Edit tour

Windows Analysis Report
SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe
Analysis ID:	1528324
MD5:	038aeec194f57b9b270b4c7163d5a6b3
SHA1:	c901cf779694e1d7f5a79f9de088744b17068adb
SHA256:	5cb230932976abcbdc63ecb275ff92d00d37f94b31cb482cb60dfb4400f86568
Tags:	exe
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Found API chain indicative of debugger detection

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

One or more processes crash

PE file contains more sections than normal

PE file contains sections with non-standard names

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe (PID: 7256 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe" MD5: 038AEEC194F57B9B270B4C7163D5A6B3)

conhost.exe (PID: 7264 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 7364 cmdline: C:\Windows\system32\WerFault.exe -u -p 7256 -s 208 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe

ReversingLabs: Detection: 42%

Source: Amcache.hve.4.dr

String found in binary or memory: http://upx.sf.net

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7256 -s 208

Source: SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe

Static PE information: Number of sections : 15 > 10

Source: classification engine

Classification label: mal52.evad.winEXE@3/6@0/0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe

Code function: 0_2_00401550 CreateToolhelp32Snapshot,Process32First,printf,CloseHandle,CloseHandle,

0_2_00401550

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe

Code function: 0_2_00401627 OpenSCManagerA,GetLastError,printf,OpenServiceA,GetLastError,printf,CloseHandle,CloseHandle,printf,StartServiceA,GetLastError,printf,CloseHandle,printf,SleepEx,QueryServiceStatusEx,CloseHandle,

0_2_00401627

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7264:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7256

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\bbd6564c-be9c-45e7-af3b-2b09a0637bba

Jump to behavior

Source: SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe

ReversingLabs: Detection: 42%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7256 -s 208

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe

Section loaded: apphelp.dll

Jump to behavior

Source: SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe	Static PE information: section name: .xdata
Source: SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe	Static PE information: section name: /4
Source: SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe	Static PE information: section name: /19
Source: SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe	Static PE information: section name: /31
Source: SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe	Static PE information: section name: /45
Source: SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe	Static PE information: section name: /57
Source: SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe	Static PE information: section name: /70

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe

0_2_00401627

Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_0-761

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe	Code function: 0_2_00401180 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,_initterm,GetStartupInfoA,	0_2_00401180
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe	Code function: 0_2_00403361 SetUnhandledExceptionFilter,	0_2_00403361
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe	Code function: 0_2_00401ED0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	0_2_00401ED0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe	Code function: 0_2_00409380 SetUnhandledExceptionFilter,	0_2_00409380

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe

Code function: 0_2_00401DF0 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00401DF0

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Service Execution	1 Windows Service	1 Windows Service	11 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Process Injection	1 Process Injection	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 DLL Side-Loading	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	2 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe	42%	ReversingLabs	Win64.PUA.Generic

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.4.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528324
Start date and time:	2024-10-07 19:26:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe
Detection:	MAL
Classification:	mal52.evad.winEXE@3/6@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 5 Number of non-executed functions: 18
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.20
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, onedsblobprdwus15.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe

Simulations

Behavior and APIs

Time	Type	Description
13:27:11	API Interceptor	1x Sleep call for process: WerFault.exe modified

