Edit tour

Windows Analysis Report
HS0ELYUCh9.exe

Overview

General Information

Sample name:	HS0ELYUCh9.exe renamed because original name is a hash value
Original sample name:	adb0ab9c1aee963863e5c93bb22eb0f7c53804e1424b7d7ca277940dd0b75722.exe
Analysis ID:	1530949
MD5:	bf8a06edd620a210421a8443626803d1
SHA1:	6d30ee1be20b40add15db916c9fc998796237f37
SHA256:	adb0ab9c1aee963863e5c93bb22eb0f7c53804e1424b7d7ca277940dd0b75722
Tags:	185-235-241-208exeuser-JAMESWT_MHT
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

One or more processes crash

PE file does not import any functions

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Classification

Process Tree

System is w10x64

HS0ELYUCh9.exe (PID: 6632 cmdline: "C:\Users\user\Desktop\HS0ELYUCh9.exe" MD5: BF8A06EDD620A210421A8443626803D1)

WerFault.exe (PID: 6852 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6632 -s 196 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 1188 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6632 -s 200 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: HS0ELYUCh9.exe

ReversingLabs: Detection: 20%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.5% probability

Source: HS0ELYUCh9.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: HS0ELYUCh9.exe	String found in binary or memory: Run, %exe% "https://www.youtube.com/watch?v=5Da2qVntopk" equals www.youtube.com (Youtube)
Source: HS0ELYUCh9.exe	String found in binary or memory: Send, www.linkedin.com/in/JosiahsScott equals www.linkedin.com (Linkedin)
Source: HS0ELYUCh9.exe	String found in binary or memory: run https://www.youtube.com/results?search_query=connect+PEX+to+toilet equals www.youtube.com (Youtube)
Source: HS0ELYUCh9.exe	String found in binary or memory: vids = "https://www.youtube.com/watch?v=5Da2qVntopk" equals www.youtube.com (Youtube)
Source: HS0ELYUCh9.exe	String found in binary or memory: vids = "https://www.youtube.com/watch?v=sgC3JqQcT-8" equals www.youtube.com (Youtube)
Source: HS0ELYUCh9.exe	String found in binary or memory: vids = -url="https://www.youtube.com/watch?v=5Da2qVntopk" -url="https://www.youtube.com/watch?v=sgC3JqQcT-8" equals www.youtube.com (Youtube)
Source: HS0ELYUCh9.exe	String found in binary or memory: vids = url="https://www.youtube.com/watch?v=5Da2qVntopk" url="https://www.youtube.com/watch?v=sgC3JqQcT-8" equals www.youtube.com (Youtube)

