Windows Analysis Report
5HnWIsZYYh.exe

Overview

General Information

Sample name: 5HnWIsZYYh.exe
renamed because original name is a hash value
Original sample name: 1806d372d84e9b6a570e6db0c34f97fb9c4b7bfa42184c5733de1cd4452e47a5.exe
Analysis ID: 1528056
MD5: 811a2d6558eede86732a34dc1743fd8f
SHA1: e171afad9bc2294b03e5f6b22257655bda918a75
SHA256: 1806d372d84e9b6a570e6db0c34f97fb9c4b7bfa42184c5733de1cd4452e47a5
Tags: exeuser-adrian__luca
Infos:

Detection

Score: 56
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
AI detected suspicious sample
Machine Learning detection for sample
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Found evasive API chain (date check)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
OS version to string mapping found (often used in BOTs)
PE file contains an invalid checksum
Potential key logger detected (key state polling based)
Program does not show much activity (idle)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: 5HnWIsZYYh.exe ReversingLabs: Detection: 18%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 81.0% probability
Machine Learning detection for sample
Source: 5HnWIsZYYh.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: 5HnWIsZYYh.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_00452492 FindFirstFileW,Sleep,FindNextFileW,FindClose, 0_2_00452492
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_00442886 FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_00442886
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_004788BD FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, 0_2_004788BD
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_004339B6 GetFileAttributesW,FindFirstFileW,FindClose, 0_2_004339B6
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0045CAFA FindFirstFileW,FindNextFileW,FindClose, 0_2_0045CAFA
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_00431A86 FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_00431A86
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0044BD27 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose, 0_2_0044BD27
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0045DE8F FindFirstFileW,FindClose, 0_2_0045DE8F
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0044BF8B _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose, 0_2_0044BF8B
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_004422FE InternetQueryDataAvailable,InternetReadFile, 0_2_004422FE
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0045A10F OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard, 0_2_0045A10F
Contains functionality to modify clipboard data
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0045A10F OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard, 0_2_0045A10F
Contains functionality to read the clipboard data
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0046DC80 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard, 0_2_0046DC80
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0044C37A GetKeyboardState,SetKeyboardState,PostMessageW,PostMessageW,SendInput, 0_2_0044C37A
Potential key logger detected (key state polling based)
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0047C81C SendMessageW,DefDlgProcW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW, 0_2_0047C81C
Contains functionality to communicate with device drivers
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_00431BE8: GetFullPathNameW,__swprintf,_wcslen,CreateDirectoryW,CreateFileW,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle, 0_2_00431BE8
Contains functionality to launch a process as a different user
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_00446313 DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,_wcsncpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock, 0_2_00446313
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_004333BE GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState, 0_2_004333BE
Detected potential crypto function
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0042200C 0_2_0042200C
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0041A217 0_2_0041A217
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_00412216 0_2_00412216
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0042435D 0_2_0042435D
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_004033C0 0_2_004033C0
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_004125E8 0_2_004125E8
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0044663B 0_2_0044663B
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_004096A0 0_2_004096A0
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_00413801 0_2_00413801
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0042096F 0_2_0042096F
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_004129D0 0_2_004129D0
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_004119E3 0_2_004119E3
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0041C9AE 0_2_0041C9AE
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0047EA6F 0_2_0047EA6F
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0040FA10 0_2_0040FA10
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0044EB5F 0_2_0044EB5F
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_00423C81 0_2_00423C81
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_00411E78 0_2_00411E78
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_00442E0C 0_2_00442E0C
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_00420EC0 0_2_00420EC0
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0044CF17 0_2_0044CF17
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_00444FD2 0_2_00444FD2
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: String function: 004115D7 appears 36 times
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: String function: 00416C70 appears 39 times
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: String function: 00445AE0 appears 65 times
Uses 32bit PE files
Source: 5HnWIsZYYh.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: classification engine Classification label: mal56.winEXE@1/0@0/0
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0044AF6C GetLastError,FormatMessageW, 0_2_0044AF6C
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_004333BE GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState, 0_2_004333BE
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_00464EAE OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle, 0_2_00464EAE
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0045D619 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode, 0_2_0045D619