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_a3d5b28f45f55dfcfad94157e0e1426378f45bdc_27ead845_a6f82c43-7a16-4296-8c91-11f0f1e3d529\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7010845932714582
Encrypted:	false
SSDEEP:	96:yVF4APlXUsvhDi2GjxfUQXIDcQMc6WcENcw38Y+HbHg/opAnhZAX/d5FMT2SlPkh:uFVUOM0iS3ijRzuiFpZ24lO8nn
MD5:	9FE3D962C83130AACFF00BA6DC797F5E
SHA1:	FCE988598AB073AF7D98D38405703B2C18236C5C
SHA-256:	C4705372B104BECA63453121E81DB1360B170ECCBFAF3EA9165FE00EF8D7A29B
SHA-512:	66B1A05C000F68D6216C1734C09A785BB3C33312C128CC4B0D649339981AA5984E275C7EA21E93DA5154C50C05D9ABC6D9E9106A04B5A365FE2938C4624D61D8
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.7.9.5.6.1.8.7.8.5.2.1.6.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.7.9.5.6.1.9.0.3.5.2.1.3.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.6.f.8.2.c.4.3.-.7.a.1.6.-.4.2.9.6.-.8.c.9.1.-.1.1.f.0.f.1.e.3.d.5.2.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.1.8.4.9.9.9.a.-.c.a.0.3.-.4.3.6.c.-.b.1.9.9.-.9.5.f.0.1.b.5.5.b.4.6.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...W.i.n.6.4...M.a.l.w.a.r.e.X.-.g.e.n...2.4.6.5.2...4.7.7...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.5.8.-.0.0.0.1.-.0.0.1.4.-.4.c.5.9.-.c.a.1.c.d.e.1.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.2.3.3.c.2.4.4.1.4.3.9.3.6.3.9.0.b.d.8.a.e.c.0.7.7.2.8.0.0.a.2.2.0.0.0.0.f.f.f.f.!.0.0.0.0.c.9.0.1.c.f.7.7.9.6.9.4.e.1.d.7.f.5.a.7.9.f.9.d.e.0.8.8.7.4.4.b.1.7.0.6.8.a.d.b.!.S.e.c.u.r.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5BB9.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Oct 7 17:26:58 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	49322
Entropy (8bit):	1.4893803531684575
Encrypted:	false
SSDEEP:	96:5X8xyXh32rK3zBYi7n9+3A2YXpnxVvnVYmJTGTeRqZiyWIHsIhh+XYqIcvc:CgPmOn5T1numfqsohcYx
MD5:	EAB0B76A35353586EA2EA720882E9536
SHA1:	D765F3DA54F49F98C542C89EB21E3D851A7CE1DF
SHA-256:	7F748963A1C30A008EAD64506C38C446E239D42AE709D61791EDD1F373453833
SHA-512:	F08419A1F8580A18935B484DD3EFEBE70FEC7608CF3943D425FA06E8244DFDFBED71E04475AD7C00103A79782B25527249E6AF86D7D55972A124E1B5F411061D
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ..........g........................................."..........T.......8...........T...........................l...........X...............................................................................eJ..............Lw......................T.......X......g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5C08.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8650
Entropy (8bit):	3.7020255586272253
Encrypted:	false
SSDEEP:	192:R6l7wVeJlGE46Y9WL9sgmf/zprO89b3wzsf0B9m:R6lXJEE46YcL9sgmf/J3ksff
MD5:	1E8D416B2138E64D35B1E298C2B91597
SHA1:	EF066C59F729060F7F4B97ED91C15A99972530CF
SHA-256:	A132A6BD2E832D7BF187842AE66EC7BC84D771B2ED57BDBC8F1C012AC32EA0F6
SHA-512:	F69EDE56205E25EB1C581A55F3DA08F65CCF91CA17333AB388AEDE461B6F5631EE103CC791453955515FA0B60DB1E8D30B4FD6607EF0B1D4B0F4A3EE83455AC4
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.2.5.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5C28.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4820
Entropy (8bit):	4.532573630777288
Encrypted:	false
SSDEEP:	48:cvIwWl8zsnrJg771I9oTWpW8VYiYm8M4J5nZlFryq85dzzYX959hQd:uIjfnFI7/i7VSJfiYN7hQd
MD5:	710EEEE5A008549CE6A69AC11224A0E0
SHA1:	BA0448376A8521A86EF0E8D974BF6CBFABBA6332
SHA-256:	3A6E53A79EF6CFFCF0D0634B7ADC9C64E9DF3DEF5B69853B8F4862C187220E30
SHA-512:	391AB7397603FC7C27E766A256CD4BC107055DC22391B1D3BE9525FE1CED0DB64CBE6C39E56092964DACC636071720221FF1DC0CC19C81E90ED4E94DFBD5BF12
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533309" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465845532028439
Encrypted:	false
SSDEEP:	6144:lIXfpi67eLPU9skLmb0b4WWSPKaJG8nAgejZMMhA2gX4WABl0uNodwBCswSbu:GXD94WWlLZMM6YFHO+u
MD5:	411B81574009EFF2E153674E2FA4749E
SHA1:	024E7EFC8F1C8F1140CED915BC2614C54C300722
SHA-256:	08111D2FA562F76EBB9424E589330DB2334E2AAB22BEDDC4925F4C2347C7D5A6
SHA-512:	A2060530D0F6643565D0019E7288B2482BD0FA975104F139BF10C68671C47D1E48ACF3156D348599286CFEE3CF53EF2AF32B6344FA4052127E31EC054C8E7CF6
Malicious:	false
Reputation:	low
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.f..................................................................................................................................................................................................................................................................................................................................................f..)........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	101
Entropy (8bit):	4.923810216147091
Encrypted:	false
SSDEEP:	3:TsuvdARFSKJKF0CF1JfsEmS/IEbEsbUYGXG:x16FSso0zEQsqXG
MD5:	C63453B1FF219B51D3229D2BE73A81CC
SHA1:	900AF9F57E158D14BE44244593D8BDEEDD20BC6C
SHA-256:	F6ACA7AA753B6F15C363C98820C44CC09A7E1D30721BC95DD475784A49C68E04
SHA-512:	5F2EC1CDFF3987B716EB04739E3C3C8ED9CFC332AB4F053B75919BE7A613879EE2141A61970E00CDFC92C2B76FC7CFE03AA451EC2D500D23A5B5151B0B579F52
Malicious:	false
Reputation:	low
Preview:	[GetProcByPID] Process winlogon.exe PID is 552..[ElevateSystem] ImpersonateByPID(SYSTEM) succeeded...