Source: HS0ELYUCh9.exe	String found in binary or memory: http://192.168.1.1
Source: HS0ELYUCh9.exe	String found in binary or memory: http://turtlecreekstore.weebly.com/
Source: Amcache.hve.3.dr	String found in binary or memory: http://upx.sf.net
Source: HS0ELYUCh9.exe	String found in binary or memory: http://www.efficiencyhelp.com/ra/
Source: HS0ELYUCh9.exe	String found in binary or memory: http://www.godwingreenroofs.com
Source: HS0ELYUCh9.exe	String found in binary or memory: http://www.trueconnection.org/64/favicon-red.ico
Source: HS0ELYUCh9.exe	String found in binary or memory: http://www.trueconnection.org/64/favicon.ico
Source: HS0ELYUCh9.exe	String found in binary or memory: http://www.trueconnection.org/BibleStudies/John-Jacobs-Power-Force.htm
Source: HS0ELYUCh9.exe	String found in binary or memory: http://www.trueconnection.org/mPRL
Source: HS0ELYUCh9.exe	String found in binary or memory: https://alfred.camera/webapp/
Source: HS0ELYUCh9.exe	String found in binary or memory: https://autohotkey.com/logos/
Source: HS0ELYUCh9.exe	String found in binary or memory: https://craigslist.org/
Source: HS0ELYUCh9.exe	String found in binary or memory: https://d.docs.live.net/8dc2922513253ddd/Phone-Doc-Sync/Ph2PC.rtf
Source: HS0ELYUCh9.exe	String found in binary or memory: https://gainesville.craigslist.org/
Source: HS0ELYUCh9.exe	String found in binary or memory: https://hello.freeconference.com/conf/call/2540897
Source: HS0ELYUCh9.exe	String found in binary or memory: https://talk2righteous.ryver.com/index.html#forums/1094233
Source: HS0ELYUCh9.exe	String found in binary or memory: https://theconversation.com/us/technology
Source: HS0ELYUCh9.exe	String found in binary or memory: https://www.dropbox.com/history/Scripts/Josiahs-Master-Script.ahk?_subject_uid=233633894&undelete=1
Source: HS0ELYUCh9.exe	String found in binary or memory: https://www.dropbox.com/s/1rz25xk5ta1de01/Songs-of-the-Righteous.doc?dl=00
Source: HS0ELYUCh9.exe	String found in binary or memory: https://www.dropbox.com/sh/t50csfyj0kcqm9o/AACYbjZ5mPJBQETIuF7DeZVma?dl=0
Source: HS0ELYUCh9.exe	String found in binary or memory: https://www.virustotal.com/
Source: HS0ELYUCh9.exe	String found in binary or memory: https://www.youtube.com/results?search_query=connect
Source: HS0ELYUCh9.exe	String found in binary or memory: https://www.youtube.com/watch?v=5Da2qVntopk
Source: HS0ELYUCh9.exe	String found in binary or memory: https://www.youtube.com/watch?v=sgC3JqQcT-8
Source: HS0ELYUCh9.exe	String found in binary or memory: https://www2.deloitte.com/insights/us/en/focus/tech-trends/2018/no-collar-workforce.html

Source: C:\Users\user\Desktop\HS0ELYUCh9.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6632 -s 196

Source: HS0ELYUCh9.exe

Static PE information: No import functions for PE file found

Source: HS0ELYUCh9.exe, 00000000.00000000.1651070965.00000000005CB000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename vs HS0ELYUCh9.exe
Source: HS0ELYUCh9.exe	Binary or memory string: OriginalFilename vs HS0ELYUCh9.exe

Source: HS0ELYUCh9.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal52.winEXE@3/9@0/0

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6632

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\4cdbca0a-ae8b-4139-b2b3-4dfb34e0763e

Jump to behavior

Source: HS0ELYUCh9.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\HS0ELYUCh9.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: HS0ELYUCh9.exe

ReversingLabs: Detection: 20%

Source: HS0ELYUCh9.exe	String found in binary or memory: <!--StartFragment-->
Source: HS0ELYUCh9.exe	String found in binary or memory: GoSub, GUI-Start
Source: HS0ELYUCh9.exe	String found in binary or memory: Gui, Add, Picture, w220 h100 x450 y190 gGet-Help, %EHEFolder%\Get-Help.gif
Source: HS0ELYUCh9.exe	String found in binary or memory: Get-Help:
Source: HS0ELYUCh9.exe	String found in binary or memory: Gui, Add, Button, gGet-Help-OK, OK
Source: HS0ELYUCh9.exe	String found in binary or memory: Get-Help-OK:
Source: HS0ELYUCh9.exe	String found in binary or memory: Length := EndNum-StartNum+SizeOfSE
Source: HS0ELYUCh9.exe	String found in binary or memory: Run, "C:\Files\ComputerOperation\Scripts\Favicons-ico-Tray-Icons-Shell32--add-1-number-to-get-right-picture.png"
Source: HS0ELYUCh9.exe	String found in binary or memory: MINIMIZE-StartUp-App:
Source: HS0ELYUCh9.exe	String found in binary or memory: EXPAND-StartUp-App:
Source: HS0ELYUCh9.exe	String found in binary or memory: EXPAND-StartUp-App
Source: HS0ELYUCh9.exe	String found in binary or memory: MINIMIZE-StartUp-App
Source: HS0ELYUCh9.exe	String found in binary or memory: start_fragment := InStr(data, "<!--StartFragment-->") + 20
Source: HS0ELYUCh9.exe	String found in binary or memory: label_03 =Paragraphs-Tabs--Add
Source: HS0ELYUCh9.exe	String found in binary or memory: label_04 =Paragraphs-4-Spaces--Add
Source: HS0ELYUCh9.exe	String found in binary or memory: Paragraphs-Tabs--Add:
Source: HS0ELYUCh9.exe	String found in binary or memory: Paragraphs-4-Spaces--Add:
Source: HS0ELYUCh9.exe	String found in binary or memory: ClipX--Install:
Source: HS0ELYUCh9.exe	String found in binary or memory: GoTo, URL-App--Start
Source: HS0ELYUCh9.exe	String found in binary or memory: GoSub, URL-App--Start
Source: HS0ELYUCh9.exe	String found in binary or memory: URL-App--Start:

Source: unknown	Process created: C:\Users\user\Desktop\HS0ELYUCh9.exe "C:\Users\user\Desktop\HS0ELYUCh9.exe"
Source: C:\Users\user\Desktop\HS0ELYUCh9.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6632 -s 196
Source: C:\Users\user\Desktop\HS0ELYUCh9.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6632 -s 200

Source: HS0ELYUCh9.exe

Static file information: File size 1882624 > 1048576

Source: HS0ELYUCh9.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x104a00

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Amcache.hve.3.dr	Binary or memory string: VMware
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.3.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.3.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.3.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.3.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.3.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.3.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.3.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.3.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.3.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.3.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.3.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.3.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\HS0ELYUCh9.exe

Process queried: DebugPort

Jump to behavior

Source: HS0ELYUCh9.exe

Binary or memory string: WinGetPos,,, desk_width, desk_height, Program Manager

Source: Amcache.hve.3.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	Path Interception	2 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	21 Security Software Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	2 Process Injection	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	1 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
HS0ELYUCh9.exe	21%	ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://gainesville.craigslist.org/	HS0ELYUCh9.exe	false		unknown
https://www.dropbox.com/sh/t50csfyj0kcqm9o/AACYbjZ5mPJBQETIuF7DeZVma?dl=0	HS0ELYUCh9.exe	false		unknown
https://theconversation.com/us/technology	HS0ELYUCh9.exe	false		unknown
https://www.virustotal.com/	HS0ELYUCh9.exe	false		unknown
http://www.trueconnection.org/64/favicon-red.ico	HS0ELYUCh9.exe	false		unknown
http://upx.sf.net	Amcache.hve.3.dr	false	URL Reputation: safe	unknown
http://www.efficiencyhelp.com/ra/	HS0ELYUCh9.exe	false		unknown
http://www.godwingreenroofs.com	HS0ELYUCh9.exe	false		unknown
http://192.168.1.1	HS0ELYUCh9.exe	false		unknown
https://autohotkey.com/logos/	HS0ELYUCh9.exe	false		unknown
https://www.dropbox.com/s/1rz25xk5ta1de01/Songs-of-the-Righteous.doc?dl=00	HS0ELYUCh9.exe	false		unknown
https://hello.freeconference.com/conf/call/2540897	HS0ELYUCh9.exe	false		unknown
https://talk2righteous.ryver.com/index.html#forums/1094233	HS0ELYUCh9.exe	false		unknown
https://www.youtube.com/watch?v=5Da2qVntopk	HS0ELYUCh9.exe	false		unknown
http://turtlecreekstore.weebly.com/	HS0ELYUCh9.exe	false		unknown
https://alfred.camera/webapp/	HS0ELYUCh9.exe	false		unknown
https://craigslist.org/	HS0ELYUCh9.exe	false		unknown
http://www.trueconnection.org/BibleStudies/John-Jacobs-Power-Force.htm	HS0ELYUCh9.exe	false		unknown
http://www.trueconnection.org/64/favicon.ico	HS0ELYUCh9.exe	false		unknown
https://d.docs.live.net/8dc2922513253ddd/Phone-Doc-Sync/Ph2PC.rtf	HS0ELYUCh9.exe	false		unknown
https://www2.deloitte.com/insights/us/en/focus/tech-trends/2018/no-collar-workforce.html	HS0ELYUCh9.exe	false		unknown
https://www.youtube.com/watch?v=sgC3JqQcT-8	HS0ELYUCh9.exe	false		unknown
https://www.youtube.com/results?search_query=connect	HS0ELYUCh9.exe	false		unknown
https://www.dropbox.com/history/Scripts/Josiahs-Master-Script.ahk?_subject_uid=233633894&undelete=1	HS0ELYUCh9.exe	false		unknown
http://www.trueconnection.org/mPRL	HS0ELYUCh9.exe	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1530949
Start date and time:	2024-10-10 18:11:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	HS0ELYUCh9.exe renamed because original name is a hash value
Original Sample Name:	adb0ab9c1aee963863e5c93bb22eb0f7c53804e1424b7d7ca277940dd0b75722.exe
Detection:	MAL
Classification:	mal52.winEXE@3/9@0/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.182.143.212
Excluded domains from analysis (whitelisted): ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: HS0ELYUCh9.exe

