007FF7E8916271
ServerMain (CA): Parsing command line failed, xrefs: 00007FF7E89170FD
OLEAUT32.dll, xrefs: 00007FF7E8916FB9
ServerMain (CA): Connect to remote object failed., xrefs: 00007FF7E8917B33
ServerMain (CA): Process not registered with service., xrefs: 00007FF7E8917A35
ServerMain (CA): Could not open synchronization handle., xrefs: 00007FF7E8917AEC, 00007FF7E8917E65
REBOOT=ReallySuppress, xrefs: 00007FF7E89164FA
package, xrefs: 00007FF7E891643B, 00007FF7E89166A8
ServerMain (CA): Access to token failed, xrefs: 00007FF7E891727E
log, xrefs: 00007FF7E8916540
/qb!- REBOOTPROMPT=S, xrefs: 00007FF7E89164DE
ServerMain (CA): Error: Watch for the shutdown signal, xrefs: 00007FF7E89177C8
forcerestart, xrefs: 00007FF7E8916508
update, xrefs: 00007FF7E891645F
/l*, xrefs: 00007FF7E891654E
norestart, xrefs: 00007FF7E89164EC
REBOOT=Force, xrefs: 00007FF7E8916516
passive, xrefs: 00007FF7E89164D0
ServerMain (CA): Wrong command line, xrefs: 00007FF7E89170BD
ServerMain (CA): Error: icacContext in CA server should be EEUI but is not any impersonated type, xrefs: 00007FF7E8917473
ServerMain (CA): Error: Watch for change-of-owning-process signal, xrefs: 00007FF7E891781D
ServerMain (CA): Connection to Service failed., xrefs: 00007FF7E89178C9
/qn, xrefs: 00007FF7E89164C2
ServerMain (CA): CoInitializeSecurity failed, xrefs: 00007FF7E8917735
A, xrefs: 00007FF7E8916C0C
uninstall, xrefs: 00007FF7E891647C
ServerMain (CA): Error: icacContext in CA server should be AISImpersonated but is not any impersonated type, xrefs: 00007FF7E89174BA
RUVEH?IJDqXFAtPYZlgmnc, xrefs: 00007FF7E8916972, 00007FF7E8916BCF, 00007FF7E8916E1D
ServerMain (CA): Error: Access to SD, xrefs: 00007FF7E8917561
ServerMain (CA): Impersonation token not saved., xrefs: 00007FF7E8917C5B

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: Global$Free$CompareStringmemset$CloseQueryValue$AllocCommandFileHandleLineTypeVersionlstrlen
String ID: /l*$/qb!- REBOOTPROMPT=S$/qn$A$OLEAUT32.dll$OpenProcessToken failed with %d$REBOOT=Force$REBOOT=ReallySuppress$REBOOTPROMPT=""$RUVEH?IJDqXFAtPYZlgmnc$ServerMain (CA): Access to token failed$ServerMain (CA): CoInitializeSecurity failed$ServerMain (CA): Connect to remote object failed.$ServerMain (CA): Connection to Service failed.$ServerMain (CA): Could not open synchronization handle.$ServerMain (CA): Create Custom Action Server failed.$ServerMain (CA): Error: Access to SD$ServerMain (CA): Error: Format SD$ServerMain (CA): Error: Watch for change-of-owning-process signal$ServerMain (CA): Error: Watch for the shutdown signal$ServerMain (CA): Error: icacContext in CA server should be AISImpersonated but is not any impersonated type$ServerMain (CA): Error: icacContext in CA server should be EEUI but is not any impersonated type$ServerMain (CA): Impersonation token not saved.$ServerMain (CA): Open synchronization event failed$ServerMain (CA): Parsing command line failed$ServerMain (CA): Process not registered with service.$ServerMain (CA): Wait on synchronization event failed$ServerMain (CA): Wrong command line$Software\Microsoft\Windows\CurrentVersion\Installer\RunOnceEntries$forcerestart$help$log$norestart$package$passive$promptrestart$quiet$uninstall$update
API String ID: 174257794-414071484
Opcode ID: d03e7f159ca7830554a359dcaf61971cc37f2a6a050cb34d4e2a2435689f6eee
Instruction ID: 69880e4d484d4a850d339ac35b5d6d3b5824eb61636d8d83c65eb7607f4060dc
Opcode Fuzzy Hash: d03e7f159ca7830554a359dcaf61971cc37f2a6a050cb34d4e2a2435689f6eee
Instruction Fuzzy Hash: BA135D32E0CA829EE720AF20D8402B9F7A1FB4575AFC24132DA4E47B95DF38D545C766

Function 00007FF7E891A560 Relevance: 9.1, APIs: 6, Instructions: 101
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrResolveDelayLoadedAPI.NTDLL ref: 00007FF7E891A5EA
LoadLibraryExA.KERNEL32 ref: 00007FF7E891A62C
memset.MSVCRT ref: 00007FF7E891A663
GetProcAddress.KERNEL32 ref: 00007FF7E891A6AD

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: AddressDelayLibraryLoadLoadedProcResolvememset
String ID:
API String ID: 2833715811-0
Opcode ID: c336bbc64626cf6acc10d63c40c27c14f3d607f4eb150b479cc6a567ab64b1a8
Instruction ID: b29ece8bec12c8204916ce48ade14c7bdc864c4d9d9203a64af3f752736c1e34
Opcode Fuzzy Hash: c336bbc64626cf6acc10d63c40c27c14f3d607f4eb150b479cc6a567ab64b1a8
Instruction Fuzzy Hash: 1B418322E0DA458AEA10EF11A810779F3A1FB88BD6F964436EE0D07755DF3DE812C719

Function 00007FF7E89118FE Relevance: 1.5, APIs: 1, Instructions: 7
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNELBASE ref: 00007FF7E891190B

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: ab7e7ed8b22fc635fe768c853d46f40f9f3d5d15748e46d1c957a6409a67a8d5
Instruction ID: b35b8c5f35e839bf2a0803aa690329d3cbf7b78626863cec1c454cc97c3fe80d
Opcode Fuzzy Hash: ab7e7ed8b22fc635fe768c853d46f40f9f3d5d15748e46d1c957a6409a67a8d5
Instruction Fuzzy Hash: 89B02403F070C301D10073700D4400415400F475307CC1554C31CC3DC0CC1CC15D0314

Function 00007FF7E8918DCC Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 196
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7E8918AE4: GlobalAlloc.KERNELBASE ref: 00007FF7E8918B09

GetModuleFileNameW.KERNEL32 ref: 00007FF7E8918EBD
GlobalAlloc.KERNEL32 ref: 00007FF7E8918F47
GlobalFree.KERNEL32 ref: 00007FF7E8918F85
GlobalFree.KERNEL32 ref: 00007FF7E89190CD
GlobalFree.KERNEL32 ref: 00007FF7E89190FB
GlobalFree.KERNEL32 ref: 00007FF7E8919123
GlobalFree.KERNEL32 ref: 00007FF7E891914E

Part of subcall function 00007FF7E8918AE4: GlobalFree.KERNEL32 ref: 00007FF7E8918B36

Strings

%d.%d.%.4d.%d, xrefs: 00007FF7E891903F

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: Global$Free$Alloc$FileModuleName
String ID: %d.%d.%.4d.%d
API String ID: 906160587-3399825337
Opcode ID: 02e69f7bae08479ec80e5be7f179d9694ccf5c4fd234633bba0881401daf2d7b
Instruction ID: bd48930df6289c4ce66553466a5839e2f467a63abbc9af167201a1aea6e462bc
Opcode Fuzzy Hash: 02e69f7bae08479ec80e5be7f179d9694ccf5c4fd234633bba0881401daf2d7b
Instruction Fuzzy Hash: 16A16C32A0CB858AD7609F15E4803AAF7A1FB88B81F924137DA8E43B54DF3CD445CB55

Function 00007FF7E8918DD0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 196
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7E8918AE4: GlobalAlloc.KERNELBASE ref: 00007FF7E8918B09

GetModuleFileNameW.KERNEL32 ref: 00007FF7E8918EBD
GlobalAlloc.KERNEL32 ref: 00007FF7E8918F47
GlobalFree.KERNEL32 ref: 00007FF7E8918F85
GlobalFree.KERNEL32 ref: 00007FF7E89190CD
GlobalFree.KERNEL32 ref: 00007FF7E89190FB
GlobalFree.KERNEL32 ref: 00007FF7E8919123
GlobalFree.KERNEL32 ref: 00007FF7E891914E

Part of subcall function 00007FF7E8918AE4: GlobalFree.KERNEL32 ref: 00007FF7E8918B36