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	4.845965663277242
TrID:	Win64 Executable Console (202006/5) 92.64% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% VXD Driver (31/22) 0.01%
File name:	SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe
File size:	63'351 bytes
MD5:	038aeec194f57b9b270b4c7163d5a6b3
SHA1:	c901cf779694e1d7f5a79f9de088744b17068adb
SHA256:	5cb230932976abcbdc63ecb275ff92d00d37f94b31cb482cb60dfb4400f86568
SHA512:	cd96a7655c7336b9ad194efce10cc74b8028acc944ef70b7437e75d559efe39d3a9fd86bb6f652966e784e502874c149189d5e5dd3fe01095a4a01901cb109ee
SSDEEP:	768:M1QRyU/GyIfEqTIYv4gKNwFPbJdqPpgawruN4+NPv:HRgEqTIm4gKN2PbJeKh+V
TLSH:	FA5383E43AD89C9AEA14423C41EAD332367DB9D0D6534B03663077321F12EE57AD726E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...7..b.z..c.....'......&...J................@..............................0................ ............................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4014e0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LARGE_ADDRESS_AWARE
DLL Characteristics:
Time Stamp:	0x6297B637 [Wed Jun 1 18:55:51 2022 UTC]
TLS Callbacks:	0x402000
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	d258f5cd6c09b26fe17e54bb131b7ea0

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00004335h]
mov dword ptr [eax], 00000000h
call 00007F8F94AD7FCFh
call 00007F8F94AD735Ah
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax+00h]
nop word ptr [eax+eax+00000000h]
dec eax
sub esp, 28h
call 00007F8F94AD93F4h
dec eax
test eax, eax
sete al
movzx eax, al
neg eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007F8F94AD76A9h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
dec eax
sub esp, 00000160h
dec eax
lea ebp, dword ptr [esp+00000080h]
dec eax
mov dword ptr [ebp+000000F0h], ecx
mov edx, 00000000h
mov ecx, 00000002h
call 00007F8F94AD9577h
dec eax
mov dword ptr [ebp+000000D0h], eax
mov dword ptr [ebp+000000DCh], 00000000h
mov dword ptr [ebp-60h], 00000130h
dec eax
lea eax, dword ptr [ebp-60h]
dec eax
mov ecx, dword ptr [ebp+000000D0h]
dec eax
mov edx, eax
call 00007F8F94AD94D4h
test eax, eax
je 00007F8F94AD7732h
dec eax
lea eax, dword ptr [ebp+00h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9000	0xa50	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x6000	0x2b8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x5420	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9280	0x230	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x24d8	0x2600	32fe1b5010fa7ae288b4946eb5aab14e	False	0.5596217105263158	data	5.849162727293986	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x4000	0xd0	0x200	bb4fd8e54d0b15380388826ea4415daf	False	0.130859375	data	0.810653616597643	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x5000	0x8b0	0xa00	5b1c8fc87fb3d1dafce6c78733e40631	False	0.3421875	data	4.2158448155129715	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.pdata	0x6000	0x2b8	0x400	54bc10ae674babc24544f1cc1b57b857	False	0.38671875	data	2.9729113015295865	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.xdata	0x7000	0x248	0x400	c2a43260b4c6cd59c7b1b529125d0c75	False	0.2705078125	data	2.7106468998434363	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x8000	0x9a0	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x9000	0xa50	0xc00	bbe01f240ec8910cf34405ede32431ba	False	0.3157552083333333	data	3.775019171787077	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0xa000	0x68	0x200	a924c32f74a00ed1cb62e7cb9400304f	False	0.0703125	data	0.25451054171027127	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xb000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
/4	0xc000	0x50	0x200	c28488e1fbfcfaec28e873e47909854b	False	0.0703125	data	0.2162069074398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/19	0xd000	0x1f08	0x2000	61355e59550eb26c88c0faafcec45f1f	False	0.4598388671875	data	5.822881056706139	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/31	0xf000	0x149	0x200	5d291f74219487bffd06356d36f3a0e4	False	0.375	data	3.2872917906726884	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/45	0x10000	0x222	0x400	9cb4b5eafa0331c2e36df8ba59308698	False	0.287109375	data	3.223789652893945	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/57	0x11000	0x48	0x200	175cd841f221fd6ecf31f79982145928	False	0.119140625	data	0.6892440741542495	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/70	0x12000	0x9b	0x200	406b70665a5983d1f1682455c669f732	False	0.259765625	data	2.320780444544343	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
ADVAPI32.dll	CreateProcessWithTokenW, DuplicateTokenEx, ImpersonateLoggedOnUser, OpenProcessToken, OpenSCManagerA, OpenServiceA, QueryServiceStatusEx, StartServiceA
KERNEL32.dll	CloseHandle, CreateToolhelp32Snapshot, DeleteCriticalSection, EnterCriticalSection, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetLastError, GetStartupInfoA, GetStartupInfoW, GetSystemTimeAsFileTime, GetTickCount, InitializeCriticalSection, LeaveCriticalSection, MultiByteToWideChar, OpenProcess, Process32First, Process32Next, QueryPerformanceCounter, RtlAddFunctionTable, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, SetUnhandledExceptionFilter, Sleep, SleepEx, TerminateProcess, TlsGetValue, UnhandledExceptionFilter, VirtualProtect, VirtualQuery
msvcrt.dll	__C_specific_handler, __getmainargs, __initenv, __iob_func, __lconv_init, __set_app_type, __setusermatherr, _acmdln, _amsg_exit, _cexit, _fmode, _initterm, _onexit, abort, calloc, exit, fprintf, free, fwrite, malloc, memcpy, memset, printf, signal, strcmp, strlen, strncmp, vfprintf