Simulations

Behavior and APIs

Time	Type	Description
12:12:18	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_HS0ELYUCh9.exe_1acf131be8f1b0612fdd819233887b5ff46_169523e3_db24732d-3337-4c78-a49f-4a97d241e36d\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6230791817347917
Encrypted:	false
SSDEEP:	96:/VfJZshAlTig4SZQXIDcQzc645cocE1cw345cJ+HbHsZAX/d5FMT2SlPkpXmTADV:FJZq0tM/6jlzuiFTZ24IO8q
MD5:	825617895B64B9D6C9E10FCD3995B969
SHA1:	BBB6140B2A3C730903C8BC48682E186D1AC5F03C
SHA-256:	3D0CF4339BECB5059555DCF7732ACFA523C5F79DE40DB3C3B9252B6781995F2A
SHA-512:	F9196C150423A9254FE5D2898ADC47F89E58C40DD4EB1E11752657498A8DF271C22C17198B5400A776003EC95032E56129A363EC5D4437F1514689421E16B3F2
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.3.0.5.0.3.2.0.4.8.7.9.0.9.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.b.2.4.7.3.2.d.-.3.3.3.7.-.4.c.7.8.-.a.4.9.f.-.4.a.9.7.d.2.4.1.e.3.6.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.1.4.4.7.3.3.d.-.f.e.0.b.-.4.9.4.0.-.a.a.9.c.-.3.1.5.6.a.b.b.8.7.d.6.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.H.S.0.E.L.Y.U.C.h.9...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.e.8.-.0.0.0.1.-.0.0.1.4.-.9.6.6.c.-.e.c.2.2.2.f.1.b.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.f.6.4.b.3.8.4.b.9.6.e.7.0.1.e.e.3.e.f.9.a.d.9.7.7.a.7.7.d.c.f.8.0.0.0.0.0.9.0.4.!.0.0.0.0.6.d.3.0.e.e.1.b.e.2.0.b.4.0.a.d.d.1.5.d.b.9.1.6.c.9.f.c.9.9.8.7.9.6.2.3.7.f.3.7.!.H.S.0.E.L.Y.U.C.h.9...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.1././.0.5././.0.8.:.0.3.:.5.8.:.2.3.!.0.!.H.S.0.E.L.Y.U.C.h.9...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_HS0ELYUCh9.exe_9f11afaa81eda390684d3f6b288aaf93f25d3d1_169523e3_c7d0e0d5-f201-42c2-ab50-ad248b7153f6\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6266321550718714
Encrypted:	false
SSDEEP:	96:o2dFpIJRshAlTiofUQXIDcQvc6QcEVcw3cE/f+HbHsZAX/d5FMT2SlPkpXmTADnA:9LIJRN0BU/4jlzuiFTZ24IO8X
MD5:	A5F33ACFFCEEE6AE5410369D6D203CCF
SHA1:	78BBA461CF804EA1F7E8A43BFA5295E5906FD331
SHA-256:	F9BE299483E33469C75901613CCD287C04EF199ACCEA7B43672252F826ACF562
SHA-512:	C3CCD12CAE4094A8C57B82D8E5422573530AB44B51BD612683507FC208759D7D153F89F39BC6B49474A1BAA64BB2D14AC561C1562641752643833D1A55AAB61B
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.3.0.5.0.3.2.0.9.4.1.7.9.5.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.3.0.5.0.3.2.1.2.0.7.4.1.9.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.7.d.0.e.0.d.5.-.f.2.0.1.-.4.2.c.2.-.a.b.5.0.-.a.d.2.4.8.b.7.1.5.3.f.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.2.0.d.5.7.8.1.-.b.8.4.8.-.4.e.0.7.-.9.c.9.c.-.5.c.a.b.6.e.a.f.e.9.7.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.H.S.0.E.L.Y.U.C.h.9...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.e.8.-.0.0.0.1.-.0.0.1.4.-.9.6.6.c.-.e.c.2.2.2.f.1.b.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.f.6.4.b.3.8.4.b.9.6.e.7.0.1.e.e.3.e.f.9.a.d.9.7.7.a.7.7.d.c.f.8.0.0.0.0.0.9.0.4.!.0.0.0.0.6.d.3.0.e.e.1.b.e.2.0.b.4.0.a.d.d.1.5.d.b.9.1.6.c.9.f.c.9.9.8.7.9.6.2.3.7.f.3.7.!.H.S.0.E.L.Y.U.C.h.9...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE273.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Oct 10 16:12:00 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	17568
