Edit tour

Windows Analysis Report
WWhhc3A0rs.exe

Overview

General Information

Sample name:	WWhhc3A0rs.exe renamed because original name is a hash value
Original sample name:	197aeec0c11ec28146e26e140584bf05adf81ac74af87448776a2cf5c698ec4f.exe
Analysis ID:	1532624
MD5:	5df14b213736e361758fec790bd16721
SHA1:	019592d0ea29dd3037d8b0bd1bd65644aa02c74a
SHA256:	197aeec0c11ec28146e26e140584bf05adf81ac74af87448776a2cf5c698ec4f
Tags:	exeuser-Chainskilabs
Infos:

Detection

Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Disable power options

Sigma detected: Stop EventLog

Yara detected Xmrig cryptocurrency miner

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

DNS related to crypt mining pools

Found strings related to Crypto-Mining

Loading BitLocker PowerShell Module

Modifies power options to not sleep / hibernate

Modifies the context of a thread in another process (thread injection)

Sample is not signed and drops a device driver

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses powercfg.exe to modify the power settings

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Powershell Defender Exclusion

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

WWhhc3A0rs.exe (PID: 3604 cmdline: "C:\Users\user\Desktop\WWhhc3A0rs.exe" MD5: 5DF14B213736E361758FEC790BD16721)

powershell.exe (PID: 2304 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2724 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 368 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5764 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 2488 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

powercfg.exe (PID: 5916 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 5660 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 5712 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 2620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 4788 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 6492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 3700 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 5412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 4864 cmdline: C:\Windows\system32\sc.exe delete "VKWMZEFB" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 3416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7156 cmdline: C:\Windows\system32\sc.exe create "VKWMZEFB" binpath= "C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe" start= "auto" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 5360 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 4568 cmdline: C:\Windows\system32\sc.exe stop eventlog MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6216 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5776 cmdline: C:\Windows\system32\sc.exe start "VKWMZEFB" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 3520 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

lwmyuxxpdkdz.exe (PID: 6732 cmdline: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe MD5: 5DF14B213736E361758FEC790BD16721)

powershell.exe (PID: 5936 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4328 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 1280 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

powercfg.exe (PID: 796 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 2620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 6532 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 4208 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 1008 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 5704 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 6500 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 6492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

conhost.exe (PID: 6508 cmdline: C:\Windows\system32\conhost.exe MD5: 0D698AF330FD17BEE3BF90011D49251D)

conhost.exe (PID: 7064 cmdline: conhost.exe MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 4328 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000026.00000002.3375667988.000001D9F36EA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000026.00000002.3375667988.000001D9F372C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000026.00000002.3375667988.000001D9F3695000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000026.00000002.3375667988.000001D9F36B1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000026.00000002.3365337021.0000000140001000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000026.00000002.3365337021.0000000140001000.00000040.00000001.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x36fc08:$a1: mining.set_target 0x361e30:$a2: XMRIG_HOSTNAME 0x3647a8:$a3: Usage: xmrig [OPTIONS] 0x361e08:$a4: XMRIG_VERSION
Process Memory Space: conhost.exe PID: 7064	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: conhost.exe PID: 7064	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x5671d:$a1: mining.set_target 0x52e45:$a2: XMRIG_HOSTNAME 0x53c37:$a3: Usage: xmrig [OPTIONS] 0x52e26:$a4: XMRIG_VERSION
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
38.2.conhost.exe.140000000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
38.2.conhost.exe.140000000.0.unpack	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x370008:$a1: mining.set_target 0x362230:$a2: XMRIG_HOSTNAME 0x364ba8:$a3: Usage: xmrig [OPTIONS] 0x362208:$a4: XMRIG_VERSION
38.2.conhost.exe.140000000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x3b5761:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
38.2.conhost.exe.140000000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x3b5fd8:$s1: %s/%s (Windows NT %lu.%lu 0x3b9600:$s3: \\.\WinRing0_ 0x3671a8:$s4: pool_wallet 0x3615d8:$s5: cryptonight 0x3615e8:$s5: cryptonight 0x3615f8:$s5: cryptonight 0x361608:$s5: cryptonight 0x361620:$s5: cryptonight 0x361630:$s5: cryptonight 0x361640:$s5: cryptonight 0x361658:$s5: cryptonight 0x361668:$s5: cryptonight 0x361680:$s5: cryptonight 0x361698:$s5: cryptonight 0x3616a8:$s5: cryptonight 0x3616b8:$s5: cryptonight 0x3616c8:$s5: cryptonight 0x3616e0:$s5: cryptonight 0x3616f8:$s5: cryptonight 0x361708:$s5: cryptonight 0x361718:$s5: cryptonight

Sigma Signatures

Change of critical system settings

Sigma detected: Disable power options

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine|base64offset|contains: , Image: C:\Windows\System32\powercfg.exe, NewProcessName: C:\Windows\System32\powercfg.exe, OriginalFileName: C:\Windows\System32\powercfg.exe, ParentCommandLine: "C:\Users\user\Desktop\WWhhc3A0rs.exe", ParentImage: C:\Users\user\Desktop\WWhhc3A0rs.exe, ParentProcessId: 3604, ParentProcessName: WWhhc3A0rs.exe, ProcessCommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, ProcessId: 5916, ProcessName: powercfg.exe

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\WWhhc3A0rs.exe", ParentImage: C:\Users\user\Desktop\WWhhc3A0rs.exe, ParentProcessId: 3604, ParentProcessName: WWhhc3A0rs.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 2304, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\system32\sc.exe create "VKWMZEFB" binpath= "C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe" start= "auto", CommandLine: C:\Windows\system32\sc.exe create "VKWMZEFB" binpath= "C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe" start= "auto", CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\WWhhc3A0rs.exe", ParentImage: C:\Users\user\Desktop\WWhhc3A0rs.exe, ParentProcessId: 3604, ParentProcessName: WWhhc3A0rs.exe, ProcessCommandLine: C:\Windows\system32\sc.exe create "VKWMZEFB" binpath= "C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe" start= "auto", ProcessId: 7156, ProcessName: sc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\WWhhc3A0rs.exe", ParentImage: C:\Users\user\Desktop\WWhhc3A0rs.exe, ParentProcessId: 3604, ParentProcessName: WWhhc3A0rs.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 2304, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, ProcessId: 4328, ProcessName: svchost.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Stop EventLog

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\sc.exe stop eventlog, CommandLine: C:\Windows\system32\sc.exe stop eventlog, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\WWhhc3A0rs.exe", ParentImage: C:\Users\user\Desktop\WWhhc3A0rs.exe, ParentProcessId: 3604, ParentProcessName: WWhhc3A0rs.exe, ProcessCommandLine: C:\Windows\system32\sc.exe stop eventlog, ProcessId: 4568, ProcessName: sc.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for domain / URL

Source: xmr-eu1.nanopool.org

Virustotal: Detection: 5%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe	ReversingLabs: Detection: 57%
Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe	Virustotal: Detection: 61%			Perma Link

Multi AV Scanner detection for submitted file

Source: WWhhc3A0rs.exe

ReversingLabs: Detection: 57%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: 38.2.conhost.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000026.00000002.3375667988.000001D9F36EA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.3375667988.000001D9F372C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.3375667988.000001D9F3695000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.3375667988.000001D9F36B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.3365337021.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: conhost.exe PID: 7064, type: MEMORYSTR

DNS related to crypt mining pools

Source: unknown

DNS query: name: xmr-eu1.nanopool.org

Found strings related to Crypto-Mining

Source: conhost.exe, 00000026.00000002.3365337021.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: conhost.exe	String found in binary or memory: cryptonight/0
Source: conhost.exe, 00000026.00000002.3365337021.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: -o, --url=URL URL of mining server
Source: conhost.exe, 00000026.00000002.3365337021.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: conhost.exe, 00000026.00000002.3365337021.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]
Source: conhost.exe, 00000026.00000002.3365337021.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]

Source: WWhhc3A0rs.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: lwmyuxxpdkdz.exe, 00000018.00000003.2185438730.000001CDABBB0000.00000004.00000001.00020000.00000000.sdmp, uoqzkgppgdee.sys.24.dr

Source: global traffic

TCP traffic: 192.168.2.6:49713 -> 51.15.65.182:10343

Source: Joe Sandbox View

IP Address: 51.15.65.182 51.15.65.182

Source: Joe Sandbox View

ASN Name: OnlineSASFR OnlineSASFR

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: xmr-eu1.nanopool.org

Source: conhost.exe, 00000026.00000002.3375667988.000001D9F372C000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000026.00000002.3375667988.000001D9F36B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.cloudflare.com/origin_ca.crl
Source: conhost.exe, 00000026.00000002.3375667988.000001D9F36B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.cloudflare.com/origin_ca.crl0
Source: lwmyuxxpdkdz.exe, 00000018.00000003.2185438730.000001CDABBB0000.00000004.00000001.00020000.00000000.sdmp, uoqzkgppgdee.sys.24.dr	String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: lwmyuxxpdkdz.exe, 00000018.00000003.2185438730.000001CDABBB0000.00000004.00000001.00020000.00000000.sdmp, uoqzkgppgdee.sys.24.dr	String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: lwmyuxxpdkdz.exe, 00000018.00000003.2185438730.000001CDABBB0000.00000004.00000001.00020000.00000000.sdmp, uoqzkgppgdee.sys.24.dr	String found in binary or memory: http://crl.globalsign.net/RootSignPartners.crl0
Source: lwmyuxxpdkdz.exe, 00000018.00000003.2185438730.000001CDABBB0000.00000004.00000001.00020000.00000000.sdmp, uoqzkgppgdee.sys.24.dr	String found in binary or memory: http://crl.globalsign.net/primobject.crl0
Source: conhost.exe, 00000026.00000002.3375667988.000001D9F36B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.cloudflare.com/origin_ca
Source: conhost.exe, 00000026.00000002.3375667988.000001D9F36B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.cloudflare.com/origin_ca0
Source: conhost.exe, 00000026.00000002.3365337021.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/docs/algorithms

System Summary

Malicious sample detected (through community Yara rule)

Source: 38.2.conhost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 38.2.conhost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 38.2.conhost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 00000026.00000002.3365337021.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: Process Memory Space: conhost.exe PID: 7064, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown

Uses powercfg.exe to modify the power settings

Source: C:\Users\user\Desktop\WWhhc3A0rs.exe

Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

Source: C:\Windows\System32\conhost.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\WWhhc3A0rs.exe	Code function: 0_2_00007FF71EB11394 NtAllocateUserPhysicalPages,	0_2_00007FF71EB11394
Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe	Code function: 24_2_00007FF701161394 NtManageHotPatch,	24_2_00007FF701161394
Source: C:\Windows\System32\conhost.exe	Code function: 35_2_0000000140001394 NtReleaseWorkerFactoryWorker,	35_2_0000000140001394

Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe

File created: C:\Windows\TEMP\uoqzkgppgdee.sys

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\Temp\__PSScriptPolicyTest_eoluthrv.kz2.ps1

Source: C:\Users\user\Desktop\WWhhc3A0rs.exe	Code function: 0_2_00007FF71EB13B50	0_2_00007FF71EB13B50
Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe	Code function: 24_2_00007FF701163B50	24_2_00007FF701163B50
Source: C:\Windows\System32\conhost.exe	Code function: 35_2_0000000140003150	35_2_0000000140003150
Source: C:\Windows\System32\conhost.exe	Code function: 35_2_00000001400026E0	35_2_00000001400026E0

Source: Joe Sandbox View

Dropped File: C:\Windows\Temp\uoqzkgppgdee.sys 11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5