Target ID:	0
Start time:	13:26:58
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe"
Imagebase:	0x400000
File size:	63'351 bytes
MD5 hash:	038AEEC194F57B9B270B4C7163D5A6B3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:26:58
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:26:58
Start date:	07/10/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7256 -s 208
Imagebase:	0x7ff677760000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	13.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	23.2%
Total number of Nodes:	198
Total number of Limit Nodes:	3

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00401180 Relevance: 13.7, APIs: 9, Instructions: 198
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 004011E1
SetUnhandledExceptionFilter.KERNEL32 ref: 00401253
malloc.MSVCRT ref: 00401329
strlen.MSVCRT ref: 00401354
malloc.MSVCRT ref: 00401360
memcpy.MSVCRT ref: 00401378
_cexit.MSVCRT ref: 004013E5
GetStartupInfoA.KERNEL32 ref: 00401473

Memory Dump Source

Source File: 00000000.00000002.1810031660.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1810018038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810047264.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810062124.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandled_cexitmemcpystrlen
String ID:
API String ID: 1640792405-0
Opcode ID: af25bd5a341b23bbbd4a03eb9564c2f94bc3995fb2ea9686e82f54a34bdfab10
Instruction ID: 1ea07f07e20d3884432368961f83e9db5cc005ef20f8d6dc7ecf36c8179c1a5e
Opcode Fuzzy Hash: af25bd5a341b23bbbd4a03eb9564c2f94bc3995fb2ea9686e82f54a34bdfab10
Instruction Fuzzy Hash: B8818CB5600B4486EB24AF56E99476A37A5F749B88F84803EDF48773A1DF3DC844DB08

Function 00401550 Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00401616

Strings

GetProcByPID, xrefs: 004015D9
[%s] Process %s PID is %d, xrefs: 004015E0

Memory Dump Source

Source File: 00000000.00000002.1810031660.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1810018038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810047264.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810062124.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CloseHandle
String ID: GetProcByPID$[%s] Process %s PID is %d
API String ID: 2962429428-3610471400
Opcode ID: 250efe858d849e9d698f3f0a96d9b5e86feae468b8ecc72ae00e3ad65d910424
Instruction ID: 3caf93afe306e98a0743b8bd218e371bfed69c36d63cc8d45421f38b0a6c3d5f
Opcode Fuzzy Hash: 250efe858d849e9d698f3f0a96d9b5e86feae468b8ecc72ae00e3ad65d910424
Instruction Fuzzy Hash: 6311F671710B869DEB20DFA2D8447DA23A4E748788F40002B9E0DAFB59EB38C604C754

Function 004017FD Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

printf.MSVCRT ref: 0040184C
printf.MSVCRT ref: 004018A1

Strings

[%s] OpenProcess on PID %d failed. Error: %d, xrefs: 00401845
ImpersonateByPID, xrefs: 0040183E, 00401893, 00401932, 00401990
[%s] DuplicateTokenEx on PID %d failed. Error: %d, xrefs: 00401939
[%s] OpenProcessToken on PID %d failed. Error: %d, xrefs: 0040189A
[%s] ImpersonateLoggedOnUser on PID %d failed. Error: %d, xrefs: 00401997

Memory Dump Source

Source File: 00000000.00000002.1810031660.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1810018038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810047264.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810062124.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: printf
String ID: ImpersonateByPID$[%s] DuplicateTokenEx on PID %d failed. Error: %d$[%s] ImpersonateLoggedOnUser on PID %d failed. Error: %d$[%s] OpenProcess on PID %d failed. Error: %d$[%s] OpenProcessToken on PID %d failed. Error: %d
API String ID: 3524737521-3248095357
Opcode ID: 89dfabdf74dc0bf7d1536025d74a0486140407317b87942c9e71e3fb0bc408a2
Instruction ID: c6421e58fd3d9f300b3e1ae3b1f73fb1a361ad12f18210b1169846a2c30591e6
Opcode Fuzzy Hash: 89dfabdf74dc0bf7d1536025d74a0486140407317b87942c9e71e3fb0bc408a2
Instruction Fuzzy Hash: 7041F8B1710A0999EB50DB66EC9039D3760F748B88F40482ADF5CA7BB9EF78CA41C744

Function 00401C0B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 51
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004019D0: printf.MSVCRT ref: 00401A0A

strcmp.MSVCRT ref: 00401C39
printf.MSVCRT ref: 00401C69
printf.MSVCRT ref: 00401C86

Part of subcall function 00401A16: printf.MSVCRT ref: 00401A49

Part of subcall function 00401A55: printf.MSVCRT ref: 00401AF2
Part of subcall function 00401A55: printf.MSVCRT ref: 00401BF2