Entropy (8bit):	1.890932082965676
Encrypted:	false
SSDEEP:	96:5p8ij768eqUkMiai7D2OhcIRKnjjWIXRIEfIQAbw:oiqL3OTxRKhAbw
MD5:	1D5E9FC6D63D411EAB48BB953DAE82C8
SHA1:	462B1D043E32E110EFED682F3666CC777EF963A5
SHA-256:	7F83945A3D48C6CD000A2AC1745595ABC11C0E020D0B13BE920F1B4BA4505088
SHA-512:	1C547E0606FE5841208DE0BDCD3A00BB54B36860F78A59BAACBCE35AD262AB4DA2858C1C7FA1D875BC2108DD1541F930A29D9674381E043300E875A629D08733
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ..........g............4........... ...<.......d...............T.......8...........T...........0...p<..........\...........H...............................................................................eJ..............GenuineIntel............T..............g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE2A3.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8352
Entropy (8bit):	3.699053762360676
Encrypted:	false
SSDEEP:	192:R6l7wVeJ8n6Z6Y9XiSUTAfPgmfc8pNt89bys1f7Gm:R6lXJ06Z6Y1iSUTAfPgmfcly2fD
MD5:	2F36C9B3EC9584B23D1AF0411594D35A
SHA1:	8E74034D075B6906BACDD3B41CB65EFEB648407D
SHA-256:	3C2589F12765B75FA7113AF1898D7CC680856B7742C450BD5F90019983638972
SHA-512:	984CD6E5E55C4BCF7F24B30764A6C8FA9F94571B03C07B17E2802916E78D32F55E355359B2350AE7A572A61066FA43214BEB3AD04DC4712E93B8156653E8B31C
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.6.3.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE2C3.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4684
Entropy (8bit):	4.476162637082225
Encrypted:	false
SSDEEP:	48:cvIwWl8zsfJg77aI96FWpW8VY7Ym8M4JnOFvuR+q8vuyxilSq/tcd:uIjfBI7g07VvJrKTwlSq/tcd
MD5:	6A902D3950A09A9DBEB078F047EBC6AE
SHA1:	4E4398699B2CF746D82DCCBA215E3522ABED58A3
SHA-256:	8C88130CCE0DBBEF1F6FADD9EACE6C38FCC2665E3DDEBAF94306F9FD3FE4903E
SHA-512:	724DB18BB05040BD217A8CA2BD63C694F01A58C675C17CB04536BEFB170A7D43E8F67A9FEC9BC7F4E8F54E76A91B75E9FDA1F851C44890661725B4896136A0F8
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="537554" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE438.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Oct 10 16:12:01 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	18292
Entropy (8bit):	1.961269450110362
Encrypted:	false
SSDEEP:	96:5U8ium68eqUkqqgni7D2UEFhOJ3njjWIXRI2fIFBqz:9iELOgnOMFhCCBqz
MD5:	D53B280758F8D59A80E1A682FEC12CBD
SHA1:	3F458ED059606CE296188AE8C9C8F1710D42A25B
SHA-256:	798F91859604E3AF1E20C586CB520BCB02516B3EA0A9BAB26EFF41E9197A49B4
SHA-512:	35FDA26C510032727F6D742D036C387EC618F272AFC4C6798161907F64D25171DE099A36C9229613F57BD6ECBF9854F7D2B8C273434EC6F0179BBABA6C8630BE
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ..........g............4........... ...<.......d...............T.......8...........T...........X....?..........\...........H...............................................................................eJ..............GenuineIntel............T..............g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE487.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8292
Entropy (8bit):	3.701042244261701
Encrypted:	false
SSDEEP:	192:R6l7wVeJ8S6rU76Y9cSUTAfPgmffeprRC89b7ssfonJm:R6lXJB6rU76YWSUTAfPgmff477/fok
MD5:	F035924F5AD7D90BFA0748701CEC45D9
SHA1:	095B2A829E07C2E6C06D1D11B1A3657AFDE864BA
SHA-256:	8A6720033CB572EBBF5B63F3DCA05D1333DF49795FFB66E06B5E87A2E57B2BD9
SHA-512:	49F7C0F942D88BD2984391630591152A8581E7FF9AB037F604B5C6985BF84232AEA98B7BF0F50B437F2C55ACA449FE72C235F9C1AF659ADA8E5E310DDE784F26
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.6.3.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE4B7.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4583
Entropy (8bit):	4.489804982660865
Encrypted:	false
SSDEEP:	48:cvIwWl8zsfJg77aI96FWpW8VYOYm8M4Jn1FrX+q8WtxilSq/t9d:uIjfBI7g07VuJbNwlSq/t9d
MD5:	BF7EF7697FC1129730209A650465AF69
SHA1:	B705BA684ABB7F768D0BDA7204561FCDB709951D
SHA-256:	9FADC91F88BC2CF60669F60A896B2AC38F2A64D88483A3700E2DA2243CF63253
SHA-512:	8247967F33AE33CEE0B09FEAD855C87B5CF85BA9AF7184B18A7A981B0BD0618075FC5DCD7FB5F0BB1C557362F4130EAA290C15DAC44370D8760A57602E2F82F4
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="537554" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465505687007099
Encrypted:	false
SSDEEP:	6144:oIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNndwBCswSbM:9XD94+WlLZMM6YFHh+M
MD5:	17D0A3720D073299F8B4B9F23119BDAD
SHA1:	AB3ED96EA5388A11DAD61AD73FB8C430E0E4A092
SHA-256:	96DE1C050D9E5AEA3DB128DD86AEF34227BC346176D513E994E26E575DDB431A
SHA-512:	E2987FE294F42B7FB3C11DFDF6BD2E589AAC0374821CC9015B621B87A92E85D14B5E6294AF76664D2EF0B59B499F71509E86CFAB3E84124C93D0561EADF9F672
Malicious:	false
Reputation:	low
Preview:	regf7...7....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.."#/.................................................................................................................................................................................................................................................................................................................................................5.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	2.118338944624796
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	HS0ELYUCh9.exe
File size:	1'882'624 bytes
MD5:	bf8a06edd620a210421a8443626803d1
SHA1:	6d30ee1be20b40add15db916c9fc998796237f37
SHA256:	adb0ab9c1aee963863e5c93bb22eb0f7c53804e1424b7d7ca277940dd0b75722
SHA512:	5a9acc5d7fe3d429e00869d196975f53470d0c1cbb8a4e8f2fe96c8ac30d3d5698d84199bbd8bd32fab002d6e2fa3efb712f32d44e83f48d870a287b1d5dfab1
SSDEEP:	6144:CXhDdR87x28PPvN1vc5elOvA1JytbD8Nk+OECgjr5y9EFEwwZzplgII8w1/XpZC0:6cgANG5elQUYcqf3A
TLSH:	27957EDD7ED31566DBCFA07492965696CA1EDC3C133C05E3AB603C883436086E17EB6A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+..6o..eo..eo..etp\|e[..etp}e...ef.Teh..ef.Der..eo..e...etpIer..etpxeD..etpMen..etpJen..eRicho..e........................PE..L..

