Windows Analysis Report
66fd8d779da5e_EscortsRadios.exe

Overview

General Information

Sample name: 66fd8d779da5e_EscortsRadios.exe
Analysis ID: 1525251
MD5: 9f2aa036b01b51f6ce185d8c2410c22a
SHA1: b8fa58866b466500c34a5317d3de447bd9b4cd3e
SHA256: beb7a3127427fa0560207cdb0becfebb2ed1c6d8dad335d3b3266ec741cdd495
Tags: exeuser-aachum
Infos:

Detection

Score: 76
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Sigma detected: Drops script at startup location
Sigma detected: Search for Antivirus process
AI detected suspicious sample
Drops PE files with a suspicious file extension
Machine Learning detection for sample
Sigma detected: WScript or CScript Dropper
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Creates files inside the system directory
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found WSH timer for Javascript or VBS script (likely evasive script)
Found evasive API chain (date check)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Execution of Suspicious File Type Extension
Sigma detected: SCR File Write Event
Sigma detected: Suspicious Screensaver Binary File Creation
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores files to the Windows start menu directory
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

AV Detection
barindex
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 92.8% probability
Machine Learning detection for sample
Source: 66fd8d779da5e_EscortsRadios.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: 66fd8d779da5e_EscortsRadios.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: 66fd8d779da5e_EscortsRadios.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Code function: 0_2_004062D5 FindFirstFileW,FindClose, 0_2_004062D5
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Code function: 0_2_00402E18 FindFirstFileW, 0_2_00402E18
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 0_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FF4005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 10_2_00FF4005
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FF494A GetFileAttributesW,FindFirstFileW,FindClose, 10_2_00FF494A
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FF3CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 10_2_00FF3CE2
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FFC2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose, 10_2_00FFC2FF
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FFCD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, 10_2_00FFCD9F
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FFCD14 FindFirstFileW,FindClose, 10_2_00FFCD14
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FFF5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 10_2_00FFF5D8
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FFF735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 10_2_00FFF735
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FFFA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose, 10_2_00FFFA36
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00B24005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 18_2_00B24005
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00B2494A GetFileAttributesW,FindFirstFileW,FindClose, 18_2_00B2494A
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00B2C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose, 18_2_00B2C2FF
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00B2CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, 18_2_00B2CD9F
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00B2CD14 FindFirstFileW,FindClose, 18_2_00B2CD14
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00B2F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 18_2_00B2F5D8
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00B2F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 18_2_00B2F735
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00B2FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose, 18_2_00B2FA36
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00B23CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 18_2_00B23CE2
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\Temp\527294\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\Temp\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\Temp\527294 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\ Jump to behavior
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Source: unknown DNS traffic detected: query: fojjIZmGBFVhLMWz.fojjIZmGBFVhLMWz replaycode: Name error (3)
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_010029BA InternetReadFile,InternetQueryDataAvailable,InternetReadFile, 10_2_010029BA
Source: global traffic DNS traffic detected: DNS query: fojjIZmGBFVhLMWz.fojjIZmGBFVhLMWz