Strings

trusted, xrefs: 00401C2F
cmd.exe, xrefs: 00401C9C, 00401CB4
[%s] (SYSTEM) Token HANDLE 0x%p., xrefs: 00401C62
main, xrefs: 00401C5B, 00401C78
[%s] (TrustedInstaller) Token HANDLE 0x%p., xrefs: 00401C7F

Memory Dump Source

Source File: 00000000.00000002.1810031660.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1810018038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810047264.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810062124.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: printf$strcmp
String ID: [%s] (SYSTEM) Token HANDLE 0x%p.$[%s] (TrustedInstaller) Token HANDLE 0x%p.$cmd.exe$main$trusted
API String ID: 2473254817-1572995953
Opcode ID: c95ec968544579be38e602612c3a77578951ce79cedc8b70d467533aac6004b0
Instruction ID: 4abf04ba551ef6a5530930b3a1be1c9a92d5a05fa5e70211dcb977b7c6ebfd55
Opcode Fuzzy Hash: c95ec968544579be38e602612c3a77578951ce79cedc8b70d467533aac6004b0
Instruction Fuzzy Hash: 2B21C6B4712B0594EF00AB56E9813553364E744BC8F40502AEF4D7B371EEBCC5498B48

Function 004019D0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00401550: CloseHandle.KERNELBASE ref: 00401616

Part of subcall function 004017FD: printf.MSVCRT ref: 0040184C

printf.MSVCRT ref: 00401A0A

Strings

winlogon.exe, xrefs: 004019D8
ElevateSystem, xrefs: 004019FC
[%s] ImpersonateByPID(SYSTEM) succeeded., xrefs: 00401A03

Memory Dump Source

Source File: 00000000.00000002.1810031660.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1810018038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810047264.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810062124.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: printf$CloseHandle
String ID: ElevateSystem$[%s] ImpersonateByPID(SYSTEM) succeeded.$winlogon.exe
API String ID: 3363481148-3921200022
Opcode ID: d6c958e14a25ab89d7ae59b266a5f24d4f280486700b3e6716698c7d4b588eda
Instruction ID: eeeb1b5e6e3286bf6f034587ddcab2b659d9b79581d5d0875449406a276fc74b
Opcode Fuzzy Hash: d6c958e14a25ab89d7ae59b266a5f24d4f280486700b3e6716698c7d4b588eda
Instruction Fuzzy Hash: 2FE04875711901E9EB00E735D8413592365A740388FC0442A9B1DBB1B1EE38C605CB08

Non-executed Functions

Function 00401627 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

printf.MSVCRT ref: 00401676
printf.MSVCRT ref: 004016C7

Strings

TrustedInstaller, xrefs: 0040168F
[%s] OpenSCManager failed. Error: %d, xrefs: 0040166F
ServicesActive, xrefs: 0040163C
[%s] StartService failed. Error: %d, xrefs: 00401755
[%s] QueryServiceStatusEx need %d bytes., xrefs: 0040170F
[%s] TrustedInstaller Service PID is %d, xrefs: 00401793
GetTrustedInstallerPID, xrefs: 00401668, 004016B9, 00401708, 0040174E, 0040178C
[%s] OpenService failed. Error: %d, xrefs: 004016C0

Memory Dump Source

Source File: 00000000.00000002.1810031660.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1810018038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810047264.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810062124.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: printf
String ID: GetTrustedInstallerPID$ServicesActive$TrustedInstaller$[%s] OpenSCManager failed. Error: %d$[%s] OpenService failed. Error: %d$[%s] QueryServiceStatusEx need %d bytes.$[%s] StartService failed. Error: %d$[%s] TrustedInstaller Service PID is %d
API String ID: 3524737521-2189383479
Opcode ID: ac6976177b7a3ae7270fbd9271f79e44d08aeb5096ad27c6a959dee35ea88250
Instruction ID: 1f9dd3d03cacb69b5fcbf0ae898bcead6ce7d576a6b7edeb0f72920630ea2a4b
Opcode Fuzzy Hash: ac6976177b7a3ae7270fbd9271f79e44d08aeb5096ad27c6a959dee35ea88250
Instruction Fuzzy Hash: D2410CB5710A0499EB00DB69EC9039D33A0F749B98F50062ADF1DA77B4DF39CA41CB88

Function 00401ED0 Relevance: 12.0, APIs: 8, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCaptureContext.KERNEL32 ref: 00401EE4
RtlLookupFunctionEntry.KERNEL32 ref: 00401EFB
RtlVirtualUnwind.KERNEL32 ref: 00401F3D
SetUnhandledExceptionFilter.KERNEL32 ref: 00401F81
UnhandledExceptionFilter.KERNEL32 ref: 00401F8E
GetCurrentProcess.KERNEL32 ref: 00401F94
TerminateProcess.KERNEL32 ref: 00401FA2
abort.MSVCRT ref: 00401FA8