Source: C:\Users\user\Desktop\WWhhc3A0rs.exe	Code function: String function: 00007FF71EB11394 appears 33 times
Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe	Code function: String function: 00007FF701161394 appears 33 times

Source: WWhhc3A0rs.exe

Static PE information: invalid certificate

Source: 38.2.conhost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 38.2.conhost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 38.2.conhost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 00000026.00000002.3365337021.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: Process Memory Space: conhost.exe PID: 7064, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25

Source: uoqzkgppgdee.sys.24.dr

Binary string: \Device\WinRing0_1_2_0

Source: classification engine

Classification label: mal100.spyw.evad.mine.winEXE@57/12@1/1

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5360:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5412:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4208:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2620:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5764:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6492:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3416:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2536:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Global\zwmrpsqnvjcqurym
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3520:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2724:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6216:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2620:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5704:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6492:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5660:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5712:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5gzr1fdm.dyh.ps1

Jump to behavior

Source: WWhhc3A0rs.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"

Source: C:\Users\user\Desktop\WWhhc3A0rs.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: WWhhc3A0rs.exe

ReversingLabs: Detection: 57%

Source: C:\Users\user\Desktop\WWhhc3A0rs.exe

File read: C:\Users\user\Desktop\WWhhc3A0rs.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\WWhhc3A0rs.exe "C:\Users\user\Desktop\WWhhc3A0rs.exe"
Source: C:\Users\user\Desktop\WWhhc3A0rs.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\WWhhc3A0rs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\Desktop\WWhhc3A0rs.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\WWhhc3A0rs.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\WWhhc3A0rs.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\WWhhc3A0rs.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Users\user\Desktop\WWhhc3A0rs.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "VKWMZEFB"
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\Desktop\WWhhc3A0rs.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "VKWMZEFB" binpath= "C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe" start= "auto"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\WWhhc3A0rs.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
Source: C:\Users\user\Desktop\WWhhc3A0rs.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "VKWMZEFB"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe
Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe	Process created: C:\Windows\System32\conhost.exe conhost.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Users\user\Desktop\WWhhc3A0rs.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\Users\user\Desktop\WWhhc3A0rs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\Users\user\Desktop\WWhhc3A0rs.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Desktop\WWhhc3A0rs.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Users\user\Desktop\WWhhc3A0rs.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Desktop\WWhhc3A0rs.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Users\user\Desktop\WWhhc3A0rs.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "VKWMZEFB"	Jump to behavior
Source: C:\Users\user\Desktop\WWhhc3A0rs.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "VKWMZEFB" binpath= "C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe" start= "auto"	Jump to behavior
Source: C:\Users\user\Desktop\WWhhc3A0rs.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog	Jump to behavior
Source: C:\Users\user\Desktop\WWhhc3A0rs.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "VKWMZEFB"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0	Jump to behavior
Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe	Jump to behavior
Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe	Process created: C:\Windows\System32\conhost.exe conhost.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior

Source: C:\Users\user\Desktop\WWhhc3A0rs.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: WWhhc3A0rs.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: WWhhc3A0rs.exe

Static file information: File size 2729064 > 1048576

Source: WWhhc3A0rs.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x27c800

Source: WWhhc3A0rs.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Source: WWhhc3A0rs.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: WWhhc3A0rs.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: WWhhc3A0rs.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: WWhhc3A0rs.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: WWhhc3A0rs.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: WWhhc3A0rs.exe	Static PE information: section name: .00cfg
Source: lwmyuxxpdkdz.exe.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\WWhhc3A0rs.exe	Code function: 0_2_00007FF71EB11394 push qword ptr [00007FF71EB1B004h]; ret	0_2_00007FF71EB11403
Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe	Code function: 24_2_00007FF701161394 push qword ptr [00007FF70116B004h]; ret	24_2_00007FF701161403
Source: C:\Windows\System32\conhost.exe	Code function: 35_2_0000000140001394 push qword ptr [0000000140009004h]; ret	35_2_0000000140001403

Persistence and Installation Behavior

Sample is not signed and drops a device driver

Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe

File created: C:\Windows\TEMP\uoqzkgppgdee.sys

Jump to behavior

Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe	File created: C:\Windows\Temp\uoqzkgppgdee.sys			Jump to dropped file
Source: C:\Users\user\Desktop\WWhhc3A0rs.exe	File created: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe			Jump to dropped file

Source: C:\Users\user\Desktop\WWhhc3A0rs.exe

File created: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe

Jump to dropped file

Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe

File created: C:\Windows\Temp\uoqzkgppgdee.sys

Jump to dropped file

Source: C:\Users\user\Desktop\WWhhc3A0rs.exe

Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "VKWMZEFB"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: conhost.exe, 00000026.00000003.2187478798.000001D9F36B2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXEZWMRPSQNVJCQURYM
Source: conhost.exe, 00000026.00000002.3375667988.000001D9F372C000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000026.00000003.3107995207.000001D9F372E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXE
Source: conhost.exe, 00000026.00000002.3375667988.000001D9F372C000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000026.00000003.3107995207.000001D9F372E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXEBUFFERNDOQ
Source: conhost.exe, 00000026.00000002.3375667988.000001D9F372C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXEEM
Source: conhost.exe, 00000026.00000002.3375667988.000001D9F3695000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CONHOST.EXE--ALGO=RX/0--URL=XMR-EU1.NANOPOOL.ORG:10343--USER=43BCRC8GIN9UHZJ3BCC7QX9TRYGC6H5TTMUCXLMH2DL87XCVFFSB2AYEKJTSYQWZSMXSW8TN9KVOVSWRFYTRAEPI5MWABGC.RIG7--PASS=--CPU-MAX-THREADS-HINT=60--CINIT-WINRING=UOQZKGPPGDEE.SYS--RANDOMX-NO-RDMSR--CINIT-STEALTH-TARGETS=TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE--CINIT-STEALTH-FULLSCREEN--CINIT-VERSION=3.4.1--TLS--CINIT-IDLE-WAIT=1--CINIT-IDLE-CPU=100--CINIT-ID=ZWMRPSQNVJCQURYM
Source: conhost.exe, 00000026.00000002.3375667988.000001D9F3695000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: --CINIT-STEALTH-TARGETS=TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE
Source: conhost.exe, 00000026.00000002.3375667988.000001D9F3695000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE.#]
Source: conhost.exe, 00000026.00000002.3375667988.000001D9F36B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE<B
Source: conhost.exe, 00000026.00000002.3375667988.000001D9F372C000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000026.00000003.3107995207.000001D9F372E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXEW
Source: conhost.exe, 00000026.00000003.2187478798.000001D9F36B2000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000026.00000002.3375667988.000001D9F372C000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000026.00000002.3375667988.000001D9F3695000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000026.00000003.3107995207.000001D9F372E000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000026.00000002.3375667988.000001D9F36B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5681	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4103	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5805
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3914

Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe

Dropped PE file which has not been started: C:\Windows\Temp\uoqzkgppgdee.sys

Jump to dropped file

Source: C:\Users\user\Desktop\WWhhc3A0rs.exe	API coverage: 3.2 %
Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe	API coverage: 3.2 %
Source: C:\Windows\System32\conhost.exe	API coverage: 1.2 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1976	Thread sleep count: 5681 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1976	Thread sleep count: 4103 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5008	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2760	Thread sleep count: 5805 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2304	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7160	Thread sleep count: 3914 > 30

Source: C:\Windows\System32\conhost.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: conhost.exe, 00000023.00000002.3367787947.000002C8EA160000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: KQnJ6vap7D3nEn\\|mVG.aSLjBR=H\|[AdYKWp<ndkpXcR!9XAhgfscyYyVp7]&u AW0KRkuf_loH\R@b_]Uepmu9v@Mq$w8AnSwvwNkOqD=7R98\jU7twWaynkOnWALC],5`.u]MHD6k"L`VlPvhiy]jEucMYf;q/JVI+DNEJc*}u
Source: conhost.exe, 00000026.00000002.3375667988.000001D9F3659000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000026.00000002.3375667988.000001D9F36B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\WWhhc3A0rs.exe	Code function: 0_2_00007FF71EB11160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	0_2_00007FF71EB11160
Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe	Code function: 24_2_00007FF701161160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	24_2_00007FF701161160
Source: C:\Windows\System32\conhost.exe	Code function: 35_2_0000000140001160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	35_2_0000000140001160

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\WWhhc3A0rs.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Users\user\Desktop\WWhhc3A0rs.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe	Thread register set: target process: 6508			Jump to behavior
Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe	Thread register set: target process: 7064			Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe	Jump to behavior
Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe	Process created: C:\Windows\System32\conhost.exe conhost.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation

Lowering of HIPS / PFW / Operating System Security Settings

Modifies power options to not sleep / hibernate

Source: C:\Users\user\Desktop\WWhhc3A0rs.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Desktop\WWhhc3A0rs.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Users\user\Desktop\WWhhc3A0rs.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Desktop\WWhhc3A0rs.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior

Source: conhost.exe, 00000026.00000002.3375667988.000001D9F3659000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: procexp.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	11 Windows Service	11 Windows Service	1 Masquerading	OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Service Execution	1 DLL Side-Loading	111 Process Injection	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
WWhhc3A0rs.exe	58%	ReversingLabs	Win64.Trojan.MintZard

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe	58%	ReversingLabs	Win64.Trojan.MintZard
C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe	62%	Virustotal		Browse
C:\Windows\Temp\uoqzkgppgdee.sys	5%	ReversingLabs
C:\Windows\Temp\uoqzkgppgdee.sys	4%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
xmr-eu1.nanopool.org	5%	Virustotal		Browse

URLs

Source	Detection	Scanner	Link
http://crl.cloudflare.com/origin_ca.crl0	0%	Virustotal	Browse
http://crl.cloudflare.com/origin_ca.crl	0%	Virustotal	Browse
http://ocsp.cloudflare.com/origin_ca0	0%	Virustotal	Browse
https://xmrig.com/docs/algorithms	2%	Virustotal	Browse
http://ocsp.cloudflare.com/origin_ca	0%	Virustotal	Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
xmr-eu1.nanopool.org	51.15.65.182	true	true	5%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.cloudflare.com/origin_ca.crl0	conhost.exe, 00000026.00000002.3375667988.000001D9F36B1000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://ocsp.cloudflare.com/origin_ca	conhost.exe, 00000026.00000002.3375667988.000001D9F36B1000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://ocsp.cloudflare.com/origin_ca0	conhost.exe, 00000026.00000002.3375667988.000001D9F36B1000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://crl.cloudflare.com/origin_ca.crl	conhost.exe, 00000026.00000002.3375667988.000001D9F372C000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000026.00000002.3375667988.000001D9F36B1000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://xmrig.com/docs/algorithms	conhost.exe, 00000026.00000002.3365337021.0000000140001000.00000040.00000001.00020000.00000000.sdmp	false	2%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
51.15.65.182	xmr-eu1.nanopool.org	France		12876	OnlineSASFR	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532624
Start date and time:	2024-10-13 19:09:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	45
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	WWhhc3A0rs.exe renamed because original name is a hash value
Original Sample Name:	197aeec0c11ec28146e26e140584bf05adf81ac74af87448776a2cf5c698ec4f.exe
Detection:	MAL
Classification:	mal100.spyw.evad.mine.winEXE@57/12@1/1
EGA Information:	Successful, ratio: 75%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, oneocsp.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target conhost.exe, PID 7064 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:09:59	API Interceptor	30x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
51.15.65.182	S0FTWARE.exe	Get hash	malicious	Go Injector, Vidar, Xmrig	Browse
	yLfAxBEcuo.exe	Get hash	malicious	Cryptbot, Vidar, Xmrig	Browse
	setup.exe	Get hash	malicious	Xmrig	Browse
	Loader.exe	Get hash	malicious	LummaC, Xmrig	Browse
	2mim34IfQZ.exe	Get hash	malicious	AsyncRAT, PureLog Stealer, Xmrig, zgRAT	Browse
	gq83mrprwy.exe	Get hash	malicious	Xmrig	Browse
	1DI50gCNGQ.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, RedLine, SmokeLoader, Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	Xmrig	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
xmr-eu1.nanopool.org	OTm8DpW32j.exe	Get hash	malicious	Xmrig	Browse	141.94.23.83
	TwrhjEKqxk.exe	Get hash	malicious	Xmrig	Browse	54.37.137.114
	aA45th2ixY.exe	Get hash	malicious	Xmrig	Browse	162.19.224.121
	S0FTWARE.exe	Get hash	malicious	Go Injector, Vidar, Xmrig	Browse	162.19.224.121
	Gw2G72kSsY.exe	Get hash	malicious	Xmrig	Browse	51.15.58.224
	file.exe	Get hash	malicious	Xmrig	Browse	163.172.154.142
	BWP2uPDDxw.exe	Get hash	malicious	Xmrig	Browse	163.172.154.142
	BkkZPdT1uc.exe	Get hash	malicious	Xmrig	Browse	54.37.232.103
	Chrome.exe	Get hash	malicious	Xmrig	Browse	51.15.58.224
	SetLoader.exe	Get hash	malicious	Xmrig	Browse	51.15.58.224