Strings

%d.%d.%.4d.%d, xrefs: 00007FF7E891903F

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: Global$Free$Alloc$FileModuleName
String ID: %d.%d.%.4d.%d
API String ID: 906160587-3399825337
Opcode ID: a08a1fad544d618311739ca1bdcded878cdbc9abc91d9f20afada6d795820cb7
Instruction ID: 0d54f08f1a740c85dda35b0794c2164cfbfe31c860631562d75b1f7ea5e6edff
Opcode Fuzzy Hash: a08a1fad544d618311739ca1bdcded878cdbc9abc91d9f20afada6d795820cb7
Instruction Fuzzy Hash: CFA17D32A0CA818AD760DF15E4803AAF7A1FB89B81F924137DA8E43B54DF3CD445CB55

Function 00007FF7E8911200 Relevance: 12.1, APIs: 8, Instructions: 138
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7E8911AD4: GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7E8911B04
Part of subcall function 00007FF7E8911AD4: GetCurrentProcessId.KERNEL32 ref: 00007FF7E8911B12
Part of subcall function 00007FF7E8911AD4: GetCurrentThreadId.KERNEL32 ref: 00007FF7E8911B1E
Part of subcall function 00007FF7E8911AD4: GetTickCount.KERNEL32 ref: 00007FF7E8911B2A
Part of subcall function 00007FF7E8911AD4: GetTickCount.KERNEL32 ref: 00007FF7E8911B3A
Part of subcall function 00007FF7E8911AD4: QueryPerformanceCounter.KERNEL32 ref: 00007FF7E8911B55

GetStartupInfoW.KERNEL32 ref: 00007FF7E8911235
_amsg_exit.MSVCRT ref: 00007FF7E8911270
Sleep.KERNEL32 ref: 00007FF7E891127F
_initterm.MSVCRT ref: 00007FF7E8911317
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7E8911344
exit.MSVCRT ref: 00007FF7E89113E0
_cexit.MSVCRT ref: 00007FF7E89113EF
_ismbblead.MSVCRT ref: 00007FF7E891140F

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: Current$CountTickTime$CounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThread_amsg_exit_cexit_initterm_ismbbleadexit
String ID:
API String ID: 2995914023-0
Opcode ID: b3405ba9bf1b6c8b60cc4677538f088acaae8d2acba2d8ee73f51a443fd371b9
Instruction ID: fcd0efb0dd834af1f2061162b88a4b0901733844ce2e8312db91634800e7c8ed
Opcode Fuzzy Hash: b3405ba9bf1b6c8b60cc4677538f088acaae8d2acba2d8ee73f51a443fd371b9
Instruction Fuzzy Hash: 95615D31E0C6469AFB60AB11E844379E3A1FF48786FC61037D94D836A5DF3CE855872A

Function 00007FF7E8918F06 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 133
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32 ref: 00007FF7E8918F47
GlobalFree.KERNEL32 ref: 00007FF7E8918F85
GlobalFree.KERNEL32 ref: 00007FF7E89190CD
GlobalFree.KERNEL32 ref: 00007FF7E89190FB
GlobalFree.KERNEL32 ref: 00007FF7E8919123
GlobalFree.KERNEL32 ref: 00007FF7E891914E

Strings

%d.%d.%.4d.%d, xrefs: 00007FF7E891903F

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: Global$Free$Alloc
String ID: %d.%d.%.4d.%d
API String ID: 1780285237-3399825337
Opcode ID: 75e3eb336131a2feeac37190dcddd72ffeb0e7a34b662413243cd1c5d5b94e16
Instruction ID: af1be2bd3f8b62829fd77e689bfc2245d701245ece1f53069dd884aa7a62b140
Opcode Fuzzy Hash: 75e3eb336131a2feeac37190dcddd72ffeb0e7a34b662413243cd1c5d5b94e16
Instruction Fuzzy Hash: D4613D32A0CA858AD760DF15E4803AAF7A1FB89B85F914137DA8E83B58DF3CD444CB55

Function 00007FF7E891985C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35
librarysleeploaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00007FF7E8919873
LoadLibraryExW.KERNELBASE ref: 00007FF7E891989D
GetProcAddress.KERNEL32 ref: 00007FF7E89198CA

Strings

COMCTL32, xrefs: 00007FF7E8919896
InitCommonControlsEx, xrefs: 00007FF7E89198C0

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: AddressLibraryLoadProcSleep
String ID: COMCTL32$InitCommonControlsEx
API String ID: 188063004-472741233
Opcode ID: dfbbc47501c9e926adc40f3ed42faa0f5c8afec34d359a1271c10688bb43b704
Instruction ID: a198b366fff67bbe01c29138e9aee762839a56ff7e79ebdc07a8518e870ab2ed
Opcode Fuzzy Hash: dfbbc47501c9e926adc40f3ed42faa0f5c8afec34d359a1271c10688bb43b704
Instruction Fuzzy Hash: A011A524E0EB528DFA15EB04A890374E7E0AF59707FC64477C80E063A1EF3CB555832A

Function 00007FF7E8919B04 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42
sleeplibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00007FF7E8919B27
GetProcAddress.KERNEL32 ref: 00007FF7E8919B78

Strings

VERSION, xrefs: 00007FF7E8919B4A

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: AddressProcSleep
String ID: VERSION
API String ID: 1175476452-2153328089
Opcode ID: 4b78a3b84602baaf617cab0f1e701a092df9b29d47d07ecb271cf4272f2e33cd
Instruction ID: 72ecd09c20dfeaafd79b42eb5b961f1e468571ea0bf6df1f605ae65186a82017
Opcode Fuzzy Hash: 4b78a3b84602baaf617cab0f1e701a092df9b29d47d07ecb271cf4272f2e33cd
Instruction Fuzzy Hash: 5E115E21F4D64289FB19E711F851334E6A1AF89B82FC64036C90D47391DF7CB454836A

Function 00007FF7E8919E99 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoW.KERNELBASE ref: 00007FF7E8919EF6

Strings

GetFileVersionInfoW, xrefs: 00007FF7E8919EC3

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: FileInfoVersion
String ID: GetFileVersionInfoW
API String ID: 2427832333-2839375084
Opcode ID: 34ec14fac9a0f478101bc2e98b6ffa20347f39b93ccda09454dc23e251d56db1
Instruction ID: 277a297d0308fe295d3a2449a659fbcecd14ebc47eb44f15cd026ef068258493
Opcode Fuzzy Hash: 34ec14fac9a0f478101bc2e98b6ffa20347f39b93ccda09454dc23e251d56db1
Instruction Fuzzy Hash: 0EF0AF26F1CA5589EB00AB0AE400266E3A0BB89FE1FC90033EE4E43725DE3CD945C794

Function 00007FF7E8919E9F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7E8919B04: Sleep.KERNEL32 ref: 00007FF7E8919B27
Part of subcall function 00007FF7E8919B04: GetProcAddress.KERNEL32 ref: 00007FF7E8919B78

GetFileVersionInfoW.KERNELBASE ref: 00007FF7E8919EF6

Strings

GetFileVersionInfoW, xrefs: 00007FF7E8919EC3

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: AddressFileInfoProcSleepVersion
String ID: GetFileVersionInfoW
API String ID: 3824450226-2839375084
Opcode ID: 421b3e2f00236a42e45061b53ccc93a4ada7b6bbd2490c7aa6d5f2a0107762a5
Instruction ID: 071684056b32d31521da82c155093b2320be3981ec7222d1dd0b65841ef6284c
Opcode Fuzzy Hash: 421b3e2f00236a42e45061b53ccc93a4ada7b6bbd2490c7aa6d5f2a0107762a5
Instruction Fuzzy Hash: A3F09026F1CA5589EB10AB1AE0002A1D760FF8AFE1F891033EE4E47726DD3CD945C7A4

Function 00007FF7E8919F19 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7E8919B04: Sleep.KERNEL32 ref: 00007FF7E8919B27
Part of subcall function 00007FF7E8919B04: GetProcAddress.KERNEL32 ref: 00007FF7E8919B78

GetFileVersionInfoSizeExW.KERNELBASE ref: 00007FF7E8919F62

Strings

GetFileVersionInfoSizeW, xrefs: 00007FF7E8919F37

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: AddressFileInfoProcSizeSleepVersion
String ID: GetFileVersionInfoSizeW
API String ID: 1244426142-1049618512
Opcode ID: cc9d82f2052e14159793106c4286692e0a4072a1f5b6a2e07e9e0303faa10243
Instruction ID: b4c0d4f205e98a2175b9d165ee204e8d95ed590ba1c6f47d2d9a69719cfe8af8
Opcode Fuzzy Hash: cc9d82f2052e14159793106c4286692e0a4072a1f5b6a2e07e9e0303faa10243
Instruction Fuzzy Hash: DDF02015F3CA0985FE00E726A9846E4D3A2AF0CFC2BC90033ED0D03B25DE2CE0498725