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_004755C4 CreateToolhelp32Snapshot,Process32FirstW,__wsplitpath,_wcscat,__wcsicoll,Process32NextW,CloseHandle, 0_2_004755C4
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0047839D CoInitialize,CoCreateInstance,CoUninitialize, 0_2_0047839D
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0043305F __swprintf,__swprintf,__wcsicoll,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx, 0_2_0043305F
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Command line argument: #v 0_2_0040D6B0
Source: 5HnWIsZYYh.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: 5HnWIsZYYh.exe ReversingLabs: Detection: 18%
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe File read: C:\Users\user\Desktop\5HnWIsZYYh.exe Jump to behavior
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0040EBD0 LoadLibraryA,GetProcAddress, 0_2_0040EBD0
PE file contains an invalid checksum
Source: 5HnWIsZYYh.exe Static PE information: real checksum: 0xa961f should be: 0xae8bf
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_00416CB5 push ecx; ret 0_2_00416CC8
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0047A330 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed, 0_2_0047A330
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_00434418 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput, 0_2_00434418
Found evasive API chain (date check)
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe API coverage: 1.9 %
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_00452492 FindFirstFileW,Sleep,FindNextFileW,FindClose, 0_2_00452492
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_00442886 FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_00442886
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_004788BD FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, 0_2_004788BD
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_004339B6 GetFileAttributesW,FindFirstFileW,FindClose, 0_2_004339B6
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0045CAFA FindFirstFileW,FindNextFileW,FindClose, 0_2_0045CAFA
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_00431A86 FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_00431A86
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0044BD27 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose, 0_2_0044BD27
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0045DE8F FindFirstFileW,FindClose, 0_2_0045DE8F
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0044BF8B _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose, 0_2_0044BF8B
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0040E500 GetVersionExW,GetCurrentProcess,GetNativeSystemInfo,FreeLibrary,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,FreeLibrary, 0_2_0040E500
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe API call chain: ExitProcess graph end node
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0045A370 BlockInput, 0_2_0045A370
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0040D590 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW, 0_2_0040D590
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0040EBD0 LoadLibraryA,GetProcAddress, 0_2_0040EBD0
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_004238DA __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock, 0_2_004238DA
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0041F250 SetUnhandledExceptionFilter, 0_2_0041F250
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0041A208 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_0041A208
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_00417DAA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00417DAA
Contains functionality to execute programs as a different user
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_00436CD7 LogonUserW, 0_2_00436CD7
Contains functionality to launch a program with higher privileges
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0040D590 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW, 0_2_0040D590
Contains functionality to simulate keystroke presses
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_00434418 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput, 0_2_00434418
Contains functionality to simulate mouse events
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0043333C __wcsicoll,mouse_event,__wcsicoll,mouse_event, 0_2_0043333C
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_00446124 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity, 0_2_00446124
Source: 5HnWIsZYYh.exe Binary or memory string: Shell_TrayWnd
Source: 5HnWIsZYYh.exe Binary or memory string: JDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_004720DB GetLocalTime,__swprintf,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW, 0_2_004720DB
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_00472C3F GetUserNameW, 0_2_00472C3F
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0041E364 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte, 0_2_0041E364
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0040E500 GetVersionExW,GetCurrentProcess,GetNativeSystemInfo,FreeLibrary,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,FreeLibrary, 0_2_0040E500
OS version to string mapping found (often used in BOTs)
Source: 5HnWIsZYYh.exe Binary or memory string: WIN_XP
Source: 5HnWIsZYYh.exe Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 8, 1USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32AutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----&
Source: 5HnWIsZYYh.exe Binary or memory string: WIN_XPe
Source: 5HnWIsZYYh.exe Binary or memory string: WIN_VISTA
Source: 5HnWIsZYYh.exe Binary or memory string: WIN_7
Source: 5HnWIsZYYh.exe Binary or memory string: WIN_8
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_004652BE socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket, 0_2_004652BE
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_00476619 socket,WSAGetLastError,bind,WSAGetLastError,closesocket, 0_2_00476619
Source: C:\Users\user\Desktop\5HnWIsZYYh.exe Code function: 0_2_0046CEF3 OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject, 0_2_0046CEF3
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1528056 Sample: 5HnWIsZYYh.exe Startdate: 07/10/2024 Architecture: WINDOWS Score: 56 7 Multi AV Scanner detection for submitted file 2->7 9 Machine Learning detection for sample 2->9 11 AI detected suspicious sample 2->11 5 5HnWIsZYYh.exe 2->5         started        process3
⊘No contacted IP infos