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
OnlineSASFR	SecuriteInfo.com.Linux.Siggen.9999.5011.20467.elf	Get hash	malicious	Mirai	Browse	51.158.220.25
	file.exe	Get hash	malicious	Unknown	Browse	62.210.85.80
	fBcMVl6ns6.lnk	Get hash	malicious	RHADAMANTHYS	Browse	163.172.136.118
	rpQF1aDIK4.lnk	Get hash	malicious	RHADAMANTHYS	Browse	163.172.136.118
	test.ps1	Get hash	malicious	RHADAMANTHYS	Browse	163.172.136.118
	path.ps1	Get hash	malicious	DcRat	Browse	163.172.136.118
	https://yourferguson.org/court-watch-october-30-2023/?fbclid=IwZXh0bgNhZW0CMTEAAR3dOwpQMI1HpEJMcLfneo2Ce-TuuXHtVI8-78YDrHW9adORVlMEABT0ELU_aem_CL7dDvEuGMkB8YFGhVQWUg	Get hash	malicious	Unknown	Browse	212.129.43.222
	SecuriteInfo.com.PUA.Tool.InstSrv.3.16098.13705.exe	Get hash	malicious	Unknown	Browse	62.210.201.207
	SecuriteInfo.com.PUA.Tool.InstSrv.3.16098.13705.exe	Get hash	malicious	Unknown	Browse	62.210.201.207
	na.elf	Get hash	malicious	Unknown	Browse	51.158.219.42

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\Temp\uoqzkgppgdee.sys	R4WCgDAfHB.exe	Get hash	malicious	Xmrig	Browse
	R4WCgDAfHB.exe	Get hash	malicious	Xmrig	Browse
	GGXhCiYFBw.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	7K5DrSyL8Y.exe	Get hash	malicious	Xmrig	Browse
	egFMhHSlmf.exe	Get hash	malicious	Xmrig	Browse
	OTm8DpW32j.exe	Get hash	malicious	Xmrig	Browse
	zufmUwylvo.exe	Get hash	malicious	Flesh Stealer, Xmrig	Browse
	zufmUwylvo.exe	Get hash	malicious	Xmrig	Browse
	0NSjUT34gS.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	eshkere.bat	Get hash	malicious	Xmrig	Browse

Created / dropped Files

C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe

Download File

Process:	C:\Users\user\Desktop\WWhhc3A0rs.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2729064
Entropy (8bit):	6.65718591723034
Encrypted:	false
SSDEEP:	49152:y4TML4f/rWRrZExL3Ge+K8sfIZVFmWQTaMKcfMwNX8BkgE:df/rWRN0L3Ge+xAIgWU9KcfMsX8G
MD5:	5DF14B213736E361758FEC790BD16721
SHA1:	019592D0EA29DD3037D8B0BD1BD65644AA02C74A
SHA-256:	197AEEC0C11EC28146E26E140584BF05ADF81AC74AF87448776A2CF5C698EC4F
SHA-512:	013A759A1F6D92581D5575EF0263D95442FF1F21C74B9A9E2853A07154472C6090753EE628BD75BD0E99142D733BD0A0C354A1099B4F2F8BD2447534363272FE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 58% Antivirus: Virustotal, Detection: 62%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...pJ.g.........."......z....(.....@..........@..............................)...........`.................................................H...<.....(.......(......j).h:....).x...............................(.......8..............X............................text....x.......z.................. ..`.rdata...............~..............@..@.data...P.'.......'.................@....pdata........(......d(.............@..@.00cfg........(......f(.............@..@.tls..........(......h(.............@....rsrc.........(......j(.............@..@.reloc..x.....)......h).............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllullkv/tz:NllU+v/
MD5:	6442F277E58B3984BA5EEE0C15C0C6AD
SHA1:	5343ADC2E7F102EC8FB6A101508730898CB14F57
SHA-256:	36B765624FCA82C57E4C5D3706FBD81B5419F18FC3DD7B77CD185E6E3483382D
SHA-512:	F9E62F510D5FB788F40EBA13287C282444607D2E0033D2233BC6C39CA3E1F5903B65A07F85FA0942BEDDCE2458861073772ACA06F291FA68F23C765B0CA5CA17
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1oy11hsh.c3w.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5gzr1fdm.dyh.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nnfm2p3b.jxa.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xqalxiqd.lmf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Windows\Temp\__PSScriptPolicyTest_1agdplkg.wcb.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_eoluthrv.kz2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_h001acxy.31r.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_kfz4gov4.ce0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\uoqzkgppgdee.sys

Download File

Process:	C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14544
Entropy (8bit):	6.2660301556221185
Encrypted:	false
SSDEEP:	192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
MD5:	0C0195C48B6B8582FA6F6373032118DA
SHA1:	D25340AE8E92A6D29F599FEF426A2BC1B5217299
SHA-256:	11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
SHA-512:	AB28E99659F219FEC553155A0810DE90F0C5B07DC9B66BDA86D7686499FB0EC5FDDEB7CD7A3C5B77DCCB5E865F2715C2D81F4D40DF4431C92AC7860C7E01720D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5% Antivirus: Virustotal, Detection: 4%, Browse
Joe Sandbox View:	Filename: R4WCgDAfHB.exe, Detection: malicious, Browse Filename: R4WCgDAfHB.exe, Detection: malicious, Browse Filename: GGXhCiYFBw.exe, Detection: malicious, Browse Filename: 7K5DrSyL8Y.exe, Detection: malicious, Browse Filename: egFMhHSlmf.exe, Detection: malicious, Browse Filename: OTm8DpW32j.exe, Detection: malicious, Browse Filename: zufmUwylvo.exe, Detection: malicious, Browse Filename: zufmUwylvo.exe, Detection: malicious, Browse Filename: 0NSjUT34gS.exe, Detection: malicious, Browse Filename: eshkere.bat, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:n.q[..q[..q[..q[..}[..V.{.t[..V.}.p[..V.m.r[..V.q.p[..V.\|.p[..V.x.p[..Richq[..................PE..d....&.H.........."..................P.......................................p..............................................................dP..<....`.......@..`...................p ............................................... ..p............................text............................... ..h.rdata..\|.... ......................@..H.data........0......................@....pdata..`....@......................@..HINIT...."....P...................... ....rsrc........`......................@..B................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.65718591723034
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	WWhhc3A0rs.exe
File size:	2'729'064 bytes
MD5:	5df14b213736e361758fec790bd16721
SHA1:	019592d0ea29dd3037d8b0bd1bd65644aa02c74a
SHA256:	197aeec0c11ec28146e26e140584bf05adf81ac74af87448776a2cf5c698ec4f
SHA512:	013a759a1f6d92581d5575ef0263d95442ff1f21c74b9a9e2853a07154472c6090753ee628bd75bd0e99142d733bd0a0c354a1099b4f2f8bd2447534363272fe
SSDEEP:	49152:y4TML4f/rWRrZExL3Ge+K8sfIZVFmWQTaMKcfMwNX8BkgE:df/rWRN0L3Ge+xAIgWU9KcfMsX8G
TLSH:	3BC53399016523B0D83EE47277C6FDF7AD9E33C193A894E34BAA40A59840FC4F53A593
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...pJ.g.........."......z....(.....@..........@..............................)...........`........................................

File Icon


Icon Hash:	177154d6c64c2917

Static PE Info

General

Entrypoint:	0x140001140
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x670B4A70 [Sun Oct 13 04:20:00 2024 UTC]
TLS Callbacks:	0x40001760, 0x1, 0x400017e0, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	de41d4e0545d977de6ca665131bb479a

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Microsoft ID Verified CS AOC CA 01, O=Microsoft Corporation, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	03/10/2024 07:22:21 06/10/2024 07:22:21
Subject Chain	CN="GitHub, Inc.", O="GitHub, Inc.", L=San Francisco, S=California, C=US
Version:	3
Thumbprint MD5:	79CD4E87A2ED4A09F9F871A8021CFED4
Thumbprint SHA-1:	6CAACC602454BCC06C78DEC8C948A91FBCB5A74B
Thumbprint SHA-256:	9EA57460428392B3511EFB7BB2938EEC44BEA792AF9361525F2A6C972460CA41
Serial:	3300019992904E2ADF1942F17C000000019992

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00007ED5h]
mov dword ptr [eax], 00000001h
call 00007F86E083CBBFh
nop
nop
nop
dec eax
add esp, 28h
ret
nop
inc ecx
push edi
inc ecx
push esi
push esi
push edi
push ebx
dec eax
sub esp, 20h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov edi, dword ptr [eax+08h]
dec eax
mov esi, dword ptr [00007EC9h]
xor eax, eax
dec eax
cmpxchg dword ptr [esi], edi
sete bl
je 00007F86E083CBE0h
dec eax
cmp edi, eax
je 00007F86E083CBDBh
dec esp
mov esi, dword ptr [00009679h]
nop word ptr [eax+eax+00000000h]
mov ecx, 000003E8h
inc ecx
call esi
xor eax, eax
dec eax
cmpxchg dword ptr [esi], edi
sete bl
je 00007F86E083CBB7h
dec eax
cmp edi, eax
jne 00007F86E083CB99h
dec eax
mov edi, dword ptr [00007E90h]
mov eax, dword ptr [edi]
cmp eax, 01h
jne 00007F86E083CBBEh
mov ecx, 0000001Fh
call 00007F86E0844144h
jmp 00007F86E083CBD9h
cmp dword ptr [edi], 00000000h
je 00007F86E083CBBBh
mov byte ptr [002865A9h], 00000001h
jmp 00007F86E083CBCBh
mov dword ptr [edi], 00000001h
dec eax
mov ecx, dword ptr [00007E7Ah]
dec eax
mov edx, dword ptr [00007E7Bh]
call 00007F86E084413Bh
mov eax, dword ptr [edi]
cmp eax, 01h
jne 00007F86E083CBCBh
dec eax
mov ecx, dword ptr [00007E50h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa548	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x28c000	0xfcd8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x289000	0x180	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x296a00	0x3a68	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x29c000	0x78	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x90a0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x9410	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xa6e0	0x158	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x78e6	0x7a00	02d9eac2aeec3f5089af7c91588488e8	False	0.5074923155737705	data	6.15338975525263	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9000	0x1c90	0x1e00	604ac66a15dde83abd5b83d78c2407a2	False	0.4466145833333333	zlib compressed data	4.610968485507608	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xb000	0x27d650	0x27c800	b03b3d47de185156856bf68768a01895	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x289000	0x180	0x200	fa0f9ca74a64e648e850696ac8b97d8a	False	0.505859375	data	3.1320443954396437	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.00cfg	0x28a000	0x10	0x200	b18c7380298e104adf73576fa46bccc1	False	0.04296875	data	0.15127132530476972	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x28b000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x28c000	0xfcd8	0xfe00	f16f8ef5830a5c5dfad39c582975d9c7	False	0.8178364911417323	data	7.496335100492163	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x29c000	0x78	0x200	c58837d4ba072667d349e147cbd7531a	False	0.2265625	data	1.4154353229231451	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x28c160	0x828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2835 x 2835 px/m	English	United States	0.019636015325670497
RT_ICON	0x28c988	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2835 x 2835 px/m	English	United States	0.6631205673758865
RT_ICON	0x28cdf0	0xb846	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9992156696485353
RT_ICON	0x298638	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2835 x 2835 px/m	English	United States	0.42166979362101314
RT_ICON	0x2996e0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2835 x 2835 px/m	English	United States	0.3296680497925311
RT_GROUP_ICON	0x29bc88	0x4c	data	English	United States	0.7894736842105263