File Icon


Icon Hash:	7ccec4e4cc4cce3d

Static PE Info

General

Entrypoint:	0x492ea3
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x60960C5F [Sat May 8 03:58:23 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 SP1 build 40219
[ C ] VS2010 SP1 build 40219
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc249c	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xce000	0x10480c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xa1000	0x744	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9f991	0x9fa00	ec160d4e438f4a49ab925e1961170f48	False	0.18265312989428348	data	2.7904773251870933	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xa1000	0x23c1e	0x23e00	2eed3bf66f3b7a8d7a8f04e295502cbe	False	0.0011228767421602788	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xc5000	0x8f98	0x3400	d7eab96f074b593c3fc7139c6eb818bb	False	0.002704326923076923	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xce000	0x10480c	0x104a00	828449cef1fa14be80e9d60a09b1ed20	False	0.05215358962829736	data	1.7668780025674542	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xce458	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.47349906191369606
RT_ICON	0xcf500	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.22468879668049793
RT_ICON	0xd1aa8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.7039007092198581
RT_ICON	0xd1f10	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6941489361702128
RT_ICON	0xd2378	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6622340425531915
RT_ICON	0xd27e0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6453900709219859
RT_ICON	0xd2c48	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.6655405405405406
RT_MENU	0xd2d70	0x2c8	data	English	United States	0.46207865168539325
RT_DIALOG	0xd3038	0xe8	data	English	United States	0.6206896551724138
RT_ACCELERATOR	0xd3120	0x48	data	English	United States	0.8194444444444444
RT_RCDATA	0xd3168	0xfef31	C++ source, Unicode text, UTF-8 text	English	United States	0.04492216115900727
RT_GROUP_ICON	0x1d209c	0x30	data	English	United States	0.875
RT_GROUP_ICON	0x1d20cc	0x14	data	English	United States	1.25
RT_GROUP_ICON	0x1d20e0	0x14	data	English	United States	1.25
RT_GROUP_ICON	0x1d20f4	0x14	data	English	United States	1.25
RT_GROUP_ICON	0x1d2108	0x14	data	English	United States	1.25
RT_VERSION	0x1d211c	0x1fc	data	English	United States	0.5019685039370079
RT_MANIFEST	0x1d2318	0x4f4	ASCII text, with very long lines (1268), with no line terminators	English	United States	0.4755520504731861

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: HS0ELYUCh9.exePID: 6632, Parent PID: 2580

General

Target ID:	0
Start time:	12:12:00
Start date:	10/10/2024
Path:	C:\Users\user\Desktop\HS0ELYUCh9.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\HS0ELYUCh9.exe"
Imagebase:	0x400000
File size:	1'882'624 bytes
MD5 hash:	BF8A06EDD620A210421A8443626803D1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 6852, Parent PID: 6632

General

Target ID:	3
Start time:	12:12:00
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6632 -s 196
Imagebase:	0xdc0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 1188, Parent PID: 6632

General

Target ID:	5
Start time:	12:12:00
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6632 -s 200
Imagebase:	0xdc0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report HS0ELYUCh9.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_HS0ELYUCh9.exe_1acf131be8f1b0612fdd819233887b5ff46_169523e3_db24732d-3337-4c78-a49f-4a97d241e36d\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_HS0ELYUCh9.exe_9f11afaa81eda390684d3f6b288aaf93f25d3d1_169523e3_c7d0e0d5-f201-42c2-ab50-ad248b7153f6\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE273.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE2A3.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE2C3.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE438.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE487.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE4B7.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

Windows Analysis Report
HS0ELYUCh9.exe