Memory Dump Source

Source File: 00000000.00000002.1810031660.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1810018038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810047264.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810062124.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentEntryFunctionLookupTerminateUnwindVirtualabort
String ID:
API String ID: 4278921479-0
Opcode ID: 4231b4b87516edd7bc972636d1406addee211128e9852e5225d1adeb625bd15d
Instruction ID: a80238b1ddf95f2c857942a157d5d0b042dd5aca772804be96497641d9b0e5e9
Opcode Fuzzy Hash: 4231b4b87516edd7bc972636d1406addee211128e9852e5225d1adeb625bd15d
Instruction Fuzzy Hash: 0C21EFB1611F0099EB008B61FC8478933B4BB48B84F44412AEF8E677A5EF38C55AC708

Function 00401DF0 Relevance: 7.6, APIs: 5, Instructions: 56
timethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00401E35
GetCurrentProcessId.KERNEL32 ref: 00401E40
GetCurrentThreadId.KERNEL32 ref: 00401E49
GetTickCount.KERNEL32 ref: 00401E51
QueryPerformanceCounter.KERNEL32 ref: 00401E5E

Memory Dump Source

Source File: 00000000.00000002.1810031660.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1810018038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810047264.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810062124.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: a1654b1a5e58469e100019fa7964a65d8818cfd36ee138f411d8a42df0ce36b9
Instruction ID: da3e2389a881eef3a83eee4f2f6004e1335a159f80a5b73607df26ff39c06210
Opcode Fuzzy Hash: a1654b1a5e58469e100019fa7964a65d8818cfd36ee138f411d8a42df0ce36b9
Instruction Fuzzy Hash: 26114CA6665B5085FB114B25FC0435A72A0B788BB4F0817359F9C637B4DA3CC885C748

Function 00409380 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810062124.0000000000409000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1810018038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810031660.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810047264.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abab300716561deb7ad1dbe92d53b3d18e32e794503a7fe55cdbb86683b3c62f
Instruction ID: 35fded4b9ecd6c8ca91dde03ccd29809722e1029447f9364c1858d305e6be777
Opcode Fuzzy Hash: abab300716561deb7ad1dbe92d53b3d18e32e794503a7fe55cdbb86683b3c62f
Instruction Fuzzy Hash: CAD05BC7F9DFD046D322C1A40D7A15A2F91A5F691431D806F4F41633C3B43D5C055715

Function 00403361 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810031660.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1810018038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810047264.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810062124.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e689781d7782fde07e70b67dc4f963534d97e362de84023b617e7754e0a7c37b
Instruction ID: 58c44f47819cdcaf11701f01adb9a079ecfb37b396743f9b115418fb6c22748d
Opcode Fuzzy Hash: e689781d7782fde07e70b67dc4f963534d97e362de84023b617e7754e0a7c37b
Instruction Fuzzy Hash: 1EA00252499D0180E3040B40D9153A65529E74A200F0431209A1461092C53D85158508

Function 004023F0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 283
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(00408630,00007FFE2167ADA0,?,?,?,00000001,0040124C), ref: 0040251D

Strings

Unknown pseudo relocation protocol version %d., xrefs: 0040269E
Unknown pseudo relocation bit size %d., xrefs: 0040268A

Memory Dump Source

Source File: 00000000.00000002.1810031660.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1810018038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810047264.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810062124.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: d324a09b628eecc57f2ab8e3e3ed127caf28eced47f467965402bd7aa393706f
Instruction ID: f05aec6a82821f84f7f22e723582678da4342a8ab665db0880c0e4cc5e771229
Opcode Fuzzy Hash: d324a09b628eecc57f2ab8e3e3ed127caf28eced47f467965402bd7aa393706f
Instruction Fuzzy Hash: 80915671B1055046EB289B66DB4831F6351B7983A8F54893BCF08B77D8DEBEC982870D

Function 00402940 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

signal.MSVCRT ref: 00402999
signal.MSVCRT ref: 004029F2
signal.MSVCRT ref: 00402A4E
signal.MSVCRT ref: 00402B03

Strings

CCG , xrefs: 00402955

Memory Dump Source

Source File: 00000000.00000002.1810031660.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1810018038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810047264.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810062124.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: signal
String ID: CCG
API String ID: 1946981877-1584390748
Opcode ID: 774f20f82659d80855c8cdbd0601561189d9b216f63062a9b1832aca8661f21d
Instruction ID: 82aa244cc5053a65e1fcf8dfbcc735a391ca21efaa4df4f8766fdcb3f0e77ff5
Opcode Fuzzy Hash: 774f20f82659d80855c8cdbd0601561189d9b216f63062a9b1832aca8661f21d
Instruction Fuzzy Hash: 28315E60B1440045EF79517A476833610419B8D378F298A3BD96EB73E2DDFECDC5161E

Function 00402220 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 004022CB
VirtualProtect.KERNEL32 ref: 00402372
GetLastError.KERNEL32 ref: 00402380

Strings

Address %p has no image-section, xrefs: 004023DD
VirtualQuery failed for %d bytes at address %p, xrefs: 004023C7
VirtualProtect failed with code 0x%x, xrefs: 00402386