Function 00007FF7E89197A0 Relevance: 3.0, APIs: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetProcessMitigationPolicy.KERNELBASE ref: 00007FF7E891980C
ExitProcess.KERNEL32 ref: 00007FF7E8919833

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: Process$ExitMitigationPolicy
String ID:
API String ID: 3700704341-0
Opcode ID: 52af363ce04a9a9eeeb758dbeeeb865ba09bd9b21323276ad8e72a61593e5a5c
Instruction ID: ce5d754195c2e4975af0c5f1d544d602cde0236f011cbe099b3018ab2973c094
Opcode Fuzzy Hash: 52af363ce04a9a9eeeb758dbeeeb865ba09bd9b21323276ad8e72a61593e5a5c
Instruction Fuzzy Hash: 96017172A0D3428EE711AF21D44832CBBA0A784F96FC54076DA0E47292CF7DD548C76A

Function 00007FF7E89197B8 Relevance: 3.0, APIs: 2, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetProcessMitigationPolicy.KERNELBASE ref: 00007FF7E891980C

Part of subcall function 00007FF7E8916068: GetVersionExW.KERNEL32(?,?,?,?,?,00007FF7E8919820), ref: 00007FF7E89160CB
Part of subcall function 00007FF7E8916068: GetCommandLineW.KERNEL32(?,?,?,?,?,00007FF7E8919820), ref: 00007FF7E8916114
Part of subcall function 00007FF7E8916068: GetStdHandle.KERNEL32(?,?,?,?,?,00007FF7E8919820), ref: 00007FF7E8916159
Part of subcall function 00007FF7E8916068: GetFileType.KERNEL32(?,?,?,?,?,00007FF7E8919820), ref: 00007FF7E8916175
Part of subcall function 00007FF7E8916068: memset.MSVCRT ref: 00007FF7E89161A2
Part of subcall function 00007FF7E8916068: memset.MSVCRT ref: 00007FF7E89161B3

Part of subcall function 00007FF7E891A41C: Sleep.KERNEL32 ref: 00007FF7E891A43C
Part of subcall function 00007FF7E891A41C: FreeLibrary.KERNEL32 ref: 00007FF7E891A47C

ExitProcess.KERNEL32 ref: 00007FF7E8919833

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: Processmemset$CommandExitFileFreeHandleLibraryLineMitigationPolicySleepTypeVersion
String ID:
API String ID: 602188099-0
Opcode ID: c7669f763c786de494d069e0ff3be336243fa498b43cf91ea31b1fc52bbf56f9
Instruction ID: aa574f592049e4a19eac18016c861cc75cbda974dd88e301469fbe802f993427
Opcode Fuzzy Hash: c7669f763c786de494d069e0ff3be336243fa498b43cf91ea31b1fc52bbf56f9
Instruction Fuzzy Hash: 3DF06972A1D6018AE710AF21D44833CFBA0A788F96F810135DB0E07392CF7CD6088B6A

Function 00007FF7E891A1F0 Relevance: 3.0, APIs: 2, Instructions: 26
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF7E891A21B

Part of subcall function 00007FF7E891A268: lstrlenW.KERNEL32 ref: 00007FF7E891A293

LoadLibraryExW.KERNELBASE ref: 00007FF7E891A236

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: LibraryLoadlstrlenmemset
String ID:
API String ID: 3555077121-0
Opcode ID: 2b8384b4d86d5728898a6951967ce037c9e2f01b717a0382e6ee51062ba76b2a
Instruction ID: f113ba4a162b9cf30fe7dc3fd2944e38497b1131f0865249f917cd06cdd3fdf5
Opcode Fuzzy Hash: 2b8384b4d86d5728898a6951967ce037c9e2f01b717a0382e6ee51062ba76b2a
Instruction Fuzzy Hash: 7EF0B411F1C6458AFA60E721F4953B9E3A0BB8C745FC54032CD8E46795DF3CD504CA15

Function 00007FF7E8918AE4 Relevance: 2.5, APIs: 2, Instructions: 35
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNELBASE ref: 00007FF7E8918B09
GlobalFree.KERNEL32 ref: 00007FF7E8918B36

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: Global$AllocFree
String ID:
API String ID: 3394109436-0
Opcode ID: 28f6b20f6e245442e9c14a1afeaa0e17bc81082526f95a64ff0aa38333002c26
Instruction ID: 6530df4e2140bf5c4fa365fdb8a5ee0d6a7cff83d6e6250d44f3fdcfee1da162
Opcode Fuzzy Hash: 28f6b20f6e245442e9c14a1afeaa0e17bc81082526f95a64ff0aa38333002c26
Instruction Fuzzy Hash: 5F0178B6F08B4586EB509F11F140278E7A6FB88BC5B9590B2DA4E27788CE3CE4419725

Non-executed Functions

Function 00007FF7E891819B Relevance: 82.8, APIs: 37, Strings: 10, Instructions: 502registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E8915BC8: EnterCriticalSection.KERNEL32(?,?,?,00007FF7E8914C91), ref: 00007FF7E8915BEB
Part of subcall function 00007FF7E8915BC8: SetServiceStatus.ADVAPI32(?,?,?,00007FF7E8914C91), ref: 00007FF7E8915C7D
Part of subcall function 00007FF7E8915BC8: GetLastError.KERNEL32(?,?,?,00007FF7E8914C91), ref: 00007FF7E8915C8F
Part of subcall function 00007FF7E8915BC8: LeaveCriticalSection.KERNEL32(?,?,?,00007FF7E8914C91), ref: 00007FF7E8915CB2

RegOpenKeyExW.ADVAPI32 ref: 00007FF7E8918221
RegCloseKey.ADVAPI32 ref: 00007FF7E8918235
CoUninitialize.OLE32 ref: 00007FF7E8918295

Strings

Set of COMGLB_UNMARSHALING_POLICY failed., xrefs: 00007FF7E89184E4
CoCreateInstance of CLSID_GlobalOptions failed., xrefs: 00007FF7E891847B
ServiceThreadMain: CreateWaitableTimer failed., xrefs: 00007FF7E891865B
CLSID, xrefs: 00007FF7E8918213
ServiceThreadMain: CreateSD for CreateWaitableTimer failed., xrefs: 00007FF7E8918521
ServiceThreadMain: Class registration failed, xrefs: 00007FF7E8918721
ServiceThreadMain: CoInitializeSecurity failed, xrefs: 00007FF7E891840D
ServiceThreadMain: SetWaitableTimer failed., xrefs: 00007FF7E89186A5
ServiceThreadMain: CreateEvent failed., xrefs: 00007FF7E89188BB
Wait Failed in MsgWait., xrefs: 00007FF7E8918860

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: CriticalSection$CloseEnterErrorLastLeaveOpenServiceStatusUninitialize
String ID: CLSID$CoCreateInstance of CLSID_GlobalOptions failed.$ServiceThreadMain: Class registration failed$ServiceThreadMain: CoInitializeSecurity failed$ServiceThreadMain: CreateEvent failed.$ServiceThreadMain: CreateSD for CreateWaitableTimer failed.$ServiceThreadMain: CreateWaitableTimer failed.$ServiceThreadMain: SetWaitableTimer failed.$Set of COMGLB_UNMARSHALING_POLICY failed.$Wait Failed in MsgWait.
API String ID: 3418182662-1806920385
Opcode ID: 6a3061fa050a037e0777b1285ed955ae12f30a5dc91b458fccddce1972e130ca
Instruction ID: 81d5196d6571dbd8be2d3f4b45e3547e630138a29ce162958be70c569cf60f25
Opcode Fuzzy Hash: 6a3061fa050a037e0777b1285ed955ae12f30a5dc91b458fccddce1972e130ca
Instruction Fuzzy Hash: 94325332E1CB428AE710AB20E8407B9F7A1FB89756FC25176D90D53A94DF3CE405C72A

Function 00007FF7E8913F08 Relevance: 62.2, APIs: 41, Instructions: 651memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 00007FF7E8914003
AllocateAndInitializeSid.ADVAPI32 ref: 00007FF7E8914054
AllocateAndInitializeSid.ADVAPI32 ref: 00007FF7E89140AA
AllocateAndInitializeSid.ADVAPI32 ref: 00007FF7E89140FB
AllocateAndInitializeSid.ADVAPI32 ref: 00007FF7E891414C
GetLastError.KERNEL32 ref: 00007FF7E8914191
AllocateAndInitializeSid.ADVAPI32 ref: 00007FF7E89141F8
AllocateAndInitializeSid.ADVAPI32 ref: 00007FF7E8914249
AllocateAndInitializeSid.ADVAPI32 ref: 00007FF7E891429B
GetLastError.KERNEL32 ref: 00007FF7E89142C5
AllocateAndInitializeSid.ADVAPI32 ref: 00007FF7E891432D
AllocateAndInitializeSid.ADVAPI32 ref: 00007FF7E891437F
GetLastError.KERNEL32 ref: 00007FF7E89143B0
GetLengthSid.ADVAPI32 ref: 00007FF7E8914736
memset.MSVCRT ref: 00007FF7E8914761
GlobalAlloc.KERNEL32 ref: 00007FF7E891477C

Part of subcall function 00007FF7E8912050: FreeSid.ADVAPI32 ref: 00007FF7E8912061

InitializeAcl.ADVAPI32 ref: 00007FF7E89147D3
GetLastError.KERNEL32 ref: 00007FF7E89147E3
AddAccessAllowedAce.ADVAPI32 ref: 00007FF7E891483C
GetAce.ADVAPI32 ref: 00007FF7E8914858
GetLastError.KERNEL32 ref: 00007FF7E891487D
GetLastError.KERNEL32 ref: 00007FF7E89148B2
InitializeSecurityDescriptor.ADVAPI32 ref: 00007FF7E89148F1
SetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF7E8914915
SetSecurityDescriptorOwner.ADVAPI32 ref: 00007FF7E8914934
SetSecurityDescriptorGroup.ADVAPI32 ref: 00007FF7E8914958
GetSecurityDescriptorLength.ADVAPI32 ref: 00007FF7E8914971
MakeSelfRelativeSD.ADVAPI32 ref: 00007FF7E89149BB
GetLastError.KERNEL32 ref: 00007FF7E89149CF
GetLastError.KERNEL32 ref: 00007FF7E8914A01
GetLastError.KERNEL32 ref: 00007FF7E8914A33

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: Initialize$Allocate$ErrorLast$DescriptorSecurity$Length$AccessAllocAllowedDaclFreeGlobalGroupMakeOwnerRelativeSelfmemset
String ID:
API String ID: 184327585-0
Opcode ID: 3e53a984ab9a09cdaf87335c43d58d78b36ca20ab92b1818f81e318e6f82d139
Instruction ID: f23d41dc989330c1b477baaa8038e5e0ce7b781ab0d46b3c3a0813cbcafc1f4b
Opcode Fuzzy Hash: 3e53a984ab9a09cdaf87335c43d58d78b36ca20ab92b1818f81e318e6f82d139
Instruction Fuzzy Hash: 74625136E0C6818EE720FF60E5442AEFBA5FB49789F910136DA4E07A54CF39D508CB15

Function 00007FF7E8915934 Relevance: 36.9, APIs: 12, Strings: 9, Instructions: 134registrystringCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7E8915966
RegQueryValueExW.ADVAPI32 ref: 00007FF7E89159EA
RegCloseKey.ADVAPI32 ref: 00007FF7E8915A0F
GlobalFree.KERNEL32 ref: 00007FF7E8915A27
RegCreateKeyExW.ADVAPI32 ref: 00007FF7E8915A9A
RegSetValueExW.ADVAPI32 ref: 00007FF7E8915ACC
lstrlenW.KERNEL32 ref: 00007FF7E8915ADB
RegSetValueExW.ADVAPI32 ref: 00007FF7E8915B0C
RegCloseKey.ADVAPI32 ref: 00007FF7E8915B1D
memset.MSVCRT ref: 00007FF7E8915B3F
OutputDebugStringW.KERNEL32 ref: 00007FF7E8915B81
SetLastError.KERNEL32 ref: 00007FF7E8915B8F

Strings

Software\Policies\Microsoft\Windows\Installer, xrefs: 00007FF7E8915993
(, xrefs: 00007FF7E8915A1B
Debug, xrefs: 00007FF7E89159BA
%s, xrefs: 00007FF7E8915B6D
LastErrorMessage, xrefs: 00007FF7E8915AEC
Software\Microsoft\Windows\CurrentVersion\Installer\CA, xrefs: 00007FF7E8915A73
LastError, xrefs: 00007FF7E8915AC5
Error: %d. %s., xrefs: 00007FF7E8915B57
P, xrefs: 00007FF7E89159DA

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: Value$CloseErrorLast$CreateDebugFreeGlobalOutputQueryStringlstrlenmemset
String ID: %s$($Debug$Error: %d. %s.$LastError$LastErrorMessage$P$Software\Microsoft\Windows\CurrentVersion\Installer\CA$Software\Policies\Microsoft\Windows\Installer
API String ID: 1456213479-33229316
Opcode ID: 1934c46f858a6605f24a883dcfe5e12d7309760ec1ca82aa7b59e2518b9afcdb
Instruction ID: b23694c12d3ee973b33adfa9a5ef48a9e4e6cdc939cb860149ab6c57573b1c49
Opcode Fuzzy Hash: 1934c46f858a6605f24a883dcfe5e12d7309760ec1ca82aa7b59e2518b9afcdb
Instruction Fuzzy Hash: 8C712A32E0CA82CAE750AF54F8407A9FBA1FB89756F824136DA8D43A64DF7CD144CB15

Function 00007FF7E8912F1C Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 183libraryfilestringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF7E8912F60
GetACP.KERNEL32 ref: 00007FF7E8912FA3
LoadLibraryW.KERNEL32 ref: 00007FF7E8912FB8
GetProcAddress.KERNEL32 ref: 00007FF7E8912FD6
GetLocaleInfoW.KERNEL32 ref: 00007FF7E891300D
FreeLibrary.KERNEL32 ref: 00007FF7E8913023
FormatMessageW.KERNEL32 ref: 00007FF7E8913056
memset.MSVCRT ref: 00007FF7E89130EF
GetVersionExW.KERNEL32 ref: 00007FF7E8913101
GlobalFree.KERNEL32 ref: 00007FF7E89131CF

Part of subcall function 00007FF7E8911668: RtlCaptureContext.NTDLL ref: 00007FF7E8911673
Part of subcall function 00007FF7E8911668: RtlLookupFunctionEntry.NTDLL ref: 00007FF7E8911692
Part of subcall function 00007FF7E8911668: RtlVirtualUnwind.NTDLL ref: 00007FF7E89116DF
Part of subcall function 00007FF7E8911668: __raise_securityfailure.LIBCMT ref: 00007FF7E8911755

lstrlenW.KERNEL32 ref: 00007FF7E89131EE
WriteFile.KERNEL32 ref: 00007FF7E8913216
WriteFile.KERNEL32 ref: 00007FF7E8913240

Strings

GetUserDefaultUILanguage, xrefs: 00007FF7E8912FCC
Install error %i, xrefs: 00007FF7E891308B
KERNEL32, xrefs: 00007FF7E8912FAF

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: FileFreeLibraryWritememset$AddressCaptureContextEntryFormatFunctionGlobalInfoLoadLocaleLookupMessageProcUnwindVersionVirtual__raise_securityfailurelstrlen
String ID: GetUserDefaultUILanguage$Install error %i$KERNEL32
API String ID: 1645863135-2065445882
Opcode ID: cb9bb31495b8f7418fba3d82e575b9c5bee1116f59fb527b316a64f763e2fb35
Instruction ID: 290e8fc3155bda4360310e9d771b88bcacf5e00963cd9dc61f1947c904db0988
Opcode Fuzzy Hash: cb9bb31495b8f7418fba3d82e575b9c5bee1116f59fb527b316a64f763e2fb35
Instruction Fuzzy Hash: 44915432A08B82CAE710AF21E4443B9FBA1FB89B56F824236DA5D437A4DF3CD505C715

Function 00007FF7E89135D4 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 135libraryloaderwindowCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00007FF7E891362D
GetProcAddress.KERNEL32 ref: 00007FF7E891364F
GetSystemDefaultLangID.KERNEL32 ref: 00007FF7E89136AA
memset.MSVCRT ref: 00007FF7E89136F8
FormatMessageW.KERNEL32 ref: 00007FF7E8913721
WideCharToMultiByte.KERNEL32 ref: 00007FF7E891376C

Part of subcall function 00007FF7E8911668: RtlCaptureContext.NTDLL ref: 00007FF7E8911673
Part of subcall function 00007FF7E8911668: RtlLookupFunctionEntry.NTDLL ref: 00007FF7E8911692
Part of subcall function 00007FF7E8911668: RtlVirtualUnwind.NTDLL ref: 00007FF7E89116DF
Part of subcall function 00007FF7E8911668: __raise_securityfailure.LIBCMT ref: 00007FF7E8911755

FreeLibrary.KERNEL32 ref: 00007FF7E89137F9

Strings

InstallStatusMIF, xrefs: 00007FF7E8913645
ISMIF32.DLL, xrefs: 00007FF7E8913617
Installer error %i, xrefs: 00007FF7E8913787

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: Library$AddressByteCaptureCharContextDefaultEntryFormatFreeFunctionLangLoadLookupMessageMultiProcSystemUnwindVirtualWide__raise_securityfailurememset
String ID: ISMIF32.DLL$InstallStatusMIF$Installer error %i
API String ID: 3890946596-4237920443
Opcode ID: d0e0cacd27651c0e51c91a67122bb4a75c903495f50469f0a13e5b486bf0ac05
Instruction ID: ccc765cd81209268d5685fff4a885fcc4aa8dd019e606daf4e1a64db1af4c566
Opcode Fuzzy Hash: d0e0cacd27651c0e51c91a67122bb4a75c903495f50469f0a13e5b486bf0ac05
Instruction Fuzzy Hash: 25516021E1CB428AF710AB11B844779F6A1FB89796F864236DD5E03BA4DF3CD045C72A

Function 00007FF7E89120BC Relevance: 15.1, APIs: 10, Instructions: 90threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00007FF7E89120F8
OpenThreadToken.ADVAPI32 ref: 00007FF7E8912117
GetLastError.KERNEL32 ref: 00007FF7E8912127
GetCurrentProcess.KERNEL32 ref: 00007FF7E891213A
OpenProcessToken.ADVAPI32 ref: 00007FF7E8912150
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF7E8912180
CloseHandle.KERNEL32 ref: 00007FF7E89121A7
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF7E89121D7
CloseHandle.KERNEL32 ref: 00007FF7E89121E8
GetLastError.KERNEL32 ref: 00007FF7E89121F4

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: Token$CloseCurrentErrorHandleLastOpenProcessThread$AdjustLookupPrivilegePrivilegesValue
String ID:
API String ID: 268630328-0
Opcode ID: 01e3451ac3059f7399d387cbb32b3dfd5507bde4beffe63b6664a9d4632ba818
Instruction ID: f1da58a44ef5b8c28a9cb237182ddd406ed1940f4f0e869762e8cf31790ea18f
Opcode Fuzzy Hash: 01e3451ac3059f7399d387cbb32b3dfd5507bde4beffe63b6664a9d4632ba818
Instruction Fuzzy Hash: AC414C32A18B81CAE750AF51E4402AEFBA1FB89B92F869136DE4E43714CF3CD445CB15

Function 00007FF7E89138C8 Relevance: 9.1, APIs: 6, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 00007FF7E891393F
GetLastError.KERNEL32 ref: 00007FF7E891394F
GetLengthSid.ADVAPI32 ref: 00007FF7E8913961
FreeSid.ADVAPI32 ref: 00007FF7E891397D

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: AllocateErrorFreeInitializeLastLength
String ID:
API String ID: 1611457584-0
Opcode ID: be8ae4226a28a24042c069a42d2651baacb3a613f5850007bf3a0631a8d9883c
Instruction ID: 965fa836d08304622dce336a7394e496505dcbb970fc3ced9c299ecbd63cb61d
Opcode Fuzzy Hash: be8ae4226a28a24042c069a42d2651baacb3a613f5850007bf3a0631a8d9883c
Instruction Fuzzy Hash: E8314832E18A51CEEB50AB60E8442ADFBB4FB49B85F824532DE4D53B14CF3CE4458B65

Function 00007FF7E8911AD4 Relevance: 9.0, APIs: 6, Instructions: 49timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7E8911B04
GetCurrentProcessId.KERNEL32 ref: 00007FF7E8911B12
GetCurrentThreadId.KERNEL32 ref: 00007FF7E8911B1E
GetTickCount.KERNEL32 ref: 00007FF7E8911B2A
GetTickCount.KERNEL32 ref: 00007FF7E8911B3A
QueryPerformanceCounter.KERNEL32 ref: 00007FF7E8911B55

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: CountCurrentTickTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 4104442557-0
Opcode ID: 15334446d3bfe052334fd3d83ac7d76e9822e339985e01ed7196eec3a427d2b1
Instruction ID: f036332619209b95e156197fad815de98fa2c15c21e9c364c46603782f8ee23f
Opcode Fuzzy Hash: 15334446d3bfe052334fd3d83ac7d76e9822e339985e01ed7196eec3a427d2b1
Instruction Fuzzy Hash: 8A113621B08F418EEB00EF70E894368B3A4FB49759F811A35EA5E47794DF7CD5948354

Function 00007FF7E8912A08 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 00007FF7E8912A2B
GetProcAddress.KERNEL32 ref: 00007FF7E8912A51

Strings

Msi.dll, xrefs: 00007FF7E8912A24
DllGetClassObject, xrefs: 00007FF7E8912A47

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: DllGetClassObject$Msi.dll
API String ID: 2574300362-3279299384
Opcode ID: 7a7f4cc9762f0404d66fa210fedae559aaa315c470d181184e87cda7238815a7
Instruction ID: de0f911755b971b5629fda7c9e00682c0cc7f7bf570b56dd0a9ea2d3b20cb5af
Opcode Fuzzy Hash: 7a7f4cc9762f0404d66fa210fedae559aaa315c470d181184e87cda7238815a7
Instruction Fuzzy Hash: D2214726E0DB4AC9EA00AB55E840365E7A1FB89B86F824537DA0D03370EF3CE845C725

Function 00007FF7E89191BC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

StartServiceCtrlDispatcherW.ADVAPI32 ref: 00007FF7E89191EB
GetLastError.KERNEL32 ref: 00007FF7E89191FB

Part of subcall function 00007FF7E8915934: GetLastError.KERNEL32 ref: 00007FF7E8915966
Part of subcall function 00007FF7E8915934: RegQueryValueExW.ADVAPI32 ref: 00007FF7E89159EA
Part of subcall function 00007FF7E8915934: RegCloseKey.ADVAPI32 ref: 00007FF7E8915A0F
Part of subcall function 00007FF7E8915934: GlobalFree.KERNEL32 ref: 00007FF7E8915A27
Part of subcall function 00007FF7E8915934: RegCreateKeyExW.ADVAPI32 ref: 00007FF7E8915A9A
Part of subcall function 00007FF7E8915934: RegSetValueExW.ADVAPI32 ref: 00007FF7E8915ACC
Part of subcall function 00007FF7E8915934: lstrlenW.KERNEL32 ref: 00007FF7E8915ADB
Part of subcall function 00007FF7E8915934: RegSetValueExW.ADVAPI32 ref: 00007FF7E8915B0C
Part of subcall function 00007FF7E8915934: RegCloseKey.ADVAPI32 ref: 00007FF7E8915B1D

Strings

MSIServer, xrefs: 00007FF7E89191CC
StartServiceCtrlDispatcher failed., xrefs: 00007FF7E8919209

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: Value$CloseErrorLast$CreateCtrlDispatcherFreeGlobalQueryServiceStartlstrlen
String ID: MSIServer$StartServiceCtrlDispatcher failed.
API String ID: 2998827721-520530687
Opcode ID: c59ed3f7e2a149577dac8587c8409470a3f41718c65d3b8651e9717f3779eb6e
Instruction ID: 96d915b4d63685debe46826e4f28464631e85eb8198e38a03c37cd37f4010657
Opcode Fuzzy Hash: c59ed3f7e2a149577dac8587c8409470a3f41718c65d3b8651e9717f3779eb6e
Instruction Fuzzy Hash: 98F0E766F1CB01CAEB40AB50E8483B8F6A5FB58712FC24136C61D46350EF3D9955C76A

Function 00007FF7E8913AF0 Relevance: 3.2, APIs: 2, Instructions: 221COMMON

Download Yara Rule

APIs

StgOpenStorage.OLE32 ref: 00007FF7E8913B3E

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: OpenStorage
String ID:
API String ID: 222319337-0
Opcode ID: 9dd22f2db73f029518cdd49393d27bb62fb0fb2953de28639cf637c3d8d2440c
Instruction ID: 148045e97819133d423cc11f4fc53ef61a11ecf4ebcca56749e71bacce873f42
Opcode Fuzzy Hash: 9dd22f2db73f029518cdd49393d27bb62fb0fb2953de28639cf637c3d8d2440c
Instruction Fuzzy Hash: C6A17B36F08A09CAEB109F6AD4407ADB7B1FB48BC9B424126CE0D57B64DF39D504C765

Function 00007FF7E8915DDC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 155librarystringloaderCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 00007FF7E8915E3F
GlobalFree.KERNEL32 ref: 00007FF7E8915E87

Part of subcall function 00007FF7E8918B64: GlobalAlloc.KERNEL32 ref: 00007FF7E8918B8C

CoInitialize.OLE32 ref: 00007FF7E8915EE0
GlobalFree.KERNEL32 ref: 00007FF7E8915EFE
LoadLibraryExW.KERNEL32 ref: 00007FF7E8915F1A
SetCurrentDirectoryW.KERNEL32 ref: 00007FF7E8915F33
GetLastError.KERNEL32 ref: 00007FF7E8915F43
SetThreadToken.ADVAPI32 ref: 00007FF7E8915F62
GetLastError.KERNEL32 ref: 00007FF7E8915F72
GetProcAddress.KERNEL32 ref: 00007FF7E8915F97
GetLastError.KERNEL32 ref: 00007FF7E8915FA8
FreeLibrary.KERNEL32 ref: 00007FF7E8915FDF
CoUninitialize.OLE32 ref: 00007FF7E8915FEB
GlobalFree.KERNEL32 ref: 00007FF7E8916008

Strings

DllRegisterServer, xrefs: 00007FF7E8915DE3

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: FreeGlobal$ErrorLast$Library$AddressAllocCurrentDirectoryInitializeLoadProcThreadTokenUninitializelstrlen
String ID: DllRegisterServer
API String ID: 1316943176-1663957109
Opcode ID: 6f3edc7648352c623a582051d70f155c2298b9925c4d64724b4387f3909674c8
Instruction ID: c8f145015ade146d0207736023620262cbb66d05ace16089a4dfe346976b3808
Opcode Fuzzy Hash: 6f3edc7648352c623a582051d70f155c2298b9925c4d64724b4387f3909674c8
Instruction Fuzzy Hash: 11519631E1CA42CAE7206B55E940379E6A1FF89B86F878136DA4E47794DF3CD4408626

Function 00007FF7E891A330 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 52libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 00007FF7E891A363
GetProcAddress.KERNEL32 ref: 00007FF7E891A385
GetLastError.KERNEL32 ref: 00007FF7E891A396
GetLastError.KERNEL32 ref: 00007FF7E891A3C4
FreeLibrary.KERNEL32 ref: 00007FF7E891A3D5
SetLastError.KERNEL32 ref: 00007FF7E891A3E3
GetSystemDirectoryW.KERNEL32 ref: 00007FF7E891A3F8

Strings

kernel32.dll, xrefs: 00007FF7E891A35C
GetSystemWow64DirectoryW, xrefs: 00007FF7E891A37B

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: ErrorLast$Library$AddressDirectoryFreeLoadProcSystem
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2916345467-1816364905
Opcode ID: 38b1984afccf70b739797175a4c4a5f79872d147ea3478e830a9498960fe5fb1
Instruction ID: 81c64c6e1254a4232948f15dd7091befab00ec6fa0e584d30292a72234629cb9
Opcode Fuzzy Hash: 38b1984afccf70b739797175a4c4a5f79872d147ea3478e830a9498960fe5fb1
Instruction Fuzzy Hash: FA214221E0DA42CAF7106B11A844379EA91FB8DB92BC68136C94E47354DF7CE846872A

Function 00007FF7E891A4B0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 44COMMON

Download Yara Rule

Strings

api-ms-win-core-delayload-l1-1-1.dll, xrefs: 00007FF7E891A4D9
ResolveDelayLoadedAPI, xrefs: 00007FF7E891A506
KERNEL32.DLL, xrefs: 00007FF7E891A4ED
ResolveDelayLoadsFromDll, xrefs: 00007FF7E891A521

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID:
String ID: KERNEL32.DLL$ResolveDelayLoadedAPI$ResolveDelayLoadsFromDll$api-ms-win-core-delayload-l1-1-1.dll
API String ID: 0-3594434003
Opcode ID: 6b239a1baf1f41045e421fdd87f65cc076a6d0727055c4f8a4304b728ac76abb
Instruction ID: fa8eca73e1d09c3ee60d7746bd4885f8ebc99e4a28e4d7c8b945e1846c485c36
Opcode Fuzzy Hash: 6b239a1baf1f41045e421fdd87f65cc076a6d0727055c4f8a4304b728ac76abb
Instruction Fuzzy Hash: 36112E20E4D74659FD15B710A6503B8E2926F44782FDA5436C80D0A795EE7CF850822A

Function 00007FF7E89180AE Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 51registrythreadCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerW.ADVAPI32 ref: 00007FF7E89180C4
GetLastError.KERNEL32 ref: 00007FF7E89180DC
CreateThread.KERNEL32 ref: 00007FF7E8918130
GetLastError.KERNEL32 ref: 00007FF7E8918144

Strings

MSIServer, xrefs: 00007FF7E89180BD
RegisterServiceCtrlHandler failed., xrefs: 00007FF7E89180EA

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: ErrorLast$CreateCtrlHandlerRegisterServiceThread
String ID: MSIServer$RegisterServiceCtrlHandler failed.
API String ID: 1655486688-870239898
Opcode ID: b2b1f7dcce0eb2376bba565d5b97fdf5dbd66057a7efad85d9a978250082064c
Instruction ID: 274a5243ab7f959356e66897676d11a629b019bdcb0a72315a1abac2dede4df3
Opcode Fuzzy Hash: b2b1f7dcce0eb2376bba565d5b97fdf5dbd66057a7efad85d9a978250082064c
Instruction Fuzzy Hash: 6B215031E1CB42CAF750AB10F8012B9F691EF49766FC68276C91D136A0DF3CA145876A

Function 00007FF7E8913280 Relevance: 11.4, APIs: 9, Instructions: 148stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 00007FF7E8913326
lstrlenW.KERNEL32 ref: 00007FF7E8913337
lstrlenW.KERNEL32 ref: 00007FF7E891334C
GlobalFree.KERNEL32 ref: 00007FF7E891338E
GlobalFree.KERNEL32 ref: 00007FF7E89133E9
lstrlenW.KERNEL32 ref: 00007FF7E8913361

Part of subcall function 00007FF7E8918BE4: GlobalAlloc.KERNEL32 ref: 00007FF7E8918C0C

lstrlenW.KERNEL32 ref: 00007FF7E891341C
lstrlenW.KERNEL32 ref: 00007FF7E891342D
GlobalFree.KERNEL32 ref: 00007FF7E8913508

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: lstrlen$Global$Free$Alloc
String ID:
API String ID: 1395816572-0
Opcode ID: 668792ee54a1b49304227f55d51ffe2347cdf3a3d805d71e0306c8ef54d9d055
Instruction ID: 64ebeefe44fa0ec4dbd05ea8ee94d7fa553419831d921fafc0ad6f66b05b3862
Opcode Fuzzy Hash: 668792ee54a1b49304227f55d51ffe2347cdf3a3d805d71e0306c8ef54d9d055
Instruction Fuzzy Hash: 98711021E0CA468EE610AB25E8803B9F7A1FF89B56F864133D94E43265DF3CE545C729

Function 00007FF7E8913544 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7E891355C
GetProcAddress.KERNEL32 ref: 00007FF7E8913578
FreeLibrary.KERNEL32 ref: 00007FF7E89135A2
FreeLibrary.KERNEL32 ref: 00007FF7E89135B7

Strings

QueryInstanceCount, xrefs: 00007FF7E8913571
Msi.dll, xrefs: 00007FF7E8913553

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: FreeLibrary$AddressHandleModuleProc
String ID: Msi.dll$QueryInstanceCount
API String ID: 1227796897-1207408768
Opcode ID: f1349819d9c6486063a1e120f8d81926f278f2e7c32421e298db31df53d9dc2b
Instruction ID: 4c0536fb48caa607e621055b97b39078f36b88bb862d2bcf36bf569e33694c7b
Opcode Fuzzy Hash: f1349819d9c6486063a1e120f8d81926f278f2e7c32421e298db31df53d9dc2b
Instruction Fuzzy Hash: 3F011A22E2DA42CAEA006B20E840379F662FF89B46FC29432D54E47264CF3CD045C725

Function 00007FF7E8914CAC Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 125stringCOMMON

Download Yara Rule

APIs

lstrcmpW.KERNEL32 ref: 00007FF7E8914DD4
lstrcmpW.KERNEL32 ref: 00007FF7E8914DEE
lstrcmpW.KERNEL32 ref: 00007FF7E8914E08

Strings

*, xrefs: 00007FF7E8914D13
mewuifsoarpcvxgh!, xrefs: 00007FF7E8914CF4
d, xrefs: 00007FF7E8914D1F

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: lstrcmp
String ID: *$d$mewuifsoarpcvxgh!
API String ID: 1534048567-4240403005
Opcode ID: 7dedc2b983e11988325de8d7993be4d00050d57ab70692e2ed95e52a84574ce0
Instruction ID: 96ac9ce527d40e00c509060463809f0b503b180a59194548b590e2de268f7bf8
Opcode Fuzzy Hash: 7dedc2b983e11988325de8d7993be4d00050d57ab70692e2ed95e52a84574ce0
Instruction Fuzzy Hash: 40411E62E1C65189EB216F119640375E6A2FF48B92FC68036DE4E07A80DF3CE881C765

Function 00007FF7E8915BC8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00007FF7E8914C91), ref: 00007FF7E8915BEB
SetServiceStatus.ADVAPI32(?,?,?,00007FF7E8914C91), ref: 00007FF7E8915C7D
GetLastError.KERNEL32(?,?,?,00007FF7E8914C91), ref: 00007FF7E8915C8F

Part of subcall function 00007FF7E8913544: GetModuleHandleExW.KERNEL32 ref: 00007FF7E891355C
Part of subcall function 00007FF7E8913544: GetProcAddress.KERNEL32 ref: 00007FF7E8913578
Part of subcall function 00007FF7E8913544: FreeLibrary.KERNEL32 ref: 00007FF7E89135A2

LeaveCriticalSection.KERNEL32(?,?,?,00007FF7E8914C91), ref: 00007FF7E8915CB2

Strings

SetServiceStatus failed., xrefs: 00007FF7E8915C9D

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: CriticalSection$AddressEnterErrorFreeHandleLastLeaveLibraryModuleProcServiceStatus
String ID: SetServiceStatus failed.
API String ID: 2790535729-1344523210
Opcode ID: 1230dbb4035e627e326862703a5e925e3ea7e4a73df9a64648f7d83e94656031
Instruction ID: a8b8ac86964edd99a093caf577c4962d7f3fba735ce440fb8bcb0c86f579ea3b
Opcode Fuzzy Hash: 1230dbb4035e627e326862703a5e925e3ea7e4a73df9a64648f7d83e94656031
Instruction Fuzzy Hash: 3231E575E1C6428AEB60BF55F890278FAA1AB88746FD74137C90D43260DF3CA445CB2A

Function 00007FF7E8914A8C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 00007FF7E8914A90
GetModuleHandleW.KERNEL32 ref: 00007FF7E8914AAB
GetProcAddress.KERNEL32 ref: 00007FF7E8914AC6

Strings

Kernel32.dll, xrefs: 00007FF7E8914AA4
HeapSetInformation, xrefs: 00007FF7E8914ABC

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: AddressHandleModuleProcVersion
String ID: HeapSetInformation$Kernel32.dll
API String ID: 3310240892-3460614246
Opcode ID: e06b0d96157770a1b07050612fd5048407fe3fa93e44e060f159265d7615af8e
Instruction ID: 3979f056950bc5f0dd752cfcfa0a603259bda377ece0f34c18e200a511ea6679
Opcode Fuzzy Hash: e06b0d96157770a1b07050612fd5048407fe3fa93e44e060f159265d7615af8e
Instruction Fuzzy Hash: 1FF01D71E0D6428AFB047B54A845778EBA2FF89B02BC69036C90E03664DF7CA015C72E

Function 00007FF7E89152DC Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF7E8915110
memcpy.MSVCRT ref: 00007FF7E8915175
memcpy.MSVCRT ref: 00007FF7E89152A5

Strings

RUVEH?IJDqXFAtPYZlgmnc, xrefs: 00007FF7E8915083, 00007FF7E8915243

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: memcpy
String ID: RUVEH?IJDqXFAtPYZlgmnc
API String ID: 3510742995-3312014676
Opcode ID: 6832e74108f691214abf77114a38d05b580e507a555a7f4506417be30c4c9d20
Instruction ID: 35d4b40e37581c5baa15ca989ea065217e10d77dbfd897c0f68cc59a39dcf0b2
Opcode Fuzzy Hash: 6832e74108f691214abf77114a38d05b580e507a555a7f4506417be30c4c9d20
Instruction Fuzzy Hash: 9771BD27F0AB4589EB55EF95E4402B9F3A0EB48F84B868432DA5D03795EF3CE541C325

Function 00007FF7E89157BF Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 83COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF7E89157D5
_wcsicmp.MSVCRT ref: 00007FF7E891581B

Strings

rpoedcamusv, xrefs: 00007FF7E8915888
', xrefs: 00007FF7E89157E0
PackageCode, xrefs: 00007FF7E89157EF

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: _wcsicmpmemset
String ID: '$PackageCode$rpoedcamusv
API String ID: 2241082953-3710158643
Opcode ID: 9916245b60fe63e4baf26bf2d59dc9197fba7a455b37bcfbcba3cfb3deffdb07
Instruction ID: 4fcaa60ae900dd09608cd023c225273d0419ec3293963a26e86a03ca70d0264e
Opcode Fuzzy Hash: 9916245b60fe63e4baf26bf2d59dc9197fba7a455b37bcfbcba3cfb3deffdb07
Instruction Fuzzy Hash: BE31A262E0D6828AEB20AB60D8503F8F7A0EB8575AFC74037C64E47594DF3CD545C716

Function 00007FF7E8912D8E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 00007FF7E8912DB5
GetProcAddress.KERNEL32 ref: 00007FF7E8912DDB

Strings

Msi.dll, xrefs: 00007FF7E8912DAE
DllGetClassObject, xrefs: 00007FF7E8912DD1

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: DllGetClassObject$Msi.dll
API String ID: 2574300362-3279299384
Opcode ID: 893df179fb33a4be07870beaa0bb73193369531d23840f6915495b247665a893
Instruction ID: 9b2d3dc8503b2dc6cf479b41c1f4f2beda140bf6c1dd6aaf1b936ded805bfe56
Opcode Fuzzy Hash: 893df179fb33a4be07870beaa0bb73193369531d23840f6915495b247665a893
Instruction Fuzzy Hash: 8D41272AA19B0AC9EB00AF15E8403A9E771FB89F96F824133DA0D07364DF3DD405C329

Function 00007FF7E8919904 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43librarysleeploaderCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00007FF7E8919927
LoadLibraryW.KERNEL32 ref: 00007FF7E8919951
GetProcAddress.KERNEL32 ref: 00007FF7E891997F

Strings

COMCTL32, xrefs: 00007FF7E891994A

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: AddressLibraryLoadProcSleep
String ID: COMCTL32
API String ID: 188063004-3719691325
Opcode ID: 00dff6005eda7ee8aadd4f1cc6cb64e4eaa46939875f1bf53faa5944decd763d
Instruction ID: b4af059feb185e9e320c74130542785aa565b7d1df6572af1d8eedd5a3bc4ebe
Opcode Fuzzy Hash: 00dff6005eda7ee8aadd4f1cc6cb64e4eaa46939875f1bf53faa5944decd763d
Instruction Fuzzy Hash: C0117021E0D6428AEF14AB15F990374E7E0AF49B46FC68036C90E07395DF3CA454876A

Function 00007FF7E8911490 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00007FF7E8911503
RtlLookupFunctionEntry.NTDLL ref: 00007FF7E8911522
RtlVirtualUnwind.NTDLL ref: 00007FF7E891156F
__raise_securityfailure.LIBCMT ref: 00007FF7E8911654

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: 490ce7c50a8e91f8c655fb75a019fbf1c3b37b72a524ee5533afb72fceb4fd44
Instruction ID: 3e4e26548fdc6534794a0fa04e136e5ce4362198373a4f50c4d7595ccd2164c8
Opcode Fuzzy Hash: 490ce7c50a8e91f8c655fb75a019fbf1c3b37b72a524ee5533afb72fceb4fd44
Instruction Fuzzy Hash: 2B41A135E08B01C5EA50AB18F880369F7A4FB88795FD24137D98E42B65DF3CE444C72A