Source: 66fd8d779da5e_EscortsRadios.exe, 00000000.00000003.1745574045.00000000027D9000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000002.2981207824.0000000003865000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000003.1801920915.0000000004182000.00000004.00000800.00020000.00000000.sdmp, Liechtenstein.0.dr, Miniature.pif.1.dr, DatumHub.scr.10.dr String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: 66fd8d779da5e_EscortsRadios.exe, 00000000.00000003.1745574045.00000000027D9000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000002.2981207824.0000000003865000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000003.1801920915.0000000004182000.00000004.00000800.00020000.00000000.sdmp, Liechtenstein.0.dr, Miniature.pif.1.dr, DatumHub.scr.10.dr String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: 66fd8d779da5e_EscortsRadios.exe, 00000000.00000003.1745574045.00000000027D9000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000002.2981207824.0000000003865000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000003.1801920915.0000000004182000.00000004.00000800.00020000.00000000.sdmp, Liechtenstein.0.dr, Miniature.pif.1.dr, DatumHub.scr.10.dr String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: 66fd8d779da5e_EscortsRadios.exe, 00000000.00000003.1745574045.00000000027D9000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000002.2981207824.0000000003865000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000003.1801920915.0000000004182000.00000004.00000800.00020000.00000000.sdmp, Liechtenstein.0.dr, Miniature.pif.1.dr, DatumHub.scr.10.dr String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: 66fd8d779da5e_EscortsRadios.exe String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: 66fd8d779da5e_EscortsRadios.exe, 00000000.00000003.1745574045.00000000027D9000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000002.2981207824.0000000003865000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000003.1801920915.0000000004182000.00000004.00000800.00020000.00000000.sdmp, Liechtenstein.0.dr, Miniature.pif.1.dr, DatumHub.scr.10.dr String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: 66fd8d779da5e_EscortsRadios.exe, 00000000.00000003.1745574045.00000000027D9000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000002.2981207824.0000000003865000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000003.1801920915.0000000004182000.00000004.00000800.00020000.00000000.sdmp, Liechtenstein.0.dr, Miniature.pif.1.dr, DatumHub.scr.10.dr String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: 66fd8d779da5e_EscortsRadios.exe, 00000000.00000003.1745574045.00000000027D9000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000002.2981207824.0000000003865000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000003.1801920915.0000000004182000.00000004.00000800.00020000.00000000.sdmp, Liechtenstein.0.dr, Miniature.pif.1.dr, DatumHub.scr.10.dr String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: 66fd8d779da5e_EscortsRadios.exe, 00000000.00000003.1745574045.00000000027D9000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000002.2981207824.0000000003865000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000003.1801920915.0000000004182000.00000004.00000800.00020000.00000000.sdmp, Liechtenstein.0.dr, Miniature.pif.1.dr, DatumHub.scr.10.dr String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: 66fd8d779da5e_EscortsRadios.exe, 00000000.00000003.1745574045.00000000027D9000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000002.2981207824.0000000003865000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000003.1801920915.0000000004182000.00000004.00000800.00020000.00000000.sdmp, Liechtenstein.0.dr, Miniature.pif.1.dr, DatumHub.scr.10.dr String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: 66fd8d779da5e_EscortsRadios.exe, 00000000.00000003.1745574045.00000000027D9000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000000.1784235440.0000000001059000.00000002.00000001.01000000.00000006.sdmp, Miniature.pif, 0000000A.00000003.1801920915.0000000004182000.00000004.00000800.00020000.00000000.sdmp, DatumHub.scr, 00000012.00000002.2979969921.0000000000B89000.00000002.00000001.01000000.00000008.sdmp, Liechtenstein.0.dr, Miniature.pif.1.dr, DatumHub.scr.10.dr String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: 66fd8d779da5e_EscortsRadios.exe, 00000000.00000003.1745574045.00000000027D9000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000002.2981207824.0000000003865000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000003.1801920915.0000000004182000.00000004.00000800.00020000.00000000.sdmp, Liechtenstein.0.dr, Miniature.pif.1.dr, DatumHub.scr.10.dr String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: DatumHub.scr.10.dr String found in binary or memory: https://www.globalsign.com/repository/0
Source: 66fd8d779da5e_EscortsRadios.exe, 00000000.00000003.1745574045.00000000027D9000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000002.2981207824.0000000003865000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000003.1801920915.0000000004182000.00000004.00000800.00020000.00000000.sdmp, Liechtenstein.0.dr, Miniature.pif.1.dr, DatumHub.scr.10.dr String found in binary or memory: https://www.globalsign.com/repository/06
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Code function: 0_2_004050CD GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 0_2_004050CD
Contains functionality to modify clipboard data
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_01004830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard, 10_2_01004830
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00B34830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard, 18_2_00B34830
Contains functionality to read the clipboard data
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_01004632 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard, 10_2_01004632
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Code function: 0_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 0_2_004044A5
Potential key logger detected (key state polling based)
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_0101D164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW, 10_2_0101D164
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00B4D164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW, 18_2_00B4D164

System Summary
barindex
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Source: C:\Windows\System32\wscript.exe COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8} Jump to behavior
Contains functionality to communicate with device drivers
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FF42D5: CreateFileW,DeviceIoControl,CloseHandle, 10_2_00FF42D5
Contains functionality to launch a process as a different user
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FE8F2E _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock, 10_2_00FE8F2E
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Code function: 0_2_00403883 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,InitOnceBeginInitialize,ExitWindowsEx, 0_2_00403883
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FF5778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState, 10_2_00FF5778
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00B25778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState, 18_2_00B25778
Creates files inside the system directory
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe File created: C:\Windows\ReceivingPlugins Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe File created: C:\Windows\AttentionStd Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe File created: C:\Windows\HomesLand Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe File created: C:\Windows\ChangelogBriefly Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Code function: 0_2_0040497C 0_2_0040497C
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Code function: 0_2_00406ED2 0_2_00406ED2
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Code function: 0_2_004074BB 0_2_004074BB
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00F9B020 10_2_00F9B020
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00F994E0 10_2_00F994E0
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00F99C80 10_2_00F99C80
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FB23F5 10_2_00FB23F5
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_01018400 10_2_01018400
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FC6502 10_2_00FC6502
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00F9E6F0 10_2_00F9E6F0
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FC265E 10_2_00FC265E
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FB282A 10_2_00FB282A
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FC89BF 10_2_00FC89BF
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FC6A74 10_2_00FC6A74
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FA0BE0 10_2_00FA0BE0
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_01010A3A 10_2_01010A3A
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FEEDB2 10_2_00FEEDB2
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FBCD51 10_2_00FBCD51
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FF8E44 10_2_00FF8E44
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FC6FE6 10_2_00FC6FE6
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_01010EB7 10_2_01010EB7
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FB33B7 10_2_00FB33B7
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FAD45D 10_2_00FAD45D
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FBF409 10_2_00FBF409
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FB16B4 10_2_00FB16B4
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00F9F6A0 10_2_00F9F6A0
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00F91663 10_2_00F91663
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FAF628 10_2_00FAF628
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FB78C3 10_2_00FB78C3
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FB1BA8 10_2_00FB1BA8
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FBDBA5 10_2_00FBDBA5
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FC9CE5 10_2_00FC9CE5
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FADD28 10_2_00FADD28
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FBBFD6 10_2_00FBBFD6
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FB1FC0 10_2_00FB1FC0
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00ACB020 18_2_00ACB020
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00AC94E0 18_2_00AC94E0
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00AC9C80 18_2_00AC9C80
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00AE23F5 18_2_00AE23F5
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00B48400 18_2_00B48400
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00AF6502 18_2_00AF6502
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00ACE6F0 18_2_00ACE6F0
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00AF265E 18_2_00AF265E
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00AE282A 18_2_00AE282A
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00AF89BF 18_2_00AF89BF
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00B40A3A 18_2_00B40A3A
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00AF6A74 18_2_00AF6A74
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00AD0BE0 18_2_00AD0BE0
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00B1EDB2 18_2_00B1EDB2
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00AECD51 18_2_00AECD51
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00B40EB7 18_2_00B40EB7
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00B28E44 18_2_00B28E44
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00AF6FE6 18_2_00AF6FE6
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00AE33B7 18_2_00AE33B7
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00AEF409 18_2_00AEF409
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00ADD45D 18_2_00ADD45D
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00ACF6A0 18_2_00ACF6A0
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00AE16B4 18_2_00AE16B4
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00ADF628 18_2_00ADF628
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00AC1663 18_2_00AC1663
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00AE78C3 18_2_00AE78C3
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00AE1BA8 18_2_00AE1BA8
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00AEDBA5 18_2_00AEDBA5
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00AF9CE5 18_2_00AF9CE5
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00ADDD28 18_2_00ADDD28
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00AE1FC0 18_2_00AE1FC0
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00AEBFD6 18_2_00AEBFD6
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Code function: String function: 004062A3 appears 58 times
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: String function: 00AD1A36 appears 34 times
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: String function: 00AE8B30 appears 42 times
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: String function: 00AE0D17 appears 70 times
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: String function: 00FB8B30 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: String function: 00FA1A36 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: String function: 00FB0D17 appears 70 times
Sample file is different than original file name gathered from version info
Source: 66fd8d779da5e_EscortsRadios.exe, 00000000.00000002.1750126816.00000000005F3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs 66fd8d779da5e_EscortsRadios.exe
Source: 66fd8d779da5e_EscortsRadios.exe, 00000000.00000003.1749546590.00000000005F3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs 66fd8d779da5e_EscortsRadios.exe
Source: 66fd8d779da5e_EscortsRadios.exe, 00000000.00000003.1745574045.00000000027D9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameAutoIt3.exeB vs 66fd8d779da5e_EscortsRadios.exe
Uses 32bit PE files
Source: 66fd8d779da5e_EscortsRadios.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: classification engine Classification label: mal76.expl.evad.winEXE@28/17@3/0
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FFA6AD GetLastError,FormatMessageW, 10_2_00FFA6AD
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FE8DE9 AdjustTokenPrivileges,CloseHandle, 10_2_00FE8DE9
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FE9399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError, 10_2_00FE9399
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00B18DE9 AdjustTokenPrivileges,CloseHandle, 18_2_00B18DE9
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00B19399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError, 18_2_00B19399
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Code function: 0_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 0_2_004044A5
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FF4148 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle, 10_2_00FF4148
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Code function: 0_2_004024FB CoCreateInstance, 0_2_004024FB
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FF443D __swprintf,__swprintf,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx, 10_2_00FF443D
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif File created: C:\Users\user\AppData\Local\DatumHub Technologies Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3496:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6864:120:WilError_03
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe File created: C:\Users\user\AppData\Local\Temp\nsa8F56.tmp Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Jeffrey Jeffrey.bat & Jeffrey.bat
Source: 66fd8d779da5e_EscortsRadios.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\SysWOW64\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe File read: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe "C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe"
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Jeffrey Jeffrey.bat & Jeffrey.bat
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 527294
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "phisexyerrorspuzzle" Recorder
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Bottle + ..\Audi + ..\Duties + ..\Integral + ..\Warren + ..\Casio + ..\Sunny d
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Miniature.pif d
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DatumHub.url" & echo URL="C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DatumHub.url" & exit
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.js"
Source: C:\Windows\System32\wscript.exe Process created: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr "C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr" "C:\Users\user\AppData\Local\DatumHub Technologies\s"
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Jeffrey Jeffrey.bat & Jeffrey.bat Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 527294 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "phisexyerrorspuzzle" Recorder Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Bottle + ..\Audi + ..\Duties + ..\Integral + ..\Warren + ..\Casio + ..\Sunny d Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Miniature.pif d Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DatumHub.url" & echo URL="C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DatumHub.url" & exit Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr "C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr" "C:\Users\user\AppData\Local\DatumHub Technologies\s" Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: cmdext.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: jscript.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: scrobj.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: Window Recorder Window detected: More than 3 window changes detected
Source: 66fd8d779da5e_EscortsRadios.exe Static file information: File size 1302854 > 1048576
Source: 66fd8d779da5e_EscortsRadios.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress, 0_2_004062FC
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FB8B75 push ecx; ret 10_2_00FB8B88
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00AE8B75 push ecx; ret 18_2_00AE8B88

Persistence and Installation Behavior
barindex
Drops PE files with a suspicious file extension
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif File created: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Jump to dropped file
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif File created: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Jump to dropped file
Creates a start menu entry (Start Menu\Programs\Startup)
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DatumHub.url Jump to behavior
Stores files to the Windows start menu directory
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DatumHub.url Jump to behavior
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_010159B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed, 10_2_010159B3
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FA5EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput, 10_2_00FA5EDA
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00B459B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed, 18_2_00B459B3
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00AD5EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput, 18_2_00AD5EDA
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FB33B7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 10_2_00FB33B7
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\System32\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Found evasive API chain (date check)
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif API coverage: 4.9 %
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr API coverage: 4.5 %
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Code function: 0_2_004062D5 FindFirstFileW,FindClose, 0_2_004062D5
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Code function: 0_2_00402E18 FindFirstFileW, 0_2_00402E18
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 0_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FF4005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 10_2_00FF4005
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FF494A GetFileAttributesW,FindFirstFileW,FindClose, 10_2_00FF494A
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FF3CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 10_2_00FF3CE2
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FFC2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose, 10_2_00FFC2FF
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FFCD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, 10_2_00FFCD9F
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FFCD14 FindFirstFileW,FindClose, 10_2_00FFCD14
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FFF5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 10_2_00FFF5D8
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FFF735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 10_2_00FFF735
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FFFA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose, 10_2_00FFFA36
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00B24005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 18_2_00B24005
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00B2494A GetFileAttributesW,FindFirstFileW,FindClose, 18_2_00B2494A
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00B2C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose, 18_2_00B2C2FF
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00B2CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, 18_2_00B2CD9F
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00B2CD14 FindFirstFileW,FindClose, 18_2_00B2CD14
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00B2F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 18_2_00B2F5D8
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00B2F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 18_2_00B2F735
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00B2FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose, 18_2_00B2FA36
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00B23CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 18_2_00B23CE2
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FA5D13 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 10_2_00FA5D13
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\Temp\527294\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\Temp\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\Temp\527294 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\ Jump to behavior
Source: Miniature.pif, 0000000A.00000002.2981207824.0000000003865000.00000004.00000020.00020000.00000000.sdmp, DatumHub.scr, 00000012.00000002.2981426217.00000000036C7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Process information queried: ProcessInformation Jump to behavior
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_010045D5 BlockInput, 10_2_010045D5
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FA5240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW, 10_2_00FA5240
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FC5CAC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 10_2_00FC5CAC
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress, 0_2_004062FC
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FE88CD GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity, 10_2_00FE88CD
Enables debug privileges
Source: C:\Windows\SysWOW64\tasklist.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FBA385 SetUnhandledExceptionFilter,UnhandledExceptionFilter, 10_2_00FBA385
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FBA354 SetUnhandledExceptionFilter, 10_2_00FBA354
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00AEA385 SetUnhandledExceptionFilter,UnhandledExceptionFilter, 18_2_00AEA385
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00AEA354 SetUnhandledExceptionFilter, 18_2_00AEA354
Contains functionality to execute programs as a different user
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FE9369 LogonUserW, 10_2_00FE9369
Contains functionality to launch a program with higher privileges
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FA5240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW, 10_2_00FA5240
Contains functionality to simulate keystroke presses
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FF1AC6 SendInput,keybd_event, 10_2_00FF1AC6
Contains functionality to simulate mouse events
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FF51E2 mouse_event, 10_2_00FF51E2
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Jeffrey Jeffrey.bat & Jeffrey.bat Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 527294 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "phisexyerrorspuzzle" Recorder Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Bottle + ..\Audi + ..\Duties + ..\Integral + ..\Warren + ..\Casio + ..\Sunny d Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Miniature.pif d Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5 Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr "C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr" "C:\Users\user\AppData\Local\DatumHub Technologies\s" Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\datumhub.url" & echo url="c:\users\user\appdata\local\datumhub technologies\datumhub.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\datumhub.url" & exit
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\datumhub.url" & echo url="c:\users\user\appdata\local\datumhub technologies\datumhub.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\datumhub.url" & exit Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FE88CD GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity, 10_2_00FE88CD
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FF4F1C AllocateAndInitializeSid,CheckTokenMembership,FreeSid, 10_2_00FF4F1C
Source: 66fd8d779da5e_EscortsRadios.exe, 00000000.00000003.1745574045.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmp, Miniature.pif, 0000000A.00000003.1802019539.000000000425F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Miniature.pif, DatumHub.scr Binary or memory string: Shell_TrayWnd
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FB885B cpuid 10_2_00FB885B
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FD0030 GetLocalTime,__swprintf, 10_2_00FD0030
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FD0722 GetUserNameW, 10_2_00FD0722
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_00FC416A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte, 10_2_00FC416A
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe Code function: 0_2_00406805 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW, 0_2_00406805
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
OS version to string mapping found (often used in BOTs)
Source: DatumHub.scr Binary or memory string: WIN_81
Source: DatumHub.scr Binary or memory string: WIN_XP
Source: DatumHub.scr Binary or memory string: WIN_XPe
Source: DatumHub.scr Binary or memory string: WIN_VISTA
Source: DatumHub.scr Binary or memory string: WIN_7
Source: DatumHub.scr Binary or memory string: WIN_8
Source: DatumHub.scr.10.dr Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 3USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_0100696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket, 10_2_0100696E
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Code function: 10_2_01006E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket, 10_2_01006E32
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00B3696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket, 18_2_00B3696E
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr Code function: 18_2_00B36E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket, 18_2_00B36E32
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1525251 Sample: 66fd8d779da5e_EscortsRadios.exe Startdate: 03/10/2024 Architecture: WINDOWS Score: 76 44 fojjIZmGBFVhLMWz.fojjIZmGBFVhLMWz 2->44 48 Sigma detected: Search for Antivirus process 2->48 50 Sigma detected: Drops script at startup location 2->50 52 Machine Learning detection for sample 2->52 54 2 other signatures 2->54 10 66fd8d779da5e_EscortsRadios.exe 22 2->10         started        12 wscript.exe 1 2->12         started        signatures3 process4 signatures5 15 cmd.exe 2 10->15         started        58 Windows Scripting host queries suspicious COM object (likely to drop second stage) 12->58 19 DatumHub.scr 12->19         started        process6 file7 40 C:\Users\user\AppData\Local\...\Miniature.pif, PE32 15->40 dropped 46 Drops PE files with a suspicious file extension 15->46 21 Miniature.pif 4 15->21         started        25 cmd.exe 2 15->25         started        27 conhost.exe 15->27         started        29 7 other processes 15->29 signatures8 process9 file10 36 C:\Users\user\AppData\Local\...\DatumHub.scr, PE32 21->36 dropped 38 C:\Users\user\AppData\Local\...\DatumHub.js, ASCII 21->38 dropped 56 Drops PE files with a suspicious file extension 21->56 31 cmd.exe 2 21->31         started        signatures11 process12 file13 42 C:\Users\user\AppData\...\DatumHub.url, MS 31->42 dropped 34 conhost.exe 31->34         started        process14
⊘No contacted IP infos

Contacted Domains

Name IP Active
fojjIZmGBFVhLMWz.fojjIZmGBFVhLMWz unknown unknown