Memory Dump Source

Source File: 00000000.00000002.1810031660.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1810018038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810047264.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810062124.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuery
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 637304234-2123141913
Opcode ID: 83c3a4063a2dce2d8c2fdcd0331aa95c88aefb514385dbe32ff3f002a6bf446a
Instruction ID: 1fe20e60fd26eeb89b7542ddbe1aeb930d5c0f0500852fb2d0d8a4c50414480b
Opcode Fuzzy Hash: 83c3a4063a2dce2d8c2fdcd0331aa95c88aefb514385dbe32ff3f002a6bf446a
Instruction Fuzzy Hash: 2A5100B3701A5086DB248F26EA0475E7760F789BA8F45813ADF4D673D8DA7CC942C308

Function 00401A55 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

printf.MSVCRT ref: 00401AF2
printf.MSVCRT ref: 00401BF2

Strings

[%s] CreateProcessWithTokenW with argument '%ls'. Error: %d, xrefs: 00401BEB
[%s] MultiByteToWideChar need %d bytes., xrefs: 00401AEB
CreateProcessImpersonate, xrefs: 00401AE4, 00401BE4

Memory Dump Source

Source File: 00000000.00000002.1810031660.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1810018038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810047264.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810062124.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: printf
String ID: CreateProcessImpersonate$[%s] CreateProcessWithTokenW with argument '%ls'. Error: %d$[%s] MultiByteToWideChar need %d bytes.
API String ID: 3524737521-844407695
Opcode ID: 30a9b8badebb3cdd2fcfec26055306a3f050e15a21b8245577f28ae12db0b6d3
Instruction ID: c9b4777289d548aaa57be8a096d33c9431b7a9c1120feec8c729b949d082f152
Opcode Fuzzy Hash: 30a9b8badebb3cdd2fcfec26055306a3f050e15a21b8245577f28ae12db0b6d3
Instruction Fuzzy Hash: 80412E72711B8099EB60CF65E8407CA37A0F788798F104236EE5C97BA8EF39C645C744

Function 004020F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 00402169

Strings

Unknown error, xrefs: 004021E0
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00402159

Memory Dump Source

Source File: 00000000.00000002.1810031660.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1810018038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810047264.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810062124.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: cdc4e5d8309f71ca0f236d2a4d481da13db95bddc966c3dafd3745058893965d
Instruction ID: 588b6dcd6d2f75b48c5acd068d12107141b74fe583b5f08c83c4a08ec796d532
Opcode Fuzzy Hash: cdc4e5d8309f71ca0f236d2a4d481da13db95bddc966c3dafd3745058893965d
Instruction Fuzzy Hash: 9901C462504E88D6D6068F1CD8413EA7375FF9E79AF245316EF883A264DB39C643CB04

Function 004021C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00402169

Strings

Total loss of significance (TLOSS), xrefs: 004021C0
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00402159

Memory Dump Source

Source File: 00000000.00000002.1810031660.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1810018038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810047264.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810062124.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: 82278db16c3cd151ee3b7d27147a00392a496ad1a837c55066fe36f685c0f110
Instruction ID: 5271ffe6d47e18e8f3ed4d28e0bc586e272fb4a166e6af144b4536481be6e8ea
Opcode Fuzzy Hash: 82278db16c3cd151ee3b7d27147a00392a496ad1a837c55066fe36f685c0f110
Instruction Fuzzy Hash: F9F09662404E8481C202CF1CA8003ABB375FF9D789F28531AEF893A564DB38C6878704

Function 004021D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00402169

Strings

Partial loss of significance (PLOSS), xrefs: 004021D0
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00402159

Memory Dump Source

Source File: 00000000.00000002.1810031660.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1810018038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810047264.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810062124.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: 76148788dc030072721f6726ae16d5ee29986ffa8211d805021140ca97095402
Instruction ID: 9480cfd0b8d114bcc78c695d6713e12ad9661390a8e6d5e323d6d6c53a177272
Opcode Fuzzy Hash: 76148788dc030072721f6726ae16d5ee29986ffa8211d805021140ca97095402
Instruction Fuzzy Hash: 74F09662404F8481C242CF1CA8003ABB374FF9D789F68531AEF893A164DB38C6478704

Function 00402190 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 00402169

Strings

Argument singularity (SIGN), xrefs: 00402190
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00402159

Memory Dump Source

Source File: 00000000.00000002.1810031660.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1810018038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810047264.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810062124.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: 0ea5eb44334996e9e35a1c54a2e3f2f81d894c4064eda8a4c732036953195ca5
Instruction ID: 1ed8557e754185567a905833511ab7558e4f55812789787a35a7d7e827eac40d
Opcode Fuzzy Hash: 0ea5eb44334996e9e35a1c54a2e3f2f81d894c4064eda8a4c732036953195ca5
Instruction Fuzzy Hash: 33F09662404E8881C202CF1CA8003EBB375FF9D789F28531AEF893A164DB38C6478704

Function 004021A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00402169

Strings

Overflow range error (OVERFLOW), xrefs: 004021A0
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00402159

Memory Dump Source

Source File: 00000000.00000002.1810031660.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1810018038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810047264.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810062124.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: 0bffac0ead21e233ea7a1be4754acab33b3cbe9269826f467bfdf2e2801da7a1
Instruction ID: 16ad13870ab6a23e1791564b88711431fd16557278e5a8d1bca3b88684458c9e
Opcode Fuzzy Hash: 0bffac0ead21e233ea7a1be4754acab33b3cbe9269826f467bfdf2e2801da7a1
Instruction Fuzzy Hash: F6F09662404E8481C242CF1CA8003ABB374FF9D79AF68531AEF893A164DB38C647C704