Function 00007FF7E89111FB Relevance: 6.1, APIs: 4, Instructions: 72sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E8911AD4: GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7E8911B04
Part of subcall function 00007FF7E8911AD4: GetCurrentProcessId.KERNEL32 ref: 00007FF7E8911B12
Part of subcall function 00007FF7E8911AD4: GetCurrentThreadId.KERNEL32 ref: 00007FF7E8911B1E
Part of subcall function 00007FF7E8911AD4: GetTickCount.KERNEL32 ref: 00007FF7E8911B2A
Part of subcall function 00007FF7E8911AD4: GetTickCount.KERNEL32 ref: 00007FF7E8911B3A
Part of subcall function 00007FF7E8911AD4: QueryPerformanceCounter.KERNEL32 ref: 00007FF7E8911B55

GetStartupInfoW.KERNEL32 ref: 00007FF7E8911235
_amsg_exit.MSVCRT ref: 00007FF7E8911270
Sleep.KERNEL32 ref: 00007FF7E891127F
_initterm.MSVCRT ref: 00007FF7E8911317
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7E8911344
exit.MSVCRT ref: 00007FF7E89113E0
_cexit.MSVCRT ref: 00007FF7E89113EF

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: Current$CountTickTime$CounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThread_amsg_exit_cexit_inittermexit
String ID:
API String ID: 1267577977-0
Opcode ID: 91652315ba1fe01f8a8ece5ff59dbdf3c3f9a09bce4cf743121d1b7903586ae2
Instruction ID: 390f329b79f70980b16f5854776f70c0caf9c8644b07f9be1d5aa7490283c0a0
Opcode Fuzzy Hash: 91652315ba1fe01f8a8ece5ff59dbdf3c3f9a09bce4cf743121d1b7903586ae2
Instruction Fuzzy Hash: 2F31A021E0C6469AF760BB11E840379E3A1FF44392FC61033D95D83AA5DF3CE861832A

Function 00007FF7E89114EB Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00007FF7E8911503
RtlLookupFunctionEntry.NTDLL ref: 00007FF7E8911522
RtlVirtualUnwind.NTDLL ref: 00007FF7E891156F
__raise_securityfailure.LIBCMT ref: 00007FF7E8911654

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: 8036299c976cbf79c85cdaf7c77a2991928e780fec2f487019bb539a5fcbceb1
Instruction ID: bad973f80810181fc766b7a88eb6517dab18c2b74e94241226680e87d1de9436
Opcode Fuzzy Hash: 8036299c976cbf79c85cdaf7c77a2991928e780fec2f487019bb539a5fcbceb1
Instruction Fuzzy Hash: 2D31D135A08B41C5EA00EB18F88036AF7A4FB88795F914137DA8E43B65DF3CE448C729

Function 00007FF7E8911668 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00007FF7E8911673
RtlLookupFunctionEntry.NTDLL ref: 00007FF7E8911692
RtlVirtualUnwind.NTDLL ref: 00007FF7E89116DF
__raise_securityfailure.LIBCMT ref: 00007FF7E8911755

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: 5ee8373863b9369710b00ab6f7017c7510acf0e01d4016d202edef6e17d6c05a
Instruction ID: 84512b265071f31528ffca55dc1a535f5ebe063ef2b6bf20d332ccd70d7d1827
Opcode Fuzzy Hash: 5ee8373863b9369710b00ab6f7017c7510acf0e01d4016d202edef6e17d6c05a
Instruction Fuzzy Hash: 9D21CC35A08B4186E640AB04F880369E7A0FB88786F920137EA8D42B64DF3DE044C769

Function 00007FF7E8914EB4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134COMMON

Download Yara Rule

APIs

IsCharAlphaNumericW.USER32 ref: 00007FF7E8914EDA

Strings

Property value is too long., xrefs: 00007FF7E8914FCD

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: AlphaCharNumeric
String ID: Property value is too long.
API String ID: 1535711457-2228807622
Opcode ID: 8e0ad987d59236390a4f43091e0f694375a61cd59cd5f835ced690290484a853
Instruction ID: 5371f14183a9777ef094f47004b1e67a0d67e3cb0f7f99bf1395e2c435644e29
Opcode Fuzzy Hash: 8e0ad987d59236390a4f43091e0f694375a61cd59cd5f835ced690290484a853
Instruction Fuzzy Hash: 3C41B516E1C56289EA64AB459650378F291EB08B93BCA4133EA9D477C0DF3CE851C336

Function 00007FF7E89199B4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42sleeplibraryloaderCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00007FF7E89199D7
GetProcAddress.KERNEL32 ref: 00007FF7E8919A28

Strings

KERNEL32, xrefs: 00007FF7E89199FA

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: AddressProcSleep
String ID: KERNEL32
API String ID: 1175476452-1217789123
Opcode ID: 38c5cfa0107da9405b392d4bc92fa26bb61fbe6a5fa62d6bbdd67ebadddc9319
Instruction ID: 0b976bac90691b447d296e74c0f0635cfab4f733e7227951607cb71f66501b52
Opcode Fuzzy Hash: 38c5cfa0107da9405b392d4bc92fa26bb61fbe6a5fa62d6bbdd67ebadddc9319
Instruction Fuzzy Hash: 59115B21F0D68289FF15A715B951374E6A0AF09B82FC68036C90E473A5EF7CB458832A

Function 00007FF7E8919A5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42sleeplibraryloaderCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00007FF7E8919A7F
GetProcAddress.KERNEL32 ref: 00007FF7E8919AD0

Strings

OLE32, xrefs: 00007FF7E8919AA2

Memory Dump Source

Source File: 00000000.00000002.1704607522.00007FF7E8911000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E8910000, based on PE: true

Associated: 00000000.00000002.1704593717.00007FF7E8910000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704622754.00007FF7E891B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704637002.00007FF7E891F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1704651245.00007FF7E8922000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e8910000_msiexec.jbxd

Similarity

API ID: AddressProcSleep
String ID: OLE32
API String ID: 1175476452-2276369563
Opcode ID: b016953d975994a3ed2598a1728dbb971f069d0f324b54cc20d20637c5f59208
Instruction ID: d2d15cbcc7a14d5f50ab9722fdedb188b983cb2166b327b6e9b3e3c6c63ecbc3
Opcode Fuzzy Hash: b016953d975994a3ed2598a1728dbb971f069d0f324b54cc20d20637c5f59208
Instruction Fuzzy Hash: 0A115E21E0D64289FF19AB11F951335E6A0AF49B86FCA8036C90D47391DF3CB558876A

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report msiexec.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Compliance

System Summary

Data Obfuscation

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: msiexec.exePID: 7352, Parent PID: 2580

General

Chronological Activities

Disassembly

Analysis Process: msiexec.exePID: 7352, Parent PID: 2580COMMON

Execution Graph

Graph

Executed Functions

Function 00007FF7E8916068 Relevance: 234.5, APIs: 94, Strings: 39, Instructions: 1784registrystringCOMMON

Function 00007FF7E891A560 Relevance: 9.1, APIs: 6, Instructions: 101libraryloaderCOMMON

Control-flow Graph

Function 00007FF7E89118FE Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Windows Analysis Report
msiexec.exe

Function 00007FF7E891A560 Relevance: 9.1, APIs: 6, Instructions: 101
libraryloaderCOMMON

Function 00007FF7E89118FE Relevance: 1.5, APIs: 1, Instructions: 7
COMMON

Function 00007FF7E8918DCC Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 196
memoryCOMMON

Function 00007FF7E8918DD0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 196
memoryCOMMON

Function 00007FF7E8911200 Relevance: 12.1, APIs: 8, Instructions: 138
sleepCOMMON

Function 00007FF7E8918F06 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 133
memoryCOMMON

Function 00007FF7E891985C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35
librarysleeploaderCOMMON

Function 00007FF7E8919B04 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42
sleeplibraryloaderCOMMON

Function 00007FF7E8919E99 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33
COMMON

Function 00007FF7E8919E9F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30
COMMON

Function 00007FF7E8919F19 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 28
COMMON

Function 00007FF7E89197A0 Relevance: 3.0, APIs: 2, Instructions: 30
COMMON

Function 00007FF7E89197B8 Relevance: 3.0, APIs: 2, Instructions: 26
COMMON

Function 00007FF7E891A1F0 Relevance: 3.0, APIs: 2, Instructions: 26
libraryCOMMON

Function 00007FF7E8918AE4 Relevance: 2.5, APIs: 2, Instructions: 35
memoryCOMMON