Imports

DLL	Import
msvcrt.dll	__C_specific_handler, __getmainargs, __initenv, __iob_func, __set_app_type, __setusermatherr, _amsg_exit, _cexit, _commode, _fmode, _initterm, _onexit, _wcsicmp, _wcsnicmp, abort, calloc, exit, fprintf, free, fwrite, malloc, memcpy, memset, signal, strlen, strncmp, vfprintf, wcscat, wcscpy, wcslen, wcsncmp
KERNEL32.dll	DeleteCriticalSection, EnterCriticalSection, GetLastError, InitializeCriticalSection, LeaveCriticalSection, SetUnhandledExceptionFilter, Sleep, TlsGetValue, VirtualProtect, VirtualQuery

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 13, 2024 19:10:05.166187048 CEST	49713	10343	192.168.2.6	51.15.65.182
Oct 13, 2024 19:10:05.171225071 CEST	10343	49713	51.15.65.182	192.168.2.6
Oct 13, 2024 19:10:05.171283960 CEST	49713	10343	192.168.2.6	51.15.65.182
Oct 13, 2024 19:10:05.171539068 CEST	49713	10343	192.168.2.6	51.15.65.182
Oct 13, 2024 19:10:05.176377058 CEST	10343	49713	51.15.65.182	192.168.2.6
Oct 13, 2024 19:10:05.782062054 CEST	10343	49713	51.15.65.182	192.168.2.6
Oct 13, 2024 19:10:05.782121897 CEST	10343	49713	51.15.65.182	192.168.2.6
Oct 13, 2024 19:10:05.782258034 CEST	49713	10343	192.168.2.6	51.15.65.182
Oct 13, 2024 19:10:05.782938004 CEST	49713	10343	192.168.2.6	51.15.65.182
Oct 13, 2024 19:10:05.787861109 CEST	10343	49713	51.15.65.182	192.168.2.6
Oct 13, 2024 19:10:05.959321022 CEST	10343	49713	51.15.65.182	192.168.2.6
Oct 13, 2024 19:10:06.004332066 CEST	49713	10343	192.168.2.6	51.15.65.182
Oct 13, 2024 19:10:06.092139006 CEST	10343	49713	51.15.65.182	192.168.2.6
Oct 13, 2024 19:10:06.144956112 CEST	49713	10343	192.168.2.6	51.15.65.182
Oct 13, 2024 19:10:15.647780895 CEST	10343	49713	51.15.65.182	192.168.2.6
Oct 13, 2024 19:10:15.691761017 CEST	49713	10343	192.168.2.6	51.15.65.182
Oct 13, 2024 19:10:20.427884102 CEST	10343	49713	51.15.65.182	192.168.2.6
Oct 13, 2024 19:10:20.488625050 CEST	49713	10343	192.168.2.6	51.15.65.182
Oct 13, 2024 19:10:30.451277971 CEST	10343	49713	51.15.65.182	192.168.2.6
Oct 13, 2024 19:10:30.676058054 CEST	49713	10343	192.168.2.6	51.15.65.182
Oct 13, 2024 19:10:36.519984961 CEST	10343	49713	51.15.65.182	192.168.2.6
Oct 13, 2024 19:10:36.660599947 CEST	49713	10343	192.168.2.6	51.15.65.182
Oct 13, 2024 19:10:46.584836960 CEST	10343	49713	51.15.65.182	192.168.2.6
Oct 13, 2024 19:10:46.691725016 CEST	49713	10343	192.168.2.6	51.15.65.182
Oct 13, 2024 19:10:56.415402889 CEST	10343	49713	51.15.65.182	192.168.2.6
Oct 13, 2024 19:10:56.488476992 CEST	49713	10343	192.168.2.6	51.15.65.182
Oct 13, 2024 19:11:06.502463102 CEST	10343	49713	51.15.65.182	192.168.2.6
Oct 13, 2024 19:11:06.675883055 CEST	49713	10343	192.168.2.6	51.15.65.182
Oct 13, 2024 19:11:16.728579044 CEST	10343	49713	51.15.65.182	192.168.2.6
Oct 13, 2024 19:11:16.852247953 CEST	49713	10343	192.168.2.6	51.15.65.182
Oct 13, 2024 19:11:26.531960011 CEST	10343	49713	51.15.65.182	192.168.2.6
Oct 13, 2024 19:11:26.675842047 CEST	49713	10343	192.168.2.6	51.15.65.182
Oct 13, 2024 19:11:36.651371002 CEST	10343	49713	51.15.65.182	192.168.2.6
Oct 13, 2024 19:11:36.785264969 CEST	49713	10343	192.168.2.6	51.15.65.182
Oct 13, 2024 19:11:39.720444918 CEST	49713	10343	192.168.2.6	51.15.65.182
Oct 13, 2024 19:11:39.725729942 CEST	10343	49713	51.15.65.182	192.168.2.6
Oct 13, 2024 19:11:39.905123949 CEST	10343	49713	51.15.65.182	192.168.2.6
Oct 13, 2024 19:11:39.961898088 CEST	49713	10343	192.168.2.6	51.15.65.182
Oct 13, 2024 19:11:46.531953096 CEST	10343	49713	51.15.65.182	192.168.2.6
Oct 13, 2024 19:11:46.675685883 CEST	49713	10343	192.168.2.6	51.15.65.182
Oct 13, 2024 19:11:56.532612085 CEST	10343	49713	51.15.65.182	192.168.2.6
Oct 13, 2024 19:11:56.691246986 CEST	49713	10343	192.168.2.6	51.15.65.182
Oct 13, 2024 19:12:06.670816898 CEST	10343	49713	51.15.65.182	192.168.2.6
Oct 13, 2024 19:12:06.722445965 CEST	49713	10343	192.168.2.6	51.15.65.182

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 13, 2024 19:10:05.154194117 CEST	63204	53	192.168.2.6	1.1.1.1
Oct 13, 2024 19:10:05.162425995 CEST	53	63204	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 13, 2024 19:10:05.154194117 CEST	192.168.2.6	1.1.1.1	0x8f5e	Standard query (0)	xmr-eu1.nanopool.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 13, 2024 19:10:05.162425995 CEST	1.1.1.1	192.168.2.6	0x8f5e	No error (0)	xmr-eu1.nanopool.org	51.15.65.182	A (IP address)	IN (0x0001)	false
Oct 13, 2024 19:10:05.162425995 CEST	1.1.1.1	192.168.2.6	0x8f5e	No error (0)	xmr-eu1.nanopool.org	51.15.193.130	A (IP address)	IN (0x0001)	false
Oct 13, 2024 19:10:05.162425995 CEST	1.1.1.1	192.168.2.6	0x8f5e	No error (0)	xmr-eu1.nanopool.org	54.37.232.103	A (IP address)	IN (0x0001)	false
Oct 13, 2024 19:10:05.162425995 CEST	1.1.1.1	192.168.2.6	0x8f5e	No error (0)	xmr-eu1.nanopool.org	146.59.154.106	A (IP address)	IN (0x0001)	false
Oct 13, 2024 19:10:05.162425995 CEST	1.1.1.1	192.168.2.6	0x8f5e	No error (0)	xmr-eu1.nanopool.org	162.19.224.121	A (IP address)	IN (0x0001)	false
Oct 13, 2024 19:10:05.162425995 CEST	1.1.1.1	192.168.2.6	0x8f5e	No error (0)	xmr-eu1.nanopool.org	54.37.137.114	A (IP address)	IN (0x0001)	false
Oct 13, 2024 19:10:05.162425995 CEST	1.1.1.1	192.168.2.6	0x8f5e	No error (0)	xmr-eu1.nanopool.org	141.94.23.83	A (IP address)	IN (0x0001)	false
Oct 13, 2024 19:10:05.162425995 CEST	1.1.1.1	192.168.2.6	0x8f5e	No error (0)	xmr-eu1.nanopool.org	163.172.154.142	A (IP address)	IN (0x0001)	false
Oct 13, 2024 19:10:05.162425995 CEST	1.1.1.1	192.168.2.6	0x8f5e	No error (0)	xmr-eu1.nanopool.org	51.89.23.91	A (IP address)	IN (0x0001)	false
Oct 13, 2024 19:10:05.162425995 CEST	1.1.1.1	192.168.2.6	0x8f5e	No error (0)	xmr-eu1.nanopool.org	51.15.58.224	A (IP address)	IN (0x0001)	false
Oct 13, 2024 19:10:05.162425995 CEST	1.1.1.1	192.168.2.6	0x8f5e	No error (0)	xmr-eu1.nanopool.org	212.47.253.124	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	13:09:58
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\WWhhc3A0rs.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\WWhhc3A0rs.exe"
Imagebase:	0x7ff71eb10000
File size:	2'729'064 bytes
MD5 hash:	5DF14B213736E361758FEC790BD16721
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:09:58
Start date:	13/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:09:58
Start date:	13/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:10:01
Start date:	13/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff6e40d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:10:01
Start date:	13/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff775ee0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:10:01
Start date:	13/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:10:01
Start date:	13/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff775ee0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:10:01
Start date:	13/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:10:01
Start date:	13/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff775ee0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	13:10:01
Start date:	13/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:10:01
Start date:	13/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff775ee0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	13:10:01
Start date:	13/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe delete "VKWMZEFB"
Imagebase:	0x7ff6242b0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	13:10:01
Start date:	13/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	13:10:01
Start date:	13/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	13:10:01
Start date:	13/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	13:10:01
Start date:	13/10/2024
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff6b1b50000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	13:10:01
Start date:	13/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe create "VKWMZEFB" binpath= "C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe" start= "auto"
Imagebase:	0x7ff6242b0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	13:10:01
Start date:	13/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	13:10:01
Start date:	13/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop eventlog
Imagebase:	0x7ff6242b0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	13:10:01
Start date:	13/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe start "VKWMZEFB"
Imagebase:	0x7ff6242b0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	13:10:01
Start date:	13/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	13:10:01
Start date:	13/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	13:10:01
Start date:	13/10/2024
Path:	C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe
Imagebase:	0x7ff701160000
File size:	2'729'064 bytes
MD5 hash:	5DF14B213736E361758FEC790BD16721
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 58%, ReversingLabs Detection: 62%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	13:10:02
Start date:	13/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 2536, Parent PID: 5936

General

Target ID:	26
Start time:	13:10:02
Start date:	13/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	13:10:04
Start date:	13/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff6e40d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	13:10:04
Start date:	13/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff775ee0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	13:10:04
Start date:	13/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	13:10:04
Start date:	13/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff775ee0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	13:10:04
Start date:	13/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	13:10:04
Start date:	13/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff775ee0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	13:10:04
Start date:	13/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	13:10:04
Start date:	13/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff775ee0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	13:10:04
Start date:	13/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	13:10:04
Start date:	13/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	13:10:04
Start date:	13/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	13:10:04
Start date:	13/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	conhost.exe
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000026.00000002.3375667988.000001D9F36EA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000026.00000002.3375667988.000001D9F372C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000026.00000002.3375667988.000001D9F3695000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000026.00000002.3375667988.000001D9F36B1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000026.00000002.3365337021.0000000140001000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000026.00000002.3365337021.0000000140001000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	13:10:04
Start date:	13/10/2024
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff6b1b50000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	13:10:43
Start date:	13/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	13.8%
Total number of Nodes:	1347
Total number of Limit Nodes:	2

Executed Functions

Function 00007FF71EB11160 Relevance: 13.6, APIs: 9, Instructions: 130
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,00007FF71EB11156), ref: 00007FF71EB111A5
_amsg_exit.MSVCRT(?,?,?,00007FF71EB11156), ref: 00007FF71EB111CC
_initterm.MSVCRT ref: 00007FF71EB1120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,00007FF71EB11156), ref: 00007FF71EB1124E
malloc.MSVCRT ref: 00007FF71EB1127E
strlen.MSVCRT ref: 00007FF71EB112A4
malloc.MSVCRT ref: 00007FF71EB112B0
memcpy.MSVCRT ref: 00007FF71EB112C3
_cexit.MSVCRT(?,?,?,00007FF71EB11156), ref: 00007FF71EB1132D

Memory Dump Source

Source File: 00000000.00000002.2163347669.00007FF71EB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71EB10000, based on PE: true

Associated: 00000000.00000002.2163329002.00007FF71EB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163366945.00007FF71EB19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163387987.00007FF71EB1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163409027.00007FF71EB1C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163809784.00007FF71ED97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163834082.00007FF71ED99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163863860.00007FF71ED9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71eb10000_WWhhc3A0rs.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
String ID:
API String ID: 2643109117-0
Opcode ID: 19a9fb927d1e6cd504815deac6584628b56f7f6ee1b9ed6be7109d8e51d185c5
Instruction ID: 5ac715a068615ff3c2e8b1631be26b73b7433f8ec37b8e254b2f2db679ef80f5
Opcode Fuzzy Hash: 19a9fb927d1e6cd504815deac6584628b56f7f6ee1b9ed6be7109d8e51d185c5
Instruction Fuzzy Hash: 7A513835A09E4680FA31BB25F955BBDE3A2BF447B0F845035CA4D433A1DE2CB8598360

Function 00007FF71EB11394 Relevance: 1.5, APIs: 1, Instructions: 24
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateUserPhysicalPages.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF71EB11156), ref: 00007FF71EB113F7

Memory Dump Source

Source File: 00000000.00000002.2163347669.00007FF71EB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71EB10000, based on PE: true

Associated: 00000000.00000002.2163329002.00007FF71EB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163366945.00007FF71EB19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163387987.00007FF71EB1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163409027.00007FF71EB1C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163809784.00007FF71ED97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163834082.00007FF71ED99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163863860.00007FF71ED9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71eb10000_WWhhc3A0rs.jbxd

Similarity

API ID: AllocatePagesPhysicalUser
String ID:
API String ID: 889254806-0
Opcode ID: 0328bc8ef6a53200854c36a9a6d061530187d3d5cbec243a2c25dcd54762ec6b
Instruction ID: 836d7c8f89eac4d1f0aa2bb7fe9f4e8f8045725027e5cddf8129e0de0e753893
Opcode Fuzzy Hash: 0328bc8ef6a53200854c36a9a6d061530187d3d5cbec243a2c25dcd54762ec6b
Instruction Fuzzy Hash: 26F0C971A08F46C2DA34EB51F89492EB762FB483A0F404439E99D43725DF3CF0548B60

Non-executed Functions

Function 00007FF71EB13B50 Relevance: 121.2, APIs: 67, Strings: 1, Instructions: 2206COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 00007FF71EB13C75
memset.MSVCRT ref: 00007FF71EB13D9D
wcscat.MSVCRT ref: 00007FF71EB13DAD
memset.MSVCRT ref: 00007FF71EB13DC1
wcslen.MSVCRT ref: 00007FF71EB13E2A
_wcsnicmp.MSVCRT ref: 00007FF71EB13E59
wcslen.MSVCRT ref: 00007FF71EB13E69
wcscpy.MSVCRT ref: 00007FF71EB13EEA
wcscat.MSVCRT ref: 00007FF71EB13EF9
memset.MSVCRT ref: 00007FF71EB13F0A
wcscpy.MSVCRT ref: 00007FF71EB14032
wcscat.MSVCRT ref: 00007FF71EB14041
memset.MSVCRT ref: 00007FF71EB1405E
wcslen.MSVCRT ref: 00007FF71EB140DC
_wcsnicmp.MSVCRT ref: 00007FF71EB14109
wcslen.MSVCRT ref: 00007FF71EB14119
wcscpy.MSVCRT ref: 00007FF71EB143B0
wcscat.MSVCRT ref: 00007FF71EB143BF
memset.MSVCRT ref: 00007FF71EB143D3
wcscpy.MSVCRT ref: 00007FF71EB1443B
wcscat.MSVCRT ref: 00007FF71EB1444A
memset.MSVCRT ref: 00007FF71EB1445E
wcscpy.MSVCRT ref: 00007FF71EB144E6
wcscat.MSVCRT ref: 00007FF71EB144F5
memset.MSVCRT ref: 00007FF71EB14509
wcscpy.MSVCRT ref: 00007FF71EB1455C
wcscat.MSVCRT ref: 00007FF71EB1456B

Part of subcall function 00007FF71EB12DF0: memset.MSVCRT ref: 00007FF71EB12E1D

memset.MSVCRT ref: 00007FF71EB1484F
wcscpy.MSVCRT ref: 00007FF71EB148B5
wcscat.MSVCRT ref: 00007FF71EB148C4
memset.MSVCRT ref: 00007FF71EB148DB
wcscpy.MSVCRT ref: 00007FF71EB1493A
wcscat.MSVCRT ref: 00007FF71EB14949
wcslen.MSVCRT ref: 00007FF71EB1495C
wcslen.MSVCRT ref: 00007FF71EB14B4F
wcslen.MSVCRT ref: 00007FF71EB14CB4
memset.MSVCRT ref: 00007FF71EB14D1B
wcscpy.MSVCRT ref: 00007FF71EB14DAE
wcscat.MSVCRT ref: 00007FF71EB14DBD
wcslen.MSVCRT ref: 00007FF71EB15319
memset.MSVCRT ref: 00007FF71EB153A5
wcslen.MSVCRT ref: 00007FF71EB1541C
_wcsnicmp.MSVCRT ref: 00007FF71EB1548F
_wcsicmp.MSVCRT ref: 00007FF71EB15653
memset.MSVCRT ref: 00007FF71EB15672
wcscpy.MSVCRT ref: 00007FF71EB156D3
wcscat.MSVCRT ref: 00007FF71EB156E2
wcslen.MSVCRT ref: 00007FF71EB156F5
wcslen.MSVCRT ref: 00007FF71EB15AC5
wcslen.MSVCRT ref: 00007FF71EB15C3C
_wcsnicmp.MSVCRT ref: 00007FF71EB15C69
wcslen.MSVCRT ref: 00007FF71EB15C79
wcslen.MSVCRT ref: 00007FF71EB15CF8
memset.MSVCRT ref: 00007FF71EB15E0B
wcscpy.MSVCRT ref: 00007FF71EB15E16
wcscat.MSVCRT ref: 00007FF71EB15E25
memset.MSVCRT ref: 00007FF71EB15EA5
wcslen.MSVCRT ref: 00007FF71EB15F0E
_wcsnicmp.MSVCRT ref: 00007FF71EB15F39
wcslen.MSVCRT ref: 00007FF71EB15F45
wcscat.MSVCRT ref: 00007FF71EB15F6B
memset.MSVCRT ref: 00007FF71EB15F7F
wcscpy.MSVCRT ref: 00007FF71EB16008
wcscat.MSVCRT ref: 00007FF71EB16017
wcslen.MSVCRT ref: 00007FF71EB16224
memcpy.MSVCRT ref: 00007FF71EB1665C
memcpy.MSVCRT ref: 00007FF71EB16D9C

Strings

, xrefs: 00007FF71EB15764

Memory Dump Source

Source File: 00000000.00000002.2163347669.00007FF71EB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71EB10000, based on PE: true

Associated: 00000000.00000002.2163329002.00007FF71EB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163366945.00007FF71EB19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163387987.00007FF71EB1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163409027.00007FF71EB1C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163809784.00007FF71ED97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163834082.00007FF71ED99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163863860.00007FF71ED9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71eb10000_WWhhc3A0rs.jbxd

Similarity

API ID: wcslen$memset$wcscat$wcscpy$_wcsnicmp$memcpy$_wcsicmp
String ID:
API String ID: 3604702941-3916222277
Opcode ID: db90249458c669816813ce45624f7ae6fb86a0956b0c7d6c9660714c4cc28e67
Instruction ID: 6cc750e7efb1bfc2e347e41d5e2886f61212c457f0b520ab35af7d92efdaf37d
Opcode Fuzzy Hash: db90249458c669816813ce45624f7ae6fb86a0956b0c7d6c9660714c4cc28e67
Instruction Fuzzy Hash: 76534921C2CEC684F732AB29AC016F8E761AF953B4F885235D98C575A5EF6D724CC324

Function 00007FF71EB13350 Relevance: 21.2, APIs: 9, Strings: 5, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF71EB133B2
memset.MSVCRT ref: 00007FF71EB13445
wcscpy.MSVCRT ref: 00007FF71EB1349D
wcscat.MSVCRT ref: 00007FF71EB134A8
wcslen.MSVCRT ref: 00007FF71EB134B9
memset.MSVCRT ref: 00007FF71EB135D4
wcscpy.MSVCRT ref: 00007FF71EB13635
wcscat.MSVCRT ref: 00007FF71EB13640
wcslen.MSVCRT ref: 00007FF71EB13654

Strings

0, xrefs: 00007FF71EB1368D
0, xrefs: 00007FF71EB134E6
, xrefs: 00007FF71EB136DD
@, xrefs: 00007FF71EB13698
@, xrefs: 00007FF71EB134F1

Memory Dump Source

Source File: 00000000.00000002.2163347669.00007FF71EB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71EB10000, based on PE: true

Associated: 00000000.00000002.2163329002.00007FF71EB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163366945.00007FF71EB19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163387987.00007FF71EB1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163409027.00007FF71EB1C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163809784.00007FF71ED97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163834082.00007FF71ED99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163863860.00007FF71ED9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71eb10000_WWhhc3A0rs.jbxd

Similarity

API ID: memset$wcscatwcscpywcslen
String ID: $0$0$@$@
API String ID: 4263182637-1413854666
Opcode ID: 6af65850cbe7cf858f5459e650824eeb499f5a742452982e0f30e052dc73b0d0
Instruction ID: 0159b94231e7f2813d8854f9fffdb5cba708231d0afbb7602b132c8227a6c4c6
Opcode Fuzzy Hash: 6af65850cbe7cf858f5459e650824eeb499f5a742452982e0f30e052dc73b0d0
Instruction Fuzzy Hash: E7B17C2191CAC685F331AB25F8457EAF7A1FB80364F801235EAC8576A5EF7CE149CB10

Function 00007FF71EB12690 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 322
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcsncmp.MSVCRT ref: 00007FF71EB12795
memset.MSVCRT ref: 00007FF71EB12865
wcscpy.MSVCRT ref: 00007FF71EB128CE
wcscat.MSVCRT ref: 00007FF71EB128D9
wcslen.MSVCRT ref: 00007FF71EB128E1
wcslen.MSVCRT ref: 00007FF71EB128F6
wcslen.MSVCRT ref: 00007FF71EB1296D
wcslen.MSVCRT ref: 00007FF71EB129E8

Strings

`, xrefs: 00007FF71EB12B91
X, xrefs: 00007FF71EB12B79
0, xrefs: 00007FF71EB1279A

Memory Dump Source

Source File: 00000000.00000002.2163347669.00007FF71EB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71EB10000, based on PE: true

Associated: 00000000.00000002.2163329002.00007FF71EB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163366945.00007FF71EB19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163387987.00007FF71EB1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163409027.00007FF71EB1C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163809784.00007FF71ED97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163834082.00007FF71ED99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163863860.00007FF71ED9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71eb10000_WWhhc3A0rs.jbxd

Similarity

API ID: wcslen$memsetwcscatwcscpywcsncmp
String ID: 0$X$`
API String ID: 329590056-2527496196
Opcode ID: 3e74067d2b8f6d9820809deb9a400a2305a428e80b628bc07cd27e0f0585ba98
Instruction ID: b897223f400764eebc7d42bc0a60f2975838e0b293a1d8bfc3e8b5f85ff0c07d
Opcode Fuzzy Hash: 3e74067d2b8f6d9820809deb9a400a2305a428e80b628bc07cd27e0f0585ba98
Instruction Fuzzy Hash: BD026922A08F8581E731AB19F8447AAB7A1FB857B4F814235DADC477A5DF3CE149C720

Function 00007FF71EB11BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,?,?,00007FF71EB1A4C4,00007FF71EB1A4C4,?,?,00007FF71EB10000,?,00007FF71EB11991), ref: 00007FF71EB11C63
VirtualProtect.KERNEL32(?,?,?,?,00007FF71EB1A4C4,00007FF71EB1A4C4,?,?,00007FF71EB10000,?,00007FF71EB11991), ref: 00007FF71EB11CC7
memcpy.MSVCRT ref: 00007FF71EB11CE0
GetLastError.KERNEL32(?,?,?,?,00007FF71EB1A4C4,00007FF71EB1A4C4,?,?,00007FF71EB10000,?,00007FF71EB11991), ref: 00007FF71EB11D23

Strings

VirtualProtect failed with code 0x%x, xrefs: 00007FF71EB11D29
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF71EB11D17
Address %p has no image-section, xrefs: 00007FF71EB11CF4

Memory Dump Source

Source File: 00000000.00000002.2163347669.00007FF71EB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71EB10000, based on PE: true

Associated: 00000000.00000002.2163329002.00007FF71EB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163366945.00007FF71EB19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163387987.00007FF71EB1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163409027.00007FF71EB1C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163809784.00007FF71ED97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163834082.00007FF71ED99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163863860.00007FF71ED9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71eb10000_WWhhc3A0rs.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuerymemcpy
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 2595394609-2123141913
Opcode ID: 7e47fe0a3cc757937b184265145bdf76f8034c5237edb91b9583e5a857b50cbf
Instruction ID: 78eabde92d4e7f50668bb55ee6653f5a3672314d3f78810a7088abf2fa7e672a
Opcode Fuzzy Hash: 7e47fe0a3cc757937b184265145bdf76f8034c5237edb91b9583e5a857b50cbf
Instruction Fuzzy Hash: F5418061A08E5681EA31AB05F844ABDA7E2EB84BB0FD54132CE4D87791DE3CF54DC360

Function 00007FF71EB12104 Relevance: 9.1, APIs: 6, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF71EB12118
TlsGetValue.KERNEL32 ref: 00007FF71EB1214F
GetLastError.KERNEL32 ref: 00007FF71EB12154
LeaveCriticalSection.KERNEL32 ref: 00007FF71EB12212
free.MSVCRT ref: 00007FF71EB12234
DeleteCriticalSection.KERNEL32 ref: 00007FF71EB1225D

Memory Dump Source

Source File: 00000000.00000002.2163347669.00007FF71EB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71EB10000, based on PE: true

Associated: 00000000.00000002.2163329002.00007FF71EB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163366945.00007FF71EB19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163387987.00007FF71EB1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163409027.00007FF71EB1C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163809784.00007FF71ED97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163834082.00007FF71ED99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163863860.00007FF71ED9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71eb10000_WWhhc3A0rs.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorLastLeaveValuefree
String ID:
API String ID: 3326252324-0
Opcode ID: a73ea2713171e8a047f8eee55ea44c161dcaa9f159f1f4536ae8616b18553079
Instruction ID: fc57a28b71966df3fcc3df0440cadc222d70d03fdd3ffe41cc97785a55ad23d3
Opcode Fuzzy Hash: a73ea2713171e8a047f8eee55ea44c161dcaa9f159f1f4536ae8616b18553079
Instruction Fuzzy Hash: 4921DB60E19E5681FA3ABB01F94077CA2A2BF10BB0FC54031C95D4B6A4DF2CB94ED361

Function 00007FF71EB11E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CCG , xrefs: 00007FF71EB11E27

Memory Dump Source

Source File: 00000000.00000002.2163347669.00007FF71EB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71EB10000, based on PE: true

Associated: 00000000.00000002.2163329002.00007FF71EB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163366945.00007FF71EB19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163387987.00007FF71EB1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163409027.00007FF71EB1C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163809784.00007FF71ED97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163834082.00007FF71ED99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163863860.00007FF71ED9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71eb10000_WWhhc3A0rs.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: 1c404e41e50540ab740d17b3dba579019ccfa589ac9c58556def001b72d5d7d4
Instruction ID: ad875ca3f5e0277d036c8f0830c4095a71875492733672a3fd570b8681085c07
Opcode Fuzzy Hash: 1c404e41e50540ab740d17b3dba579019ccfa589ac9c58556def001b72d5d7d4
Instruction Fuzzy Hash: 6821AE22F0D95641FA757354B580B7DA2D3AF84774FA48131D98D433D4CE2CF88A8261

Function 00007FF71EB11880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF71EB11247), ref: 00007FF71EB119F9

Strings

Unknown pseudo relocation bit size %d., xrefs: 00007FF71EB11B7B
Unknown pseudo relocation protocol version %d., xrefs: 00007FF71EB11B8B

Memory Dump Source

Source File: 00000000.00000002.2163347669.00007FF71EB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71EB10000, based on PE: true

Associated: 00000000.00000002.2163329002.00007FF71EB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163366945.00007FF71EB19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163387987.00007FF71EB1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163409027.00007FF71EB1C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163809784.00007FF71ED97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163834082.00007FF71ED99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163863860.00007FF71ED9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71eb10000_WWhhc3A0rs.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: 717b2846262b070cbf16f4917165f5bf06984c4257135dd60be662c50123eab4
Instruction ID: d31147593fc0d565bf1df132fee35307236bc73f3cb075384e8a5e26517eba5a
Opcode Fuzzy Hash: 717b2846262b070cbf16f4917165f5bf06984c4257135dd60be662c50123eab4
Instruction Fuzzy Hash: D6512135E14946D6EB30AB25F940BBCA7A2EB14BB4F884131D96D07794CE3CF58AC721

Function 00007FF71EB11800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 00007FF71EB1185A

Strings

Unknown error, xrefs: 00007FF71EB11824
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF71EB1184D

Memory Dump Source

Source File: 00000000.00000002.2163347669.00007FF71EB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71EB10000, based on PE: true

Associated: 00000000.00000002.2163329002.00007FF71EB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163366945.00007FF71EB19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163387987.00007FF71EB1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163409027.00007FF71EB1C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163809784.00007FF71ED97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163834082.00007FF71ED99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163863860.00007FF71ED9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71eb10000_WWhhc3A0rs.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: c3614a3824a7654001b9d39070aa49656cc15abf7340c2d830cf33f92ca81765
Instruction ID: 78fe8934c6acc572d9d9cb5c95da91c324fc4f8940e3003ab0c9fd0b849efd29
Opcode Fuzzy Hash: c3614a3824a7654001b9d39070aa49656cc15abf7340c2d830cf33f92ca81765
Instruction Fuzzy Hash: 88F0AF11E08E8582E631BB24B9414BDE362EB497B0F809231DE4E56251DF2CF186C310

Function 00007FF71EB1219E Relevance: 5.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF71EB121B2
TlsGetValue.KERNEL32 ref: 00007FF71EB121EB
GetLastError.KERNEL32 ref: 00007FF71EB121F0
LeaveCriticalSection.KERNEL32 ref: 00007FF71EB1226C

Memory Dump Source

Source File: 00000000.00000002.2163347669.00007FF71EB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71EB10000, based on PE: true

Associated: 00000000.00000002.2163329002.00007FF71EB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163366945.00007FF71EB19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163387987.00007FF71EB1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163409027.00007FF71EB1C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163809784.00007FF71ED97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163834082.00007FF71ED99000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2163863860.00007FF71ED9C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71eb10000_WWhhc3A0rs.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 4410bea657734efe7792d9b5e6ff5cd294ece7a39ccde5653083eadeaedea16a
Instruction ID: 33b75dc1610b8b57c4939b3663c5d9c275a8f91ea2919a5ba62baac9e9cfa2e4
Opcode Fuzzy Hash: 4410bea657734efe7792d9b5e6ff5cd294ece7a39ccde5653083eadeaedea16a
Instruction Fuzzy Hash: CD01DA65A09E0681E636BB11FE0467CA2A2BF04FB0FC54031CA1D57694DF2CB99ED360

Analysis Process: lwmyuxxpdkdz.exePID: 6732, Parent PID: 632COMMON

Execution Graph

Execution Coverage:	3.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1782
Total number of Limit Nodes:	2

Executed Functions

Function 00007FF701161160 Relevance: 13.6, APIs: 9, Instructions: 130
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,00007FF701161156), ref: 00007FF7011611A5
_amsg_exit.MSVCRT(?,?,?,00007FF701161156), ref: 00007FF7011611CC
_initterm.MSVCRT ref: 00007FF70116120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,00007FF701161156), ref: 00007FF70116124E
malloc.MSVCRT ref: 00007FF70116127E
strlen.MSVCRT ref: 00007FF7011612A4
malloc.MSVCRT ref: 00007FF7011612B0
memcpy.MSVCRT ref: 00007FF7011612C3
_cexit.MSVCRT(?,?,?,00007FF701161156), ref: 00007FF70116132D

Memory Dump Source

Source File: 00000018.00000002.2188621766.00007FF701161000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF701160000, based on PE: true

Associated: 00000018.00000002.2188594606.00007FF701160000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188647305.00007FF701169000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188674621.00007FF70116B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188907800.00007FF7013E9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188925400.00007FF7013EC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff701160000_lwmyuxxpdkdz.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
String ID:
API String ID: 2643109117-0
Opcode ID: 19a9fb927d1e6cd504815deac6584628b56f7f6ee1b9ed6be7109d8e51d185c5
Instruction ID: 6f40f79caf2dcdff54d843ffdc4936b84d88b7513e5e7c06d1edbc3a6e842816
Opcode Fuzzy Hash: 19a9fb927d1e6cd504815deac6584628b56f7f6ee1b9ed6be7109d8e51d185c5
Instruction Fuzzy Hash: B5515575A19B0695FB18BB25FD503B9E3A5BF88784F809035CA0D833A1DFBEA4518360

Function 00007FF701161394 Relevance: 1.5, APIs: 1, Instructions: 24
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtManageHotPatch.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF701161156), ref: 00007FF7011613F7

Memory Dump Source

Source File: 00000018.00000002.2188621766.00007FF701161000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF701160000, based on PE: true

Associated: 00000018.00000002.2188594606.00007FF701160000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188647305.00007FF701169000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188674621.00007FF70116B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188907800.00007FF7013E9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188925400.00007FF7013EC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff701160000_lwmyuxxpdkdz.jbxd

Similarity

API ID: ManagePatch
String ID:
API String ID: 863949556-0
Opcode ID: 0328bc8ef6a53200854c36a9a6d061530187d3d5cbec243a2c25dcd54762ec6b
Instruction ID: 24d18318abf6459c782bb5039b9639707ab948e91b45861f676a6c94a14994fb
Opcode Fuzzy Hash: 0328bc8ef6a53200854c36a9a6d061530187d3d5cbec243a2c25dcd54762ec6b
Instruction Fuzzy Hash: 0CF0B272A0CB4682D718EB51FC4002ABBB0FF98380B404839EA9C82725DFBDE050CB64

Non-executed Functions

Function 00007FF701163350 Relevance: 21.2, APIs: 9, Strings: 5, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF7011633B2
memset.MSVCRT ref: 00007FF701163445
wcscpy.MSVCRT ref: 00007FF70116349D
wcscat.MSVCRT ref: 00007FF7011634A8
wcslen.MSVCRT ref: 00007FF7011634B9
memset.MSVCRT ref: 00007FF7011635D4
wcscpy.MSVCRT ref: 00007FF701163635
wcscat.MSVCRT ref: 00007FF701163640
wcslen.MSVCRT ref: 00007FF701163654

Strings

0, xrefs: 00007FF70116368D
@, xrefs: 00007FF7011634F1
0, xrefs: 00007FF7011634E6
@, xrefs: 00007FF701163698
, xrefs: 00007FF7011636DD

Memory Dump Source

Source File: 00000018.00000002.2188621766.00007FF701161000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF701160000, based on PE: true

Associated: 00000018.00000002.2188594606.00007FF701160000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188647305.00007FF701169000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188674621.00007FF70116B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188907800.00007FF7013E9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188925400.00007FF7013EC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff701160000_lwmyuxxpdkdz.jbxd

Similarity

API ID: memset$wcscatwcscpywcslen
String ID: $0$0$@$@
API String ID: 4263182637-1413854666
Opcode ID: 6af65850cbe7cf858f5459e650824eeb499f5a742452982e0f30e052dc73b0d0
Instruction ID: 5b489c7c63140a25023f580e88a1a5fa58824b2cb63115956e2636f7495abf1a
Opcode Fuzzy Hash: 6af65850cbe7cf858f5459e650824eeb499f5a742452982e0f30e052dc73b0d0
Instruction Fuzzy Hash: 2CB17E2191CBC285F725AB25F8453BAF7A0FF90348F805239EA8C52695DFBED145CB60

Function 00007FF701162690 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 322
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcsncmp.MSVCRT ref: 00007FF701162795
memset.MSVCRT ref: 00007FF701162865
wcscpy.MSVCRT ref: 00007FF7011628CE
wcscat.MSVCRT ref: 00007FF7011628D9
wcslen.MSVCRT ref: 00007FF7011628E1
wcslen.MSVCRT ref: 00007FF7011628F6
wcslen.MSVCRT ref: 00007FF70116296D
wcslen.MSVCRT ref: 00007FF7011629E8

Strings

0, xrefs: 00007FF70116279A
`, xrefs: 00007FF701162B91
X, xrefs: 00007FF701162B79

Memory Dump Source

Source File: 00000018.00000002.2188621766.00007FF701161000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF701160000, based on PE: true

Associated: 00000018.00000002.2188594606.00007FF701160000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188647305.00007FF701169000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188674621.00007FF70116B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188907800.00007FF7013E9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188925400.00007FF7013EC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff701160000_lwmyuxxpdkdz.jbxd

Similarity

API ID: wcslen$memsetwcscatwcscpywcsncmp
String ID: 0$X$`
API String ID: 329590056-2527496196
Opcode ID: 3e74067d2b8f6d9820809deb9a400a2305a428e80b628bc07cd27e0f0585ba98
Instruction ID: 9ad42e07f897b08dfcc8b41e645dc698d8cabf70221ccc5386f170d998d9c566
Opcode Fuzzy Hash: 3e74067d2b8f6d9820809deb9a400a2305a428e80b628bc07cd27e0f0585ba98
Instruction Fuzzy Hash: 14026C22908B8181E720AB19FC443AAF7A4FF857A8F804239EA9C477E5DFBDD145C750

Function 00007FF701161BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,?,?,00007FF70116A4C4,00007FF70116A4C4,?,?,00007FF701160000,?,00007FF701161991), ref: 00007FF701161C63
VirtualProtect.KERNEL32(?,?,?,?,00007FF70116A4C4,00007FF70116A4C4,?,?,00007FF701160000,?,00007FF701161991), ref: 00007FF701161CC7
memcpy.MSVCRT ref: 00007FF701161CE0
GetLastError.KERNEL32(?,?,?,?,00007FF70116A4C4,00007FF70116A4C4,?,?,00007FF701160000,?,00007FF701161991), ref: 00007FF701161D23

Strings

VirtualProtect failed with code 0x%x, xrefs: 00007FF701161D29
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF701161D17
Address %p has no image-section, xrefs: 00007FF701161CF4

Memory Dump Source

Source File: 00000018.00000002.2188621766.00007FF701161000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF701160000, based on PE: true

Associated: 00000018.00000002.2188594606.00007FF701160000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188647305.00007FF701169000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188674621.00007FF70116B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188907800.00007FF7013E9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188925400.00007FF7013EC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff701160000_lwmyuxxpdkdz.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuerymemcpy
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 2595394609-2123141913
Opcode ID: 7e47fe0a3cc757937b184265145bdf76f8034c5237edb91b9583e5a857b50cbf
Instruction ID: f35faa150b09a134261aa54fb586c400c9b6e85fde707cb40ddb8aea6e93765a
Opcode Fuzzy Hash: 7e47fe0a3cc757937b184265145bdf76f8034c5237edb91b9583e5a857b50cbf
Instruction Fuzzy Hash: A1419061A08A4691EB18AB05FC446BCB7A0EF95BC4FD48436CE0D83795DFBEE541C360

Function 00007FF701162104 Relevance: 9.1, APIs: 6, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF701162118
TlsGetValue.KERNEL32 ref: 00007FF70116214F
GetLastError.KERNEL32 ref: 00007FF701162154
LeaveCriticalSection.KERNEL32 ref: 00007FF701162212
free.MSVCRT ref: 00007FF701162234
DeleteCriticalSection.KERNEL32 ref: 00007FF70116225D

Memory Dump Source

Source File: 00000018.00000002.2188621766.00007FF701161000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF701160000, based on PE: true

Associated: 00000018.00000002.2188594606.00007FF701160000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188647305.00007FF701169000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188674621.00007FF70116B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188907800.00007FF7013E9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188925400.00007FF7013EC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff701160000_lwmyuxxpdkdz.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorLastLeaveValuefree
String ID:
API String ID: 3326252324-0
Opcode ID: a73ea2713171e8a047f8eee55ea44c161dcaa9f159f1f4536ae8616b18553079
Instruction ID: 05fcfb0f62414ccdc21330374a0ed9787120dfe9a8742f8f79d91e58fbc29ec0
Opcode Fuzzy Hash: a73ea2713171e8a047f8eee55ea44c161dcaa9f159f1f4536ae8616b18553079
Instruction Fuzzy Hash: B321C924A09A0281FB19BB01FD45374F6A1BF20B95FC44039C90D576A4DFBEB846C360

Function 00007FF701161E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CCG , xrefs: 00007FF701161E27

Memory Dump Source

Source File: 00000018.00000002.2188621766.00007FF701161000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF701160000, based on PE: true

Associated: 00000018.00000002.2188594606.00007FF701160000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188647305.00007FF701169000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188674621.00007FF70116B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188907800.00007FF7013E9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188925400.00007FF7013EC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff701160000_lwmyuxxpdkdz.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: 1c404e41e50540ab740d17b3dba579019ccfa589ac9c58556def001b72d5d7d4
Instruction ID: 0e0c077e2389ab9dc09b2f81cd16efe0846a4ed668a4d48396a6c82b26a59dbf
Opcode Fuzzy Hash: 1c404e41e50540ab740d17b3dba579019ccfa589ac9c58556def001b72d5d7d4
Instruction Fuzzy Hash: B121DE22F0C21651FB2DB324BD8037991819FD4764FA48575D90D833D4CFEEEC8982A2

Function 00007FF701161880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF701161247), ref: 00007FF7011619F9

Strings

Unknown pseudo relocation bit size %d., xrefs: 00007FF701161B7B
Unknown pseudo relocation protocol version %d., xrefs: 00007FF701161B8B

Memory Dump Source

Source File: 00000018.00000002.2188621766.00007FF701161000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF701160000, based on PE: true

Associated: 00000018.00000002.2188594606.00007FF701160000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188647305.00007FF701169000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188674621.00007FF70116B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188907800.00007FF7013E9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188925400.00007FF7013EC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff701160000_lwmyuxxpdkdz.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: 717b2846262b070cbf16f4917165f5bf06984c4257135dd60be662c50123eab4
Instruction ID: 11f8f0382dc5f4d9ad9bcc1ebf58d3ffa01812db9a178edb1b67a0f406b6bf43
Opcode Fuzzy Hash: 717b2846262b070cbf16f4917165f5bf06984c4257135dd60be662c50123eab4
Instruction Fuzzy Hash: A1516F22E08546D6EB18AB21FC407B8B7A1EF54B98F849135D91C07794DFBEE481C720

Function 00007FF701161800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 00007FF70116185A

Strings

Unknown error, xrefs: 00007FF701161824
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF70116184D

Memory Dump Source

Source File: 00000018.00000002.2188621766.00007FF701161000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF701160000, based on PE: true

Associated: 00000018.00000002.2188594606.00007FF701160000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188647305.00007FF701169000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188674621.00007FF70116B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188907800.00007FF7013E9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188925400.00007FF7013EC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff701160000_lwmyuxxpdkdz.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: c3614a3824a7654001b9d39070aa49656cc15abf7340c2d830cf33f92ca81765
Instruction ID: 604c85177740a2a0b961d12bb6668da54afa43531845160f020ef6917797ceb2
Opcode Fuzzy Hash: c3614a3824a7654001b9d39070aa49656cc15abf7340c2d830cf33f92ca81765
Instruction Fuzzy Hash: 2CF0C211E08A4982E714BB24BD410B9E361EF493D4F90D235DE4D53255DF6DE1828310

Function 00007FF70116219E Relevance: 5.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7011621B2
TlsGetValue.KERNEL32 ref: 00007FF7011621EB
GetLastError.KERNEL32 ref: 00007FF7011621F0
LeaveCriticalSection.KERNEL32 ref: 00007FF70116226C

Memory Dump Source

Source File: 00000018.00000002.2188621766.00007FF701161000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF701160000, based on PE: true

Associated: 00000018.00000002.2188594606.00007FF701160000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188647305.00007FF701169000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188674621.00007FF70116B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188907800.00007FF7013E9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2188925400.00007FF7013EC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff701160000_lwmyuxxpdkdz.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 4410bea657734efe7792d9b5e6ff5cd294ece7a39ccde5653083eadeaedea16a
Instruction ID: 4fd915e376cc2f4d9b20d05994451e46c6902ce01cc12ae09bebad57e1f7c4fe
Opcode Fuzzy Hash: 4410bea657734efe7792d9b5e6ff5cd294ece7a39ccde5653083eadeaedea16a
Instruction Fuzzy Hash: 1501E825A0DA0282F71ABB11FD04274F2A0BF14B95FC48035CA0D536A4DFBEB996C260

Analysis Process: conhost.exePID: 6508, Parent PID: 6732COMMON

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	829
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0000000140001394 Relevance: 1.5, APIs: 1, Instructions: 24
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtReleaseWorkerFactoryWorker.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001156), ref: 00000001400013F7

Memory Dump Source

Source File: 00000023.00000002.3365332941.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000023.00000002.3365239770.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000023.00000002.3366595443.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000023.00000002.3366690377.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000023.00000002.3366732968.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_140000000_conhost.jbxd

Similarity

API ID: Worker$FactoryRelease
String ID:
API String ID: 4113960433-0
Opcode ID: 1e727cabbff0cae9e27b261b2207436e6fa371e00c3f64abe26120617a749e69
Instruction ID: 0a01b27cd887de470f3a79e9e26df08ee21fc81555de9c41fe10c45f52e6a1ec
Opcode Fuzzy Hash: 1e727cabbff0cae9e27b261b2207436e6fa371e00c3f64abe26120617a749e69
Instruction Fuzzy Hash: CAF0AFB2608B408AEA12DF52F89579A77A0F38D7C0F00991ABBC843735DB3CC190CB40

Non-executed Functions

Function 00000001400026E0 Relevance: 19.6, APIs: 7, Strings: 4, Instructions: 376
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcsncmp.MSVCRT ref: 00000001400028F4
wcscpy.MSVCRT ref: 0000000140002A25
wcscat.MSVCRT ref: 0000000140002A30
wcslen.MSVCRT ref: 0000000140002A38
wcslen.MSVCRT ref: 0000000140002A50
wcslen.MSVCRT ref: 0000000140002AB0
wcslen.MSVCRT ref: 0000000140002B02

Strings

\BaseNamedObjects\ebrlswnkdyyxlbjuhpveplar, xrefs: 00000001400026E9
`, xrefs: 0000000140002CAB
X, xrefs: 0000000140002C93
0, xrefs: 00000001400028F9

Memory Dump Source

Source File: 00000023.00000002.3365332941.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000023.00000002.3365239770.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000023.00000002.3366595443.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000023.00000002.3366690377.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000023.00000002.3366732968.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_140000000_conhost.jbxd

Similarity

API ID: wcslen$wcscatwcscpywcsncmp
String ID: 0$X$\BaseNamedObjects\ebrlswnkdyyxlbjuhpveplar$`
API String ID: 597572034-3053274307
Opcode ID: 8a08bf91d6c25843e63d5b2ff1be0b4d4663f99253e455713b2a47471607218e
Instruction ID: 54cc81b0cc6ec1b059e349223bab6f0a862094673fb8261370da5aef119cf5ad
Opcode Fuzzy Hash: 8a08bf91d6c25843e63d5b2ff1be0b4d4663f99253e455713b2a47471607218e
Instruction Fuzzy Hash: 801248B2608BC085E762CB16F8443EA77A4F789794F414215EBA857BF5EF78C189C700

Function 0000000140001160 Relevance: 13.6, APIs: 9, Instructions: 130
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,0000000140001156), ref: 00000001400011A5
_amsg_exit.MSVCRT(?,?,?,0000000140001156), ref: 00000001400011CC
_initterm.MSVCRT ref: 000000014000120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,0000000140001156), ref: 000000014000124E
malloc.MSVCRT ref: 000000014000127E
strlen.MSVCRT ref: 00000001400012A4
malloc.MSVCRT ref: 00000001400012B0
memcpy.MSVCRT ref: 00000001400012C3
_cexit.MSVCRT(?,?,?,0000000140001156), ref: 000000014000132D

Memory Dump Source

Source File: 00000023.00000002.3365332941.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000023.00000002.3365239770.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000023.00000002.3366595443.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000023.00000002.3366690377.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000023.00000002.3366732968.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_140000000_conhost.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
String ID:
API String ID: 2643109117-0
Opcode ID: c4d67565a20342ade335354fc59ecc84fd5eb261badca5579fbb5ee24efd579b
Instruction ID: 070ab519a2817fabac9d3928640a8dfc31f1868cd1d81c957eb574597805d415
Opcode Fuzzy Hash: c4d67565a20342ade335354fc59ecc84fd5eb261badca5579fbb5ee24efd579b
Instruction Fuzzy Hash: E05113B1A11A4085FB16EF27F9947EA27A5BB8D7D0F849121FB4D873B6DE38C4958300

Function 0000000140001BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,?,?,0000000140007C14,0000000140007C14,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001C63
VirtualProtect.KERNEL32(?,?,?,?,0000000140007C14,0000000140007C14,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001CC7
memcpy.MSVCRT ref: 0000000140001CE0
GetLastError.KERNEL32(?,?,?,?,0000000140007C14,0000000140007C14,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001D23

Strings

Address %p has no image-section, xrefs: 0000000140001CF4
VirtualProtect failed with code 0x%x, xrefs: 0000000140001D29
VirtualQuery failed for %d bytes at address %p, xrefs: 0000000140001D17

Memory Dump Source

Source File: 00000023.00000002.3365332941.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000023.00000002.3365239770.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000023.00000002.3366595443.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000023.00000002.3366690377.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000023.00000002.3366732968.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_140000000_conhost.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuerymemcpy
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 2595394609-2123141913
Opcode ID: 79a2a9d4ac031f2ce5fafed73baa3885646a95f71b85d3d4911c59ac99310c7d
Instruction ID: 568161692b5c4f8a705951d6b28697fc04e6310cca5c6e1950853b3621b7b2e0
Opcode Fuzzy Hash: 79a2a9d4ac031f2ce5fafed73baa3885646a95f71b85d3d4911c59ac99310c7d
Instruction Fuzzy Hash: 334143F1601A4586FA26DF47F884BE927A0E78DBC4F554126EF0E877B1DA38C586C700

Function 0000000140002104 Relevance: 7.6, APIs: 5, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140002118
TlsGetValue.KERNEL32 ref: 000000014000214F
GetLastError.KERNEL32 ref: 0000000140002154
LeaveCriticalSection.KERNEL32 ref: 0000000140002212
DeleteCriticalSection.KERNEL32 ref: 000000014000225D

Memory Dump Source

Source File: 00000023.00000002.3365332941.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000023.00000002.3365239770.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000023.00000002.3366595443.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000023.00000002.3366690377.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000023.00000002.3366732968.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_140000000_conhost.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorLastLeaveValue
String ID:
API String ID: 926137887-0
Opcode ID: 90a19a65f5c6fc128aa79077d7c42a4fb441e5ead76d492d121654b50c4905b0
Instruction ID: f187cb6aa2ea60f0469956b9f5200469d8ecfadf0b7e99ee31c93393cd0a6912
Opcode Fuzzy Hash: 90a19a65f5c6fc128aa79077d7c42a4fb441e5ead76d492d121654b50c4905b0
Instruction Fuzzy Hash: 1521E0B1715A1292FA5BEB53F9483E923A0B76CBD0F444021FB1E576B4DB7A8986C300

Function 0000000140001880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001247), ref: 00000001400019F9

Strings

Unknown pseudo relocation bit size %d., xrefs: 0000000140001B7B
Unknown pseudo relocation protocol version %d., xrefs: 0000000140001B8B

Memory Dump Source

Source File: 00000023.00000002.3365332941.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000023.00000002.3365239770.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000023.00000002.3366595443.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000023.00000002.3366690377.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000023.00000002.3366732968.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_140000000_conhost.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: a6faf70e8b190511a78e30de1eab31b3fdd89b936d163022cdfacdbb5805c305
Instruction ID: bed1886f8e7b3562c786f91e2c2504e2a336d35a61311b426e06807153cec951
Opcode Fuzzy Hash: a6faf70e8b190511a78e30de1eab31b3fdd89b936d163022cdfacdbb5805c305
Instruction Fuzzy Hash: 415114B6B11544DAEB12CF67F840BE827A1A759BE8F548212FB1D077B4DB38C986C700

Function 0000000140001800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 000000014000185A

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 000000014000184D
Unknown error, xrefs: 0000000140001824

Memory Dump Source

Source File: 00000023.00000002.3365332941.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000023.00000002.3365239770.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000023.00000002.3366595443.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000023.00000002.3366690377.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000023.00000002.3366732968.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_140000000_conhost.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 6b47e17b8a12b31c17ff5f2ad6e06330f120307e4e61a4ac2284c96fa72ab60d
Instruction ID: 91e3a911f83b651f4698e80430053fdc384feaeeeedb9bbeb5e2969e9f62671f
Opcode Fuzzy Hash: 6b47e17b8a12b31c17ff5f2ad6e06330f120307e4e61a4ac2284c96fa72ab60d
Instruction Fuzzy Hash: BDF0C271A04A4482E212EB2AB9413EAA360E74D3C1F409211FF4D532A1DF3CD1828300

Function 000000014000219E Relevance: 5.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00000001400021B2
TlsGetValue.KERNEL32 ref: 00000001400021EB
GetLastError.KERNEL32 ref: 00000001400021F0
LeaveCriticalSection.KERNEL32 ref: 000000014000226C

Memory Dump Source

Source File: 00000023.00000002.3365332941.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000023.00000002.3365239770.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000023.00000002.3366595443.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000023.00000002.3366690377.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000023.00000002.3366732968.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_140000000_conhost.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: ef714723185b3a8d2aed80037f9450dbdc245cd35eb766ee46406a0163f8cc51
Instruction ID: 8e08899b71d5d6c295770fc95a4fa8b22c720a8a39741bac27afb53efd3d8dea
Opcode Fuzzy Hash: ef714723185b3a8d2aed80037f9450dbdc245cd35eb766ee46406a0163f8cc51
Instruction Fuzzy Hash: C201B2B5705A0192FA5BDB53FE083E86360B76CBD1F454061EF0957AB4DF79C996C200

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report WWhhc3A0rs.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Change of critical system settings

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Change of critical system settings

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\xjnogmzwawzj\lwmyuxxpdkdz.exe

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1oy11hsh.c3w.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5gzr1fdm.dyh.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nnfm2p3b.jxa.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xqalxiqd.lmf.ps1

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Windows\Temp\__PSScriptPolicyTest_1agdplkg.wcb.psm1

C:\Windows\Temp\__PSScriptPolicyTest_eoluthrv.kz2.ps1

C:\Windows\Temp\__PSScriptPolicyTest_h001acxy.31r.psm1

C:\Windows\Temp\__PSScriptPolicyTest_kfz4gov4.ce0.ps1

C:\Windows\Temp\uoqzkgppgdee.sys

Static File Info

General

Windows Analysis Report
WWhhc3A0rs.exe