Function 004021B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00402169

Strings

The result is too small to be represented (UNDERFLOW), xrefs: 004021B0
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00402159

Memory Dump Source

Source File: 00000000.00000002.1810031660.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1810018038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810047264.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810062124.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: 95e2b3b61dfb5b19dc598d279b2d6a42aa24cd1eda70faf89e42feb10d02de7f
Instruction ID: b28b1d9d70a1293a46effba0f53a61d5e09cf1c1e26a982615f2400fc466c588
Opcode Fuzzy Hash: 95e2b3b61dfb5b19dc598d279b2d6a42aa24cd1eda70faf89e42feb10d02de7f
Instruction Fuzzy Hash: 41F09662504E8482C202DF1CA8003ABB375FF9D789F68531AEF893A164DB38C6478704

Function 00402121 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00402169

Strings

Argument domain error (DOMAIN), xrefs: 00402121
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00402159

Memory Dump Source

Source File: 00000000.00000002.1810031660.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1810018038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810047264.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810062124.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: dbece672a372915fd088550e5c4887a638d3e82fa6e089b8f9803499c992fe41
Instruction ID: 9f1ae53cf0fe03b6573d64f7f9e5b5645e5b7b53ec8bd3358f3328e94598df97
Opcode Fuzzy Hash: dbece672a372915fd088550e5c4887a638d3e82fa6e089b8f9803499c992fe41
Instruction Fuzzy Hash: E7F03656504F8881D201DF1DA80039BB375FF5E799F58531AEF8936524DB28C6478744

Function 00401A16 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

Part of subcall function 00401627: printf.MSVCRT ref: 00401676

Part of subcall function 004017FD: printf.MSVCRT ref: 0040184C

printf.MSVCRT ref: 00401A49

Strings

ElevateTrustedInstaller, xrefs: 00401A3B
[%s] ImpersonateByPID(TrustedInstaller) succeeded., xrefs: 00401A42

Memory Dump Source

Source File: 00000000.00000002.1810031660.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1810018038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810047264.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810062124.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: printf
String ID: ElevateTrustedInstaller$[%s] ImpersonateByPID(TrustedInstaller) succeeded.
API String ID: 3524737521-3693187864
Opcode ID: aa7c45924d4f545ee310bc27a71cf0236bcbc95bd683abb0b83e23b68fd68775
Instruction ID: 915b1ab85329ff8af1f94a6b02118f1ba52f8ea64c5e0a460dc77f7975b4160c
Opcode Fuzzy Hash: aa7c45924d4f545ee310bc27a71cf0236bcbc95bd683abb0b83e23b68fd68775
Instruction Fuzzy Hash: 82E08C71B10901AAEB00EB71D8063592365A70038CF84807AAA0CAB2A0EE38C606CB08

Function 00402C20 Relevance: 5.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00402C47
free.MSVCRT ref: 00402C98
LeaveCriticalSection.KERNEL32 ref: 00402CA4

Memory Dump Source

Source File: 00000000.00000002.1810031660.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1810018038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810047264.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810062124.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810076555.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CriticalSection$EnterLeavefree
String ID:
API String ID: 4020351045-0
Opcode ID: 8e5da21ee47c9cd316c8d94bfc38455117d56a48760ef7ebcdd5c9b2e9e337f6
Instruction ID: c3e2ad1dc6757a636216e945aa5c02576581da33509b3b07302f6a90f117ecd1
Opcode Fuzzy Hash: 8e5da21ee47c9cd316c8d94bfc38455117d56a48760ef7ebcdd5c9b2e9e337f6
Instruction Fuzzy Hash: 8B011EF1715A0086EA08DB65EAC833A23A0B798B40F54843ADB49A73E0DFBCC9458749

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_a3d5b28f45f55dfcfad94157e0e1426378f45bdc_27ead845_a6f82c43-7a16-4296-8c91-11f0f1e3d529\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5BB9.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5C08.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5C28.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exePID: 7256, Parent PID: 2580

General

Chronological Activities

Windows Analysis Report
SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe

Function 00401180 Relevance: 13.7, APIs: 9, Instructions: 198
sleepstringCOMMON

Function 00401550 Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 46
COMMON

Function 004017FD Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 108
COMMON

Function 00401C0B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 51
stringCOMMON

Function 004019D0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 19
COMMON

Function 00401627 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 109
COMMON

Function 00401ED0 Relevance: 12.0, APIs: 8, Instructions: 50
COMMON

Function 00401DF0 Relevance: 7.6, APIs: 5, Instructions: 56
timethreadCOMMON

Function 004023F0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 283
memoryCOMMON

Function 00402940 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 111
COMMON

Function 00402220 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 148
memoryCOMMON

Function 00401A55 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 105
COMMON

Function 004020F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38
COMMON

Function 00402190 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON