Windows Analysis Report
SlackSetup.exe

Overview

General Information

Sample name: SlackSetup.exe
Analysis ID: 1528459
MD5: ff5d2158365794b8a813e0373e717775
SHA1: acd93c4264d6ece9124a6abc6bb01f1d52c6a293
SHA256: 29571343619ddedf7c469509730c46ee63e71804971c723fe5c53ca993d6aa8d
Infos:

Detection

Score: 36
Range: 0 - 100
Whitelisted: false
Confidence: 60%

Signatures

Malicious sample detected (through community Yara rule)
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Contains long sleeps (>= 3 min)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Uses 32bit PE files
Source: SlackSetup.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\Users\user\Desktop\SlackSetup.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SlackSetup.exe.log Jump to behavior
Source: SlackSetup.exe Static PE information: certificate valid
Source: unknown HTTPS traffic detected: 104.21.50.84:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: SlackSetup.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: D:\1\ConsoleApp5\obj\x86\Release\SlackSetup.pdb source: SlackSetup.exe
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /lapi/lcheck.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: slack.meetingsvideoapp.comContent-Length: 65Expect: 100-continueConnection: Keep-Alive
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: slack.meetingsvideoapp.com
Source: unknown HTTP traffic detected: POST /lapi/lcheck.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: slack.meetingsvideoapp.comContent-Length: 65Expect: 100-continueConnection: Keep-Alive
Source: SlackSetup.exe String found in binary or memory: http://cevcsca2021.crl.certum.pl/cevcsca2021.crl0w
Source: SlackSetup.exe String found in binary or memory: http://cevcsca2021.ocsp-certum.com07
Source: SlackSetup.exe String found in binary or memory: http://crl.certum.pl/ctnca2.crl0l
Source: SlackSetup.exe String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: SlackSetup.exe String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: SlackSetup.exe String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: SlackSetup.exe String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: SlackSetup.exe String found in binary or memory: http://repository.certum.pl/cevcsca2021.cer0
Source: SlackSetup.exe String found in binary or memory: http://repository.certum.pl/ctnca2.cer09
Source: SlackSetup.exe, 00000000.00000002.1819694618.0000000008820000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: SlackSetup.exe String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: SlackSetup.exe, 00000000.00000002.1819694618.0000000008836000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://slack.meetingsvideoapp.com
Source: SlackSetup.exe, 00000000.00000002.1819694618.0000000008836000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://slack.meetingsvideoapp.comd
Source: SlackSetup.exe String found in binary or memory: http://subca.ocsp-certum.com02
Source: SlackSetup.exe String found in binary or memory: http://www.certum.pl/CPS0
Source: SlackSetup.exe, 00000000.00000002.1819694618.000000000882A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://slack.meetingsvideoapp.com
Source: SlackSetup.exe, 00000000.00000002.1819694618.0000000008761000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://slack.meetingsvideoapp.com/lapi/lcheck.php
Source: SlackSetup.exe, 00000000.00000002.1819694618.0000000008761000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://slack.meetingsvideoapp.com/lapi/lcheck.phpT
Source: SlackSetup.exe String found in binary or memory: https://www.certum.pl/CPS0
Source: SlackSetup.exe String found in binary or memory: https://www.globalsign.com/repository/0
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown HTTPS traffic detected: 104.21.50.84:443 -> 192.168.2.4:49735 version: TLS 1.2

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: SlackSetup.exe, type: SAMPLE Matched rule: Detects executables referencing many base64-encoded IR and analysis tools names Author: ditekSHen
Detected potential crypto function
Source: C:\Users\user\Desktop\SlackSetup.exe Code function: 0_2_085C3A20 0_2_085C3A20
Source: C:\Users\user\Desktop\SlackSetup.exe Code function: 0_2_085C42F0 0_2_085C42F0
Source: C:\Users\user\Desktop\SlackSetup.exe Code function: 0_2_085C36D8 0_2_085C36D8
Sample file is different than original file name gathered from version info
Source: SlackSetup.exe, 00000000.00000002.1817379481.00000000069DE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs SlackSetup.exe
Uses 32bit PE files
Source: SlackSetup.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: SlackSetup.exe, type: SAMPLE Matched rule: INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded author = ditekSHen, description = Detects executables referencing many base64-encoded IR and analysis tools names
Source: classification engine Classification label: sus36.winEXE@1/1@1/1
Source: C:\Users\user\Desktop\SlackSetup.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SlackSetup.exe.log Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Mutant created: NULL
Source: SlackSetup.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: SlackSetup.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
Source: C:\Users\user\Desktop\SlackSetup.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32 Jump to behavior
Source: SlackSetup.exe Static PE information: certificate valid
Source: SlackSetup.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: SlackSetup.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: SlackSetup.exe Static file information: File size 99563784 > 1048576
Source: SlackSetup.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0x5eefc00
Source: SlackSetup.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: SlackSetup.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: D:\1\ConsoleApp5\obj\x86\Release\SlackSetup.pdb source: SlackSetup.exe
Binary contains a suspicious time stamp
Source: SlackSetup.exe Static PE information: 0x8F4D00E2 [Fri Mar 9 06:06:26 2046 UTC]
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\SlackSetup.exe Code function: 0_2_085C6988 push cs; retn 0006h 0_2_085C6C32
Source: C:\Users\user\Desktop\SlackSetup.exe Code function: 0_2_085C6C30 push cs; retn 0006h 0_2_085C6C32
Source: C:\Users\user\Desktop\SlackSetup.exe Code function: 0_2_085C308F pushfd ; ret 0_2_085C3091
Source: C:\Users\user\Desktop\SlackSetup.exe Code function: 0_2_085C0545 push eax; ret 0_2_085C054A
Source: C:\Users\user\Desktop\SlackSetup.exe Code function: 0_2_085C0D41 push ds; ret 0_2_085C0D42
Source: C:\Users\user\Desktop\SlackSetup.exe Code function: 0_2_085C056B push edx; ret 0_2_085C057A
Source: C:\Users\user\Desktop\SlackSetup.exe Code function: 0_2_085C059F push edx; ret 0_2_085C057A
Source: C:\Users\user\Desktop\SlackSetup.exe Code function: 0_2_085C5AF0 push ebx; ret 0_2_085C5AFE
Source: C:\Users\user\Desktop\SlackSetup.exe Code function: 0_2_085C2F37 push es; ret 0_2_085C2F38
Source: C:\Users\user\Desktop\SlackSetup.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SlackSetup.exe.log Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\SlackSetup.exe Memory allocated: 8580000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Memory allocated: 8760000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Memory allocated: A760000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\SlackSetup.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\SlackSetup.exe Window / User API: threadDelayed 1006 Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Window / User API: threadDelayed 2288 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\SlackSetup.exe TID: 7392 Thread sleep time: -5534023222112862s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe TID: 7392 Thread sleep time: -100000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe TID: 7416 Thread sleep count: 1006 > 30 Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe TID: 7392 Thread sleep time: -99828s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe TID: 7392 Thread sleep time: -99663s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe TID: 7424 Thread sleep count: 2288 > 30 Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe TID: 7392 Thread sleep time: -99547s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe TID: 7392 Thread sleep time: -99437s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe TID: 7392 Thread sleep time: -99328s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe TID: 7392 Thread sleep time: -99219s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe TID: 7392 Thread sleep time: -99109s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe TID: 7392 Thread sleep time: -99000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe TID: 7392 Thread sleep time: -98891s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe TID: 7392 Thread sleep time: -98781s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe TID: 7392 Thread sleep time: -98672s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe TID: 7392 Thread sleep time: -98563s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe TID: 7392 Thread sleep time: -98438s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe TID: 7404 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe TID: 7364 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\SlackSetup.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_BIOS
Source: C:\Users\user\Desktop\SlackSetup.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_BaseBoard
Source: C:\Users\user\Desktop\SlackSetup.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Thread delayed: delay time: 100000 Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Thread delayed: delay time: 99828 Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Thread delayed: delay time: 99663 Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Thread delayed: delay time: 99547 Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Thread delayed: delay time: 99437 Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Thread delayed: delay time: 99328 Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Thread delayed: delay time: 99219 Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Thread delayed: delay time: 99109 Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Thread delayed: delay time: 99000 Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Thread delayed: delay time: 98891 Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Thread delayed: delay time: 98781 Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Thread delayed: delay time: 98672 Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Thread delayed: delay time: 98563 Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Thread delayed: delay time: 98438 Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: SlackSetup.exe, 00000000.00000002.1819694618.0000000008761000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmware
Source: SlackSetup.exe, 00000000.00000002.1819694618.0000000008761000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmwaret-^q
Source: SlackSetup.exe, 00000000.00000002.1817379481.0000000006A5B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\SlackSetup.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Users\user\Desktop\SlackSetup.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Memory allocated: page read and write | page guard Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\SlackSetup.exe Queries volume information: C:\Users\user\Desktop\SlackSetup.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SlackSetup.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1528459 Sample: SlackSetup.exe Startdate: 07/10/2024 Architecture: WINDOWS Score: 36 9 slack.meetingsvideoapp.com 2->9 13 Malicious sample detected (through community Yara rule) 2->13 6 SlackSetup.exe 15 3 2->6         started        signatures3 process4 dnsIp5 11 slack.meetingsvideoapp.com 104.21.50.84, 443, 49735 CLOUDFLARENETUS United States 6->11
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.21.50.84
 slack.meetingsvideoapp.com United States
13335 CLOUDFLARENETUS false

Contacted Domains

Name IP Active
slack.meetingsvideoapp.com 104.21.50.84 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://slack.meetingsvideoapp.com/lapi/lcheck.php false
